Argo CD MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow Argo CD version and deployment-action coverage because cluster changes are high impact

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Inspecting and operating Argo CD applications with an explicit read-only option.

What we know

Argo CD ecosystem MCP supporting clusters/projects/apps/resources/logs plus create/update/delete/sync/resource actions.

Maintenance / activity evidence

Observed Aug 11, 2026 (UTC)Merge commit from fork

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Argo token/RBAC; MCP_READ_ONLY disables mutation tools. Writes: Create/update/delete applications; Sync; Run resource actions.
Argo API token + optional inbound MCP token.
Sensitive access: Deployment state, Workload logs, Argo credentials

A write-capable deployment-control integration; use read-only mode and separate inbound auth where possible.

Security source · repository notice ↗Security source · policy file ↗Security source · policy file (attribution not established) ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

576 repository stars

Stars observed Sep 25, 2026.

Do not overwrite existing reviewed stars/download metrics with nulls from this enrichment batch.

All limitations / Review context

Which Argo CD read and write operations are documented for MCP?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

A write-capable deployment-control integration; use read-only mode and separate inbound auth where possible.
Argo token/RBAC; MCP_READ_ONLY disables mutation tools.
Argo API token + optional inbound MCP token.
Can expose deployment configuration, resource trees and logs.
Reviewed write actions: Create/update/delete applications; Sync; Run resource actions
Sensitive access: Deployment state, Workload logs, Argo credentials
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Requires Argo CD API access/token.
HTTP inbound auth is separate from outbound Argo credentials.
Disabling TLS verification is explicitly unsafe.

Original activity observations

2026-08-11T15:27:11Z: Merge commit from fork

Technical identity

github.com/argoproj-labs/mcp-for-argocd

Exact implementation source: https://github.com/argoproj-labs/mcp-for-argocd ↗
Reviewed resource type: MCP Server
Repository identity: argoproj-labs/mcp-for-argocd
Package identity: npm:argocd-mcp
Service endpoint: http://127.0.0.1:3000/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 7, 2026

GitHub repository ↗
argoproj-labs/mcp-for-argocd
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
In Cursor MCP config, register `argocd-mcp` command `npx`, args `["argocd-mcp@latest","stdio"]`, with ARGOCD_BASE_URL and ARGOCD_API_TOKEN. Never confuse launching a stdio subprocess with successful API authentication.
npx argocd-mcp@latest stdio
Configure / authenticate
Publisher instructions
Create an Argo CD API token with least privilege, supply ARGOCD_BASE_URL and ARGOCD_API_TOKEN, and register argocd-mcp@latest stdio via the official Cursor-compatible JSON for your selected client. This MCP can sync/create/delete applications: use read-only permissions for initial testing.
Advanced configuration · claude desktop json
{ "mcpServers": { "argocd-mcp": { "args": [ "argocd-mcp@latest", "stdio" ], "command": "npx", "env": { "ARGOCD_API_TOKEN": "<argocd_token>", "ARGOCD_BASE_URL": "<argocd_url>" } } } }
Check connection
Suggested check
After successful registration, inspect Argo CD tools and list_applications or get_application in an approved non-production namespace. Avoid sync/create/delete/run_resource_action smoke calls.
Remove / uninstall / revoke
Delete only `argocd-mcp` from `.cursor/mcp.json` or equivalent client registry and restart/reload the agent. This does not remove any Argo CD applications. In the MCP client settings remove only the `mcpServers.argocd-mcp` entry and restart/reload. This is a concrete client disconnect, separate from uninstalling the local package.

Official Documentation & Sources

What it does

Argo CD ecosystem MCP supporting clusters/projects/apps/resources/logs plus create/update/delete/sync/resource actions.

Capability: Cloud & DevOps
Resource type: MCP Server
Best fit: Inspecting and operating Argo CD applications with an explicit read-only option.

Representative uses

Inspect clusters/apps/resources/logs
Create/update/delete applications
Sync applications
Run resource actions

Limitations

Requires Argo CD API access/token.
HTTP inbound auth is separate from outbound Argo credentials.
Disabling TLS verification is explicitly unsafe.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Argo API token + optional inbound MCP token.
Permissions: Argo token/RBAC; MCP_READ_ONLY disables mutation tools.
Data handling: Can expose deployment configuration, resource trees and logs.
Cost: unknown
Risk and cautions: A write-capable deployment-control integration; use read-only mode and separate inbound auth where possible.

Access scope and cautions

Write actions: Create/update/delete applications Sync Run resource actions
Sensitive access: Deployment state Workload logs Argo credentials
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Inspect clusters/apps/resources/logs; Create/update/delete applications; Sync applications; Run resource actions.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx argocd-mcp@latest stdio. Recorded endpoint: http://127.0.0.1:3000/mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: ARGOCD_BASE_URL; ARGOCD_API_TOKEN; MCP_AUTH_TOKEN optional; MCP_READ_ONLY optional. No configuration values are supplied here. Prerequisites: Node 18+; Argo CD. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Argo CD API token; optional separate inbound bearer for HTTP.

Can it modify data or perform write operations?

Documented write actions include: Create/update/delete applications; Sync; Run resource actions. Recorded permission boundary: Argo token/RBAC; MCP_READ_ONLY disables mutation tools.

What data-handling boundary should I consider?

Can expose deployment configuration, resource trees and logs. Recorded sensitive-access context: Deployment state; Workload logs; Argo credentials.

What limitations and risks should I check before use?

A write-capable deployment-control integration; use read-only mode and separate inbound auth where possible. Requires Argo CD API access/token. HTTP inbound auth is separate from outbound Argo credentials. Disabling TLS verification is explicitly unsafe. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

argoproj-labs is listed as Ecosystem official in MCP100’s current evidence.