argocd-mcp

An MCP server for Argo CD, giving AI assistants tools to inspect and operate on clusters, projects, and applications: listing and syncing applications, reading resource trees and workload logs, and running resource actions, among fourteen tools named in the README. It is distributed as npm:argocd-mcp and as container images at ghcr.io/argoproj-labs/mcp-for-argocd and quay.io/argoprojlabs/mcp-for-argocd, run over stdio, HTTP stream, or SSE; no hosted remote endpoint exists, so every deployment is self-run. A security advisory's own negative control describes the tool list falling from fifteen to ten tools in read-only mode, one more than the README's fourteen named tools, a discrepancy left unresolved here rather than guessed at.

The server lives in argoproj-labs, a GitHub org separate from argoproj, the org that owns Argo CD itself. argoproj-labs' own profile README states it is "not part of the CNCF Argo umbrella projects," and the Argo Project's community governance document in the argoproj/argoproj repository describes it as an org the project set up "for community contributions related to the Argoproj ecosystem," with repos "administered by the owners of each project." The README credits the server's creation to four named engineers from Akuity, the company Argo CD's co-founders started, who donated it to the labs org. Argo CD is a CNCF project, and neither Argo CD's repository nor its documentation links this server. On the site's definition, a server is first-party only when published by the vendor of the service it fronts; the Argo Project's own framing of argoproj-labs as a community-contribution space places this one in community, with well-identified maintainers.

CVE-2026-82456 affected version 0.8.0: the HTTP transport bound to every network interface and accepted MCP sessions without caller credentials whenever ARGOCD_API_TOKEN was configured, exposing the operator's stored token and full tool surface to any network peer. Both CVSS 3.1 and 4.0 scored it 10.0. The fix shipped in v0.9.0 on 2026-08-11, the same day as advisory GHSA-rp45-5x3v-48mr, eighteen days before the CVE record was published on 2026-08-29, and added the optional MCP_AUTH_TOKEN inbound credential described above. See the published story for the disclosure timeline.