How to Deploy Your Agent on Kubernetes with Fastio MCP

Fastio MCP is a remote service. You do not install, containerize, or operate the Fastio MCP server in your cluster. Your Kubernetes workload contains your own agent application and an MCP client that connects over HTTPS to https://mcp.fast.io/mcp using Streamable HTTP.

If the agent authenticates with a scoped key, configure the client URL as https://mcp.fast.io/mcp/key and send the key as a bearer token. The legacy endpoint at https://mcp.fast.io/sse remains available for clients that require SSE. This separation keeps storage, indexing, and MCP service operations on Fastio infrastructure while Kubernetes handles the agent's compute, scaling, and release lifecycle.

The resulting architecture is simple: a pod runs your agent, the agent's MCP client opens an outbound HTTPS connection, and Fastio applies the key's workspace and action scope. Helm gives you repeatable configuration across development, staging, and production without turning the remote service into a cluster workload.

• How to Deploy Fastio MCP Server on VercelDeploying the Fastio MCP server on Vercel enables scalable, serverless access to your agent's file tools without...
• How to Deploy Fastio MCP Server on Azure Container AppsConnecting agent runtimes on Azure Container Apps to the Fastio remote MCP server provides a secure, serverless...
• How to Deploy a Fastio MCP Server on RenderDeploying a Fastio MCP server on Render requires configuring environment variables and web services to expose tools....
• How to Deploy a Kubernetes MCP Server for AI Platform DevOpsRunning AI agents with full admin access to Kubernetes clusters introduces significant security risks. By deploying a...
• How to Deploy and Host an MCP ServerMoving an MCP server from localhost to a production environment gives remote access to AI agents across your...
• How to Deploy Containerized MCP ServersContainerized MCP servers package tools for scalable, portable AI agent integrations. This guide walks through Docker...

More on this subject: MCP and Model Context Protocol (195 guides)

Before deployment, package your agent application in a container image and confirm that its MCP client supports remote Streamable HTTP connections. The image contains your code and its normal dependencies. It does not contain a Fastio MCP package or Fastio language SDK.

Create a dedicated Fastio scoped key for the agent. Limit it to the workspace and actions the agent needs. Store the value in a Kubernetes Secret or an external secret manager, never in the image, chart defaults, or source repository.

Your Helm chart should expose only the settings owned by your application, such as the agent image, replica count, MCP URL, secret reference, resource limits, and health checks. Keep environment-specific values in separate values files so promotion between clusters does not require template edits.

Pass the hosted endpoint to your agent as configuration. The example below uses the scoped-key endpoint and reads the bearer token from an existing Kubernetes Secret.

replicaCount: 2

image:
  repository: your-registry/your-agent
  tag: "1.0.0"
  pullPolicy: IfNotPresent

fastioMcp:
  url: "https://mcp.fast.io/mcp/key"
  existingSecret: "fastio-agent-credentials"
  secretKey: "api-key"

resources:
  requests:
    cpu: "250m"
    memory: "256Mi"
  limits:
    cpu: "1"
    memory: "1Gi"

Map fastioMcp.url into the URL field expected by your MCP client. Map the secret value into an environment variable, then have the client send Authorization: Bearer <key> without logging the header. If your client does not need scoped-key authentication, use https://mcp.fast.io/mcp instead.

Connect Your Kubernetes Agent to Fastio

Deploy your agent with Helm, point its MCP client at Fastio's hosted endpoint, and protect access with a scoped key.

Start 14-Day Trial

A default-deny NetworkPolicy reduces the destinations a compromised agent can reach. Allow outbound TCP port 443 to the infrastructure required to resolve and reach mcp.fast.io, plus any model provider or internal service the agent genuinely needs. The exact policy depends on your cluster's network plugin because standard Kubernetes NetworkPolicy resources do not select destinations by hostname.

If your platform supports domain-aware egress controls, allow mcp.fast.io directly. Otherwise, route outbound traffic through an egress gateway or proxy that enforces the hostname policy. Keep inbound exposure minimal. An agent that receives work from a queue may need no public Ingress at all.

Apply Kubernetes Pod Security Standards to your agent pods. Run as a non-root user, drop unnecessary Linux capabilities, use a read-only root filesystem where practical, and assign a dedicated service account with no cluster-wide permissions.

Scale the agent based on signals that reflect its own workload, such as queue depth, request latency, CPU, or memory. Fastio operates the remote MCP service, so you do not create replicas or autoscaling rules for it in your chart.

Add liveness checks for a stuck agent process and readiness checks that confirm the pod can accept work. A transient remote dependency failure should normally produce a clear retry path with exponential backoff rather than force every healthy pod to restart at once.

Collect agent logs and metrics without recording scoped keys, authorization headers, or sensitive file contents. Track connection failures, authentication errors, retry counts, and tool-call latency. Compare those signals with Fastio activity and audit information when investigating access or data-handling issues.

Rotate a scoped key by creating a replacement with the same or narrower permissions, updating the Kubernetes Secret, rolling the agent deployment, and verifying successful connections before revoking the old key. A checksum annotation on the pod template can trigger a rollout when secret material changes.

For authentication failures, confirm that the client uses https://mcp.fast.io/mcp/key, sends the key as a bearer token, and has permission for the requested workspace. For transport failures, confirm that the client supports Streamable HTTP and that cluster egress permits HTTPS to mcp.fast.io.

If an older client only supports SSE, use https://mcp.fast.io/sse. Do not replace the remote URL with an internal service name, local executable, or container address. Those patterns describe a self-hosted server and do not apply to Fastio MCP.