The Kubernetes control room—built in Rust, ready for engineers and AI agents.

English · 简体中文 · 日本語 · 한국어 · Español · Português · Deutsch · Français

srelens is an open-source, local-first Kubernetes workspace for SREs, platform engineers and DevOps engineers. Investigate, analyse and take safe action across clusters — from a desktop app, from a terminal UI, or through an MCP server your AI agent can call. One pure-Rust core drives all three.

Website · Install · Desktop app · Terminal UI · MCP server · User guide · Developer guide · Contributing

---

Pick your surface

	Desktop app (GUI)	Terminal UI (srectl)
What it is	A native window built with Tauri v2 and React 19	One self-contained binary built with ratatui
Best for	Daily cluster work, YAML editing, topology, many clusters side by side	SSH sessions, jump hosts, keyboard-only flow, k9s muscle memory
Runs on	macOS, Linux, Windows — or in a browser via web mode	Linux (glibc and static musl) and macOS on x86-64 and arm64; Windows on x86-64
Install	Download a release	Homebrew or one line
AI	Built-in assistant, plus the MCP server in Settings → MCP	:ai assistant, plus srectl mcp over stdio

Both talk to your clusters directly with the credentials in your local kubeconfig. Nothing is routed through a srelens cloud service.

Why srelens?

Kubernetes troubleshooting usually means hopping between terminals, dashboards, YAML editors, logs and cluster contexts. srelens brings that investigation loop into one local-first workspace.

• One workspace from investigation to action — browse resources, read events and YAML, follow logs, open shells, forward ports and take cluster actions without switching tools.
• Built for engineers and AI agents — the backend capabilities you use in the app are the same ones exposed through the built-in MCP server.
• Local-first cluster access — srelens connects straight to your API servers with your own kubeconfig credentials.
• Safe operations — destructive actions are identified and confirmation-gated, in the app, in the terminal and over MCP.
• Small and fast — a Rust core on the operating system's WebView. srelens v0.5.0 shipped a 17.1 MiB macOS installer and a 19.8 MiB Linux .deb, against 190.2 MiB and 146.8 MiB for Freelens v1.10.3 — roughly 11× and 7× smaller. The performance baselines show how to reproduce that, including where the gap is narrower.
• Open source — MIT licensed, with public code, releases, issues and roadmap.

Desktop app

The desktop app is a full Kubernetes workspace in a native window. The screenshots below are the new design, which is the default. It has six themes: Light, Paper, Dark, Midnight, Glass and High contrast. The classic design is deprecated and will be removed in a future version; until then you can switch to it in Settings → Appearance → Design.

Live resources — watch-driven tables with filters, columns and bulk actions	Resource details — status, events, owners, and one-click logs, shell and forward
Logs — multi-pod streams, previous instance, filters, export and AI summaries	YAML — schema-aware editing, server dry run, diff and server-side apply
Topology — who calls whom, and where the failure starts	Helm — install, upgrade, roll back and uninstall with a rendered diff

What you can do in it — the user guide covers each in depth:

• Multi-cluster workspace — discover kubeconfig contexts, add or paste more files, give each context a name, logo and colour, and switch clusters from the cluster rail. Contexts that share a name across files stay distinct.
• Live Kubernetes resources — workloads, networking, storage, RBAC, admission, autoscaling and custom resources, with live watches, search, column pickers, namespace scoping and bulk actions.
• Resource details and YAML — manifests, events, relationships and metrics; schema-aware YAML with validation, dry-run diffs and server-side apply.
• Logs — pod or workload streams with previous-instance logs, timestamps, tail and since-window controls, per-source colours, container filters and export.
• Terminals and shells — pod exec, a context-scoped local terminal, ephemeral debug containers for distroless pods, and privileged node shells.
• Port forwarding — create, inspect, copy and stop forwards across every open cluster.
• Helm — inspect releases, and install, upgrade, roll back or uninstall them with a values editor and rendered-diff preview.
• Operational actions — scale, restart rollouts, evict or delete pods, suspend or trigger CronJobs, cordon and drain nodes, all behind confirmation gates.
• Toolbox — install and manage kubectl, krew, helm and krew plugins, and diagnose a context's exec-auth requirements.
• Metrics — node and pod CPU and memory when metrics-server is available.
• AI assistant — ask about the cluster in front of you, summarise a log stream, or explain a Helm diff.
• Command palette — keyboard-first navigation (Cmd/Ctrl-K) across views, contexts and resources.
• Web mode — run the same app as a multi-user web server in Docker, with OIDC sign-in and per-user isolation. See docs/WEB.md.

Terminal UI (srectl)

srectl is srelens in your terminal: one binary, k9s-style navigation, and the same Rust core as the desktop app. It is at home over SSH, on a jump host, or anywhere a window is not.

Relationship tree — owners, children, config and services in one view	Logs — follow, search, timestamps, previous instance and save
Helm — revisions, values diff, manifest and rollback	GPU inspector — GPU and VRAM allocation per node and per pod
Argo CD — sync, health and drift across hub and spoke clusters	AI assistant — asks the cluster through tools, with SRE playbooks

• k9s-style navigation — : opens the command prompt (:pod, :deploy, :svc, :no, :ns, :helm, :pf, :ctx …), / filters, j/k move, Enter drills down and Esc goes back.
• Act on what you see — logs (l), shell (s), describe (d), YAML (y), edit (e), port forward (f), delete (Ctrl-d) and a quick-actions palette (x) for restart, scale and more.
• Investigate — relationship tree (t), :top hotspots by CPU and memory, :topo topology, a cluster overview, and node SSH for recovery.
• Beyond the basics — Argo CD (:argo), GPU and VRAM (:gpuinfo), and BGP peering (:bgp) views.
• AI assistant — :ai with Anthropic (Claude), OpenAI, Google Gemini, any OpenAI-compatible endpoint such as Ollama, or Cursor Agent.
• Headless helpers — srectl info lists the contexts in your kubeconfig, srectl toolbox checks for kubectl, helm and krew, and srectl mcp runs the MCP server over stdio.
• Signed self-update — srectl update installs a release only when its checksums are signed by a srelens release key built into the binary.

srectl                      # start on the current context
srectl -n payments          # start on the Pods view, scoped to a namespace
srectl --context prod -A    # pick a context, all namespaces
srectl pods/my-pod          # open straight onto a resource
srectl --help               # every flag

Install

Every release is on GitHub Releases. The installation guide covers first launch, updating, verifying downloads and uninstalling on each platform.

Desktop app

Platform	Packages	Notes
macOS	.dmg for Apple Silicon and Intel	Developer ID signed and notarized
Linux	.AppImage, .deb, .rpm, and srelens-bin on the AUR	The AppImage supports the in-app updater
Windows	.exe, .msi	Windows may show a SmartScreen prompt while code signing remains on the roadmap

Terminal UI

v0.15.0 and earlier publish the terminal UI under its old name, srelens-tui. The Linux one-liner handles that and installs it as srectl. With Homebrew, run brew install srelens/tap/srelens-tui until a release ships under the new name; the command it installs is srelens-tui. Those releases' archives are srelens-tui-<version>-<target>.tar.gz.

macOS (Homebrew):

brew install srelens/tap/srectl

Linux, in one line:

( f="$(mktemp)" && trap 'rm -f "$f"' EXIT &&
  curl -fsSL https://raw.githubusercontent.com/srelens/srelens/main/packaging/install/install.sh -o "$f" &&
  sh "$f" )

Or download srectl-<version>-<target>.tar.gz (or .zip on Windows) from the release, for Linux (glibc and static musl) and macOS on x86-64 and arm64, and for Windows on x86-64. macOS builds on a stable release are signed and notarized.

Nix, from this repository — srectl is the default package, and the same flake builds the desktop app (#srelens) and the web server (#srelens-server):

nix profile install github:srelens/srelens#srectl

Nix owns that copy, so srectl update declines. The installation guide has the other two packages and nix profile upgrade.

Web app (Docker)

srelens also runs as a multi-user web server in a container. Users sign in with OIDC (or a local dev login for trials) and each gets an isolated environment built only from their own uploaded kubeconfigs. OIDC-protected clusters sign in from the browser, with no kubelogin or exec plugin needed, and kubeconfigs and tokens are sealed at rest under a required SRELENS_MASTER_KEY. See docs/WEB.md for deployment and the full security model.

MCP server

srelens includes an MCP server generated from the same capability registry as the backend, so MCP-capable clients get the same cluster operations without a separate integration layer.

In the desktop app, open Settings → MCP to:

• run the server over loopback HTTP, protected by a bearer token you can reveal, rotate or revoke — rotating restarts the running server so the new token takes effect at once, and revoking stops it;
• install the srelens CLI for stdio connections, which need no token, because the client already holds your privileges by spawning the process;
• copy client configuration for supported MCP clients.

Or start it directly — from the desktop binary, or from the terminal UI:

srelens --mcp-stdio
srelens --mcp-http 127.0.0.1:8765
srectl mcp

Example stdio configuration:

{
  "mcpServers": {
    "srelens": {
      "command": "srelens",
      "args": ["--mcp-stdio"]
    }
  }
}

Destructive tools prompt for confirmation in the app. Headless runs have no dialog to show, so they need "_confirm": true on the call and a process-level opt-in: --mcp-allow-destructive to change anything, or --mcp-allow-sensitive-reads to read Secrets (--allow-destructive and --allow-sensitive-reads on srectl mcp). The two are independent, so reading a Secret never implies permission to drain a node. See docs/MCP.md for the full security model, including the Host-header check, audit log and token storage.

MCP access uses your locally authenticated cluster contexts. Review tool calls and use appropriate Kubernetes RBAC permissions, especially with critical clusters.

Build from source

Prerequisites

• Rust stable
• Node.js 26 (development default; Node 24 LTS is also supported). Run nvm install && nvm use to use the version in .nvmrc.
• pnpm 11+ (the exact version is pinned in package.json)
• Tauri v2 system dependencies
• A reachable Kubernetes cluster for cluster-dependent workflows

Run locally

git clone https://github.com/srelens/srelens
cd srelens
pnpm install
pnpm dev                  # the desktop app
cargo run -p srectl       # the terminal UI

Useful commands

Command	Purpose
pnpm dev	Launch the desktop application in development mode
cargo run -p srectl	Run the terminal UI
pnpm test	Run JavaScript and TypeScript tests
cargo test	Run Rust workspace tests
pnpm build	Build the production frontend
pnpm tauri build	Create packaged desktop binaries

See the developer guide for architecture, testing standards and how to add a capability.

Architecture

 Desktop app (React 19 + Tauri v2)   Terminal UI (srectl)   MCP clients   Web app
                 │                           │                  │            │
                 └───────────────┬───────────┴──────────────────┴────────────┘
                                 ▼
                         Pure-Rust core
                         ├── capability registry
                         ├── Kubernetes integration with kube-rs
                         ├── live watches, logs, exec and port forwarding
                         ├── Helm and metrics
                         └── MCP server over stdio and loopback HTTP

Repository layout:

apps/
  desktop/               Tauri desktop app: React UI (src/) and Rust bridge (src-tauri/)
  tui/                   srectl, the terminal UI
packages/
  core/                  Shared frontend service layer
  ui-kit/                Design-system components
  ui-next/               The new desktop design
crates/
  capability/            Backend capability registry
  kube/                  Kubernetes clients, watches, actions, Helm and metrics
  mcp/                   MCP server
  registry/              Where every backend capability is registered
  server/                Web mode server
  streams/               Streaming cores shared by desktop and web
  agent/, llm/           AI assistant and agent-CLI bridge
  plugin-host/           Extension host
docs/                    Installation, usage, development and project documentation

Project status

srelens is stable and in active development, with regular releases for macOS, Linux and Windows. macOS builds are Developer ID signed and notarized, and supported packages update in place. New capabilities land continuously, so the release notes are worth a glance when you upgrade.

• Latest release
• All releases
• Issues and roadmap

Community

• r/srelens on Reddit — announcements, questions and feedback
• srelens on Slack — chat with maintainers and other users
• Issues — bugs and feature requests
• Website

Contributing

Contributions are welcome. Start with the contribution guide, the developer guide, the MCP agent integration guide and the open issues. Please review the Code of Conduct before participating.

Translations live in docs/i18n. The English README is the source of truth; a fix to a translation, or a new language, is welcome as a pull request.

License

srelens is open source under the MIT License.

---

_{Not affiliated with Mirantis Lens or the Freelens project.}