Feature Description
Most of the planned MCP toolset consists of thin wrappers around the Kubernetes API, list, get, create, update, delete, plus a few kcp-specific operations. For agents that have a shell and kubectl (Claude Code, Cowork, and similar), we could investigate, if they are productive against kcp: agent skills.
A skill is a markdown document (SKILL.md) the agent loads on demand, teaching it what it doesn't know, kcp's concepts (workspaces vs namespaces, logical cluster paths, APIBindings/APIExports), how to obtain scoped access, how to navigate between workspaces, and the common failure modes, while the agent uses the generic tools it already has.
This doesn't replace the MCP integration. Remote MCP clients without an execution environment still need the MCP VW, and the skills path hands the agent a real credential, which is exactly the agent-delegation exposure the ADR's threat model flags, so which path a deployment allows is a policy decision, not just a convenience one. But for shell-capable agents, skills avoid maintaining a tool schema per operation and typically produce better results than constrained toolsets. It also makes the SCAR → kubeconfig flow (scar-to-kubeconfig) a first-class entry point rather than a side utility.
Proposed Solution
Write and ship a set of skills covering: kcp fundamentals for agents (concepts, URL/path model, workspace navigation), getting scoped access via SCAR and scar-to-kubeconfig, day-to-day operations (inspecting APIBindings, creating workspaces, working with APIExports), and Platform Mesh specifics on top (org model, account structure, how authorization behaves). Validate them against real agent sessions, the test is whether an agent with no kcp knowledge completes a set of representative tasks using only the skill and kubectl.
Alternative Solutions
No response
Additional Context
No response
Feature Description
Most of the planned MCP toolset consists of thin wrappers around the Kubernetes API, list, get, create, update, delete, plus a few kcp-specific operations. For agents that have a shell and kubectl (Claude Code, Cowork, and similar), we could investigate, if they are productive against kcp: agent skills.
A skill is a markdown document (SKILL.md) the agent loads on demand, teaching it what it doesn't know, kcp's concepts (workspaces vs namespaces, logical cluster paths, APIBindings/APIExports), how to obtain scoped access, how to navigate between workspaces, and the common failure modes, while the agent uses the generic tools it already has.
This doesn't replace the MCP integration. Remote MCP clients without an execution environment still need the MCP VW, and the skills path hands the agent a real credential, which is exactly the agent-delegation exposure the ADR's threat model flags, so which path a deployment allows is a policy decision, not just a convenience one. But for shell-capable agents, skills avoid maintaining a tool schema per operation and typically produce better results than constrained toolsets. It also makes the SCAR → kubeconfig flow (scar-to-kubeconfig) a first-class entry point rather than a side utility.
Proposed Solution
Write and ship a set of skills covering: kcp fundamentals for agents (concepts, URL/path model, workspace navigation), getting scoped access via SCAR and scar-to-kubeconfig, day-to-day operations (inspecting APIBindings, creating workspaces, working with APIExports), and Platform Mesh specifics on top (org model, account structure, how authorization behaves). Validate them against real agent sessions, the test is whether an agent with no kcp knowledge completes a set of representative tasks using only the skill and kubectl.
Alternative Solutions
No response
Additional Context
No response