@dockndevai/mcp-kubernetes 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ankit Verma
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,89 @@
+# mcp-kubernetes
+
+[![CI](https://github.com/dockndevai/mcp-kubernetes/actions/workflows/ci.yml/badge.svg)](https://github.com/dockndevai/mcp-kubernetes/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
+
+A [Model Context Protocol](https://modelcontextprotocol.io) server for **Kubernetes**. It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) inspect and operate Kubernetes clusters across multiple contexts — with behaviour controlled entirely by flags.
+
+The design goal is **safe by default**: it starts read-only, can be scoped to an allowlist of namespaces and contexts, protects system namespaces from mutation, and gates the dangerous operations (delete, apply, exec) behind explicit opt-ins.
+
+## Features
+
+- **Multi-cluster** — every tool accepts an optional `context`; scope which contexts are usable with an allowlist.
+- **Access modes** — `read-only` → `read-write` → `admin`, layered so a mode never exposes tools above its level.
+- **Security flags** — namespace allowlist, protected namespaces, context allowlist, plus independent opt-ins for delete / apply / exec, dry-run, and JSON audit logging (see below).
+- **Standard auth** — uses your kube-config (or in-cluster service account). No credentials are stored by the server.
+
+## Security model
+
+| Concern | Flag | Default | Effect |
+| --- | --- | --- | --- |
+| What can the server do at all? | `K8S_MODE` | `read-only` | `read-only` exposes only reads; `read-write` adds mutations; `admin` adds destructive tools. Tools above the mode are **never registered**. |
+| Which namespaces are in scope? | `K8S_NAMESPACE_ALLOWLIST` | *(all)* | When set, any operation on a namespace outside the list is refused. |
+| Which namespaces are read-only forever? | `K8S_PROTECTED_NAMESPACES` | `kube-system,kube-public,kube-node-lease` | Can be read but never mutated or deleted, regardless of mode. |
+| Which clusters are reachable? | `K8S_CONTEXT_ALLOWLIST` | *(all)* | When set, only these kube-config contexts may be targeted. |
+| Can it delete? | `K8S_ALLOW_DELETE` | `false` | `delete_resource` needs this **and** admin mode. |
+| Can it apply manifests? | `K8S_ALLOW_APPLY` | `false` | `apply_manifest` needs this **and** read-write mode. |
+| Can it exec into pods? | `K8S_ALLOW_EXEC` | `false` | `exec_in_pod` needs this **and** admin mode; the tool isn't even registered otherwise. |
+| Preview without touching the cluster | `K8S_DRY_RUN` | `false` | Write/admin tools validate + log intent, then return without calling the API. |
+| Audit trail | `K8S_AUDIT_LOG` | `true` | Emits a JSON line to stderr per guarded operation (`ALLOW` / `DENY` / `DRY_RUN`). |
+
+The layers are independent — e.g. `admin` mode with all three opt-ins `false` can restart and scale deployments but can neither delete resources nor exec into pods.
+
+## Tools
+
+**Read** (`read-only`+): `list_contexts`, `list_namespaces`, `list_pods`, `get_pod`, `get_pod_logs`, `list_deployments`, `list_services`, `list_nodes`, `list_events`, `get_resource`
+
+**Write** (`read-write`+): `scale_deployment`, `restart_deployment`, `set_deployment_image`, `create_namespace`, `apply_manifest` (needs `K8S_ALLOW_APPLY`)
+
+**Admin** (`admin`): `delete_resource` (needs `K8S_ALLOW_DELETE`), `exec_in_pod` (needs `K8S_ALLOW_EXEC`)
+
+## Use with your MCP client
+
+Works with Claude Code, Claude Desktop, Cursor, OpenAI Codex CLI, Windsurf, VS Code (Copilot), and any other MCP client — see **[docs/CLIENTS.md](docs/CLIENTS.md)** for per-client setup.
+
+## Install
+
+```bash
+npm install
+npm run build
+```
+
+## Run with Claude Desktop / Claude Code
+
+Add to your MCP client configuration:
+
+```json
+{
+  "mcpServers": {
+    "kubernetes": {
+      "command": "node",
+      "args": ["/absolute/path/to/mcp-kubernetes/dist/index.js"],
+      "env": {
+        "KUBECONFIG_PATH": "/Users/you/.kube/config",
+        "K8S_MODE": "read-only",
+        "K8S_CONTEXT_ALLOWLIST": "staging",
+        "K8S_NAMESPACE_ALLOWLIST": "app,web"
+      }
+    }
+  }
+}
+```
+
+Bump `K8S_MODE` to `read-write` for scaling/restarts, and to `admin` (plus the relevant `K8S_ALLOW_*` flag) only when you intend to allow deletes or exec.
+
+## Develop
+
+```bash
+npm run dev        # watch mode
+npm test           # unit tests for the security policy
+npm run typecheck
+```
+
+## Publishing
+
+This server ships a [`server.json`](server.json) for the official MCP registry and an [`mcpName`](package.json) for npm ownership validation. See **[PUBLISHING.md](PUBLISHING.md)** for publishing to npm and listing on the MCP registry, Smithery, Glama, Cursor, and PulseMCP.
+
+## License
+
+MIT

package/dist/config.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Configuration from environment variables. Cluster connection details come
+ * from a standard kube-config (KUBECONFIG or ~/.kube/config, or in-cluster).
+ */
+import type { SecurityConfig } from "./security.js";
+export interface KubeConnection {
+    /** Explicit path to a kube-config file. Empty = default resolution. */
+    kubeconfigPath?: string;
+    /** Load in-cluster config (service account) instead of a kube-config file. */
+    inCluster: boolean;
+    /** Default context to use when a tool call omits one. Empty = current-context. */
+    defaultContext?: string;
+}
+export interface AppConfig {
+    connection: KubeConnection;
+    security: SecurityConfig;
+}
+export declare function loadConfig(): AppConfig;

package/dist/config.js

@@ -0,0 +1,44 @@
+const DEFAULT_PROTECTED = ["kube-system", "kube-public", "kube-node-lease"];
+function bool(name, fallback) {
+    const v = process.env[name];
+    if (v === undefined || v === "")
+        return fallback;
+    return ["1", "true", "yes", "on"].includes(v.toLowerCase());
+}
+function list(name) {
+    const v = process.env[name];
+    if (!v)
+        return [];
+    return v
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function parseMode() {
+    const raw = (process.env.K8S_MODE ?? "read-only").toLowerCase();
+    if (raw === "read-only" || raw === "read-write" || raw === "admin")
+        return raw;
+    throw new Error(`Invalid K8S_MODE '${raw}'. Expected one of: read-only, read-write, admin.`);
+}
+export function loadConfig() {
+    const protectedNs = list("K8S_PROTECTED_NAMESPACES");
+    return {
+        connection: {
+            kubeconfigPath: process.env.KUBECONFIG_PATH || undefined,
+            inCluster: bool("K8S_IN_CLUSTER", false),
+            defaultContext: process.env.K8S_CONTEXT || undefined,
+        },
+        security: {
+            mode: parseMode(),
+            namespaceAllowlist: list("K8S_NAMESPACE_ALLOWLIST"),
+            protectedNamespaces: protectedNs.length ? protectedNs : DEFAULT_PROTECTED,
+            contextAllowlist: list("K8S_CONTEXT_ALLOWLIST"),
+            allowDelete: bool("K8S_ALLOW_DELETE", false),
+            allowApply: bool("K8S_ALLOW_APPLY", false),
+            allowExec: bool("K8S_ALLOW_EXEC", false),
+            dryRun: bool("K8S_DRY_RUN", false),
+            auditLog: bool("K8S_AUDIT_LOG", true),
+        },
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAoBA,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAE5E,SAAS,IAAI,CAAC,IAAY,EAAE,QAAiB;IAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,CAAC;SACL,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IAC/E,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,mDAAmD,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACrD,OAAO;QACL,UAAU,EAAE;YACV,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS;YACxD,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC;YACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS;SACrD;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,SAAS,EAAE;YACjB,kBAAkB,EAAE,IAAI,CAAC,yBAAyB,CAAC;YACnD,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB;YACzE,gBAAgB,EAAE,IAAI,CAAC,uBAAuB,CAAC;YAC/C,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC;YAC5C,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC;YAC1C,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC;YACxC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC;YAClC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC;SACtC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadConfig } from "./config.js";
+import { buildServer } from "./server.js";
+async function main() {
+    let config;
+    try {
+        config = loadConfig();
+    }
+    catch (err) {
+        process.stderr.write(`[kubernetes-mcp] Configuration error: ${err.message}\n`);
+        process.exit(1);
+    }
+    let built;
+    try {
+        built = buildServer(config);
+    }
+    catch (err) {
+        process.stderr.write(`[kubernetes-mcp] Failed to load kube-config: ${err.message}\n` +
+            "Check KUBECONFIG_PATH / K8S_IN_CLUSTER and that a valid kube-config is present.\n");
+        process.exit(1);
+    }
+    process.stderr.write(`[kubernetes-mcp] Starting in '${config.security.mode}' mode` +
+        `${config.security.dryRun ? " (DRY RUN)" : ""}. ` +
+        `${built.enabled.length} tools enabled: ${built.enabled.join(", ")}\n`);
+    const transport = new StdioServerTransport();
+    await built.server.connect(transport);
+}
+main().catch((err) => {
+    process.stderr.write(`[kubernetes-mcp] Fatal: ${err.stack ?? err}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,UAAU,IAAI;IACjB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAA0C,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAiD,GAAa,CAAC,OAAO,IAAI;YACxE,mFAAmF,CACtF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ;QAC3D,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI;QACjD,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,mBAAmB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACzE,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA4B,GAAa,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC;IACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/k8s/client.d.ts

@@ -0,0 +1,47 @@
+import { type KubernetesObject } from "@kubernetes/client-node";
+import type { KubeConnection } from "../config.js";
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+}
+export declare class K8sClient {
+    private readonly base;
+    constructor(conn: KubeConnection);
+    /** Names of all contexts in the loaded kube-config. */
+    listContextNames(): {
+        name: string;
+        cluster: string;
+        current: boolean;
+    }[];
+    currentContext(): string;
+    /** Return a KubeConfig scoped to a specific context (or the default). */
+    private scoped;
+    private core;
+    private apps;
+    private objects;
+    listNamespaces(context?: string): Promise<import("@kubernetes/client-node").V1NamespaceList>;
+    listPods(namespace: string, context?: string): Promise<import("@kubernetes/client-node").V1PodList>;
+    getPod(name: string, namespace: string, context?: string): Promise<import("@kubernetes/client-node").V1Pod>;
+    getPodLogs(name: string, namespace: string, opts: {
+        container?: string;
+        tailLines?: number;
+        previous?: boolean;
+    }, context?: string): Promise<string>;
+    listDeployments(namespace: string, context?: string): Promise<import("@kubernetes/client-node").V1DeploymentList>;
+    listServices(namespace: string, context?: string): Promise<import("@kubernetes/client-node").V1ServiceList>;
+    listNodes(context?: string): Promise<import("@kubernetes/client-node").V1NodeList>;
+    listEvents(namespace: string, context?: string): Promise<import("@kubernetes/client-node").CoreV1EventList>;
+    getObject(apiVersion: string, kind: string, name: string, namespace: string | undefined, context?: string): Promise<KubernetesObject>;
+    scaleDeployment(name: string, namespace: string, replicas: number, context?: string): Promise<import("@kubernetes/client-node").V1Deployment>;
+    restartDeployment(name: string, namespace: string, context?: string): Promise<import("@kubernetes/client-node").V1Deployment>;
+    setDeploymentImage(name: string, namespace: string, container: string, image: string, context?: string): Promise<import("@kubernetes/client-node").V1Deployment>;
+    createNamespace(name: string, context?: string): Promise<import("@kubernetes/client-node").V1Namespace>;
+    /** Create the object if absent, otherwise replace it (preserving resourceVersion). */
+    applyObject(obj: KubernetesObject, context?: string): Promise<{
+        action: "created" | "replaced";
+    }>;
+    deleteObject(apiVersion: string, kind: string, name: string, namespace: string | undefined, context?: string): Promise<import("@kubernetes/client-node").V1Status>;
+    /** Execute a command in a pod container and collect stdout/stderr. */
+    execInPod(name: string, namespace: string, container: string, command: string[], context?: string): Promise<ExecResult>;
+}

package/dist/k8s/client.js

@@ -0,0 +1,177 @@
+/**
+ * Thin wrapper over @kubernetes/client-node. Handles kube-config loading,
+ * per-call context selection, and the handful of operations the tools need.
+ */
+import { PassThrough } from "node:stream";
+import { AppsV1Api, CoreV1Api, Exec, KubeConfig, KubernetesObjectApi, } from "@kubernetes/client-node";
+export class K8sClient {
+    base;
+    constructor(conn) {
+        this.base = new KubeConfig();
+        if (conn.inCluster) {
+            this.base.loadFromCluster();
+        }
+        else if (conn.kubeconfigPath) {
+            this.base.loadFromFile(conn.kubeconfigPath);
+        }
+        else {
+            this.base.loadFromDefault();
+        }
+        if (conn.defaultContext) {
+            this.base.setCurrentContext(conn.defaultContext);
+        }
+    }
+    /** Names of all contexts in the loaded kube-config. */
+    listContextNames() {
+        const current = this.base.getCurrentContext();
+        return this.base.getContexts().map((c) => ({
+            name: c.name,
+            cluster: c.cluster,
+            current: c.name === current,
+        }));
+    }
+    currentContext() {
+        return this.base.getCurrentContext();
+    }
+    /** Return a KubeConfig scoped to a specific context (or the default). */
+    scoped(context) {
+        if (!context)
+            return this.base;
+        const kc = new KubeConfig();
+        kc.loadFromString(this.base.exportConfig());
+        kc.setCurrentContext(context);
+        return kc;
+    }
+    core(context) {
+        return this.scoped(context).makeApiClient(CoreV1Api);
+    }
+    apps(context) {
+        return this.scoped(context).makeApiClient(AppsV1Api);
+    }
+    objects(context) {
+        return KubernetesObjectApi.makeApiClient(this.scoped(context));
+    }
+    // --- Reads -----------------------------------------------------------------
+    listNamespaces(context) {
+        return this.core(context).listNamespace();
+    }
+    listPods(namespace, context) {
+        return this.core(context).listNamespacedPod({ namespace });
+    }
+    getPod(name, namespace, context) {
+        return this.core(context).readNamespacedPod({ name, namespace });
+    }
+    getPodLogs(name, namespace, opts, context) {
+        return this.core(context).readNamespacedPodLog({
+            name,
+            namespace,
+            container: opts.container,
+            tailLines: opts.tailLines,
+            previous: opts.previous,
+        });
+    }
+    listDeployments(namespace, context) {
+        return this.apps(context).listNamespacedDeployment({ namespace });
+    }
+    listServices(namespace, context) {
+        return this.core(context).listNamespacedService({ namespace });
+    }
+    listNodes(context) {
+        return this.core(context).listNode();
+    }
+    listEvents(namespace, context) {
+        return this.core(context).listNamespacedEvent({ namespace });
+    }
+    getObject(apiVersion, kind, name, namespace, context) {
+        return this.objects(context).read({ apiVersion, kind, metadata: { name, namespace } });
+    }
+    // --- Writes ----------------------------------------------------------------
+    async scaleDeployment(name, namespace, replicas, context) {
+        const apps = this.apps(context);
+        const dep = await apps.readNamespacedDeployment({ name, namespace });
+        if (!dep.spec)
+            throw new Error(`Deployment '${name}' has no spec.`);
+        dep.spec.replicas = replicas;
+        return apps.replaceNamespacedDeployment({ name, namespace, body: dep });
+    }
+    async restartDeployment(name, namespace, context) {
+        const apps = this.apps(context);
+        const dep = await apps.readNamespacedDeployment({ name, namespace });
+        if (!dep.spec)
+            throw new Error(`Deployment '${name}' has no spec.`);
+        dep.spec.template.metadata = dep.spec.template.metadata ?? {};
+        dep.spec.template.metadata.annotations = {
+            ...(dep.spec.template.metadata.annotations ?? {}),
+            "kubectl.kubernetes.io/restartedAt": new Date().toISOString(),
+        };
+        return apps.replaceNamespacedDeployment({ name, namespace, body: dep });
+    }
+    async setDeploymentImage(name, namespace, container, image, context) {
+        const apps = this.apps(context);
+        const dep = await apps.readNamespacedDeployment({ name, namespace });
+        const containers = dep.spec?.template?.spec?.containers ?? [];
+        const target = containers.find((c) => c.name === container);
+        if (!target) {
+            throw new Error(`Container '${container}' not found in deployment '${name}'. Containers: ${containers
+                .map((c) => c.name)
+                .join(", ")}`);
+        }
+        target.image = image;
+        return apps.replaceNamespacedDeployment({ name, namespace, body: dep });
+    }
+    createNamespace(name, context) {
+        return this.core(context).createNamespace({ body: { metadata: { name } } });
+    }
+    /** Create the object if absent, otherwise replace it (preserving resourceVersion). */
+    async applyObject(obj, context) {
+        const api = this.objects(context);
+        try {
+            const existing = await api.read(obj);
+            const merged = {
+                ...obj,
+                metadata: {
+                    ...obj.metadata,
+                    resourceVersion: existing.metadata?.resourceVersion,
+                },
+            };
+            await api.replace(merged);
+            return { action: "replaced" };
+        }
+        catch {
+            await api.create(obj);
+            return { action: "created" };
+        }
+    }
+    // --- Admin -----------------------------------------------------------------
+    deleteObject(apiVersion, kind, name, namespace, context) {
+        return this.objects(context).delete({ apiVersion, kind, metadata: { name, namespace } });
+    }
+    /** Execute a command in a pod container and collect stdout/stderr. */
+    async execInPod(name, namespace, container, command, context) {
+        const kc = this.scoped(context);
+        const exec = new Exec(kc);
+        const stdout = new PassThrough();
+        const stderr = new PassThrough();
+        const outChunks = [];
+        const errChunks = [];
+        stdout.on("data", (c) => outChunks.push(Buffer.from(c)));
+        stderr.on("data", (c) => errChunks.push(Buffer.from(c)));
+        return new Promise((resolve, reject) => {
+            exec
+                .exec(namespace, name, container, command, stdout, stderr, null, false, (status) => {
+                const exitCode = status?.status === "Success"
+                    ? 0
+                    : typeof (status?.details?.causes?.[0]?.message) === "string"
+                        ? Number(status.details.causes[0].message) || 1
+                        : 1;
+                resolve({
+                    stdout: Buffer.concat(outChunks).toString("utf8"),
+                    stderr: Buffer.concat(errChunks).toString("utf8"),
+                    exitCode,
+                });
+            })
+                .catch(reject);
+        });
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/k8s/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/k8s/client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,SAAS,EACT,SAAS,EACT,IAAI,EACJ,UAAU,EACV,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AAYjC,MAAM,OAAO,SAAS;IACH,IAAI,CAAa;IAElC,YAAY,IAAoB;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,CAAC;aAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO;SAC5B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACvC,CAAC;IAED,yEAAyE;IACjE,MAAM,CAAC,OAAgB;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,UAAU,EAAE,CAAC;QAC5B,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,IAAI,CAAC,OAAgB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAEO,IAAI,CAAC,OAAgB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAEO,OAAO,CAAC,OAAgB;QAC9B,OAAO,mBAAmB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,8EAA8E;IAE9E,cAAc,CAAC,OAAgB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5C,CAAC;IAED,QAAQ,CAAC,SAAiB,EAAE,OAAgB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAgB;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CACR,IAAY,EACZ,SAAiB,EACjB,IAAoE,EACpE,OAAgB;QAEhB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC;YAC7C,IAAI;YACJ,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,SAAiB,EAAE,OAAgB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,wBAAwB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,OAAgB;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,SAAS,CAAC,OAAgB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,OAAgB;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,SAAS,CACP,UAAkB,EAClB,IAAY,EACZ,IAAY,EACZ,SAA6B,EAC7B,OAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,SAAiB,EAAE,QAAgB,EAAE,OAAgB;QACvF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,gBAAgB,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,OAAO,IAAI,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAgB;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,gBAAgB,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,GAAG;YACvC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;YACjD,mCAAmC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC9D,CAAC;QACF,OAAO,IAAI,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,KAAa,EACb,OAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8BAA8B,IAAI,kBAAkB,UAAU;iBAClF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,OAAO,IAAI,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,OAAgB;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,WAAW,CAAC,GAAqB,EAAE,OAAgB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAmB,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG;gBACb,GAAG,GAAG;gBACN,QAAQ,EAAE;oBACR,GAAG,GAAG,CAAC,QAAQ;oBACf,eAAe,EAAG,QAA6B,CAAC,QAAQ,EAAE,eAAe;iBAC1E;aACF,CAAC;YACF,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,8EAA8E;IAE9E,YAAY,CACV,UAAkB,EAClB,IAAY,EACZ,IAAY,EACZ,SAA6B,EAC7B,OAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,SAAS,CACb,IAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,OAAiB,EACjB,OAAgB;QAEhB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzD,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI;iBACD,IAAI,CACH,SAAS,EACT,IAAI,EACJ,SAAS,EACT,OAAO,EACP,MAAM,EACN,MAAM,EACN,IAAI,EACJ,KAAK,EACL,CAAC,MAAM,EAAE,EAAE;gBACT,MAAM,QAAQ,GACZ,MAAM,EAAE,MAAM,KAAK,SAAS;oBAC1B,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,QAAQ;wBAC3D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;wBAC/C,CAAC,CAAC,CAAC,CAAC;gBACV,OAAO,CAAC;oBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACjD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACjD,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC,CACF;iBACA,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/security.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Security policy engine.
+ *
+ * Flags decide which tools are registered (capability vs. access mode) and
+ * whether each individual call is allowed at runtime (namespace + context
+ * scoping, protected namespaces, destructive-op gating, exec gating, dry-run).
+ *
+ * Pure logic, no I/O, so it is fully unit-testable.
+ */
+export type Capability = "read" | "write" | "admin";
+export type AccessMode = "read-only" | "read-write" | "admin";
+export interface SecurityConfig {
+    /** Highest capability the server may expose. */
+    mode: AccessMode;
+    /** If set, only these namespaces may be touched. Empty = all. */
+    namespaceAllowlist: string[];
+    /** Namespaces that can be read but never mutated or deleted. */
+    protectedNamespaces: string[];
+    /** If set, only these kube-config contexts may be used. Empty = all. */
+    contextAllowlist: string[];
+    /** Destructive delete_* operations require this to be true. */
+    allowDelete: boolean;
+    /** `apply_manifest` (arbitrary object create/replace) requires this. */
+    allowApply: boolean;
+    /** `exec_in_pod` (run commands in a container) requires this. */
+    allowExec: boolean;
+    /** Validate + log writes without sending them to the cluster. */
+    dryRun: boolean;
+    /** Emit a structured JSON audit line to stderr per guarded operation. */
+    auditLog: boolean;
+}
+export declare class PolicyError extends Error {
+    constructor(message: string);
+}
+export interface GuardContext {
+    tool: string;
+    capability: Capability;
+    namespace?: string;
+    context?: string;
+    /** Destructive delete operation — needs allowDelete. */
+    destructive?: boolean;
+    /** Requires the apply opt-in. */
+    requiresApply?: boolean;
+    /** Requires the exec opt-in. */
+    requiresExec?: boolean;
+}
+export declare class SecurityPolicy {
+    private readonly config;
+    constructor(config: SecurityConfig);
+    get mode(): AccessMode;
+    isCapabilityEnabled(capability: Capability): boolean;
+    isNamespaceAllowed(ns: string): boolean;
+    isNamespaceProtected(ns: string): boolean;
+    isContextAllowed(ctx: string): boolean;
+    /** Whether the exec tool should even be registered. */
+    get execEnabled(): boolean;
+    guard(ctx: GuardContext): {
+        dryRun: boolean;
+    };
+    private audit;
+}

package/dist/security.js

@@ -0,0 +1,106 @@
+/**
+ * Security policy engine.
+ *
+ * Flags decide which tools are registered (capability vs. access mode) and
+ * whether each individual call is allowed at runtime (namespace + context
+ * scoping, protected namespaces, destructive-op gating, exec gating, dry-run).
+ *
+ * Pure logic, no I/O, so it is fully unit-testable.
+ */
+const MODE_RANK = {
+    "read-only": 0,
+    "read-write": 1,
+    admin: 2,
+};
+const CAPABILITY_RANK = {
+    read: 0,
+    write: 1,
+    admin: 2,
+};
+export class PolicyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PolicyError";
+    }
+}
+export class SecurityPolicy {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    get mode() {
+        return this.config.mode;
+    }
+    isCapabilityEnabled(capability) {
+        return CAPABILITY_RANK[capability] <= MODE_RANK[this.config.mode];
+    }
+    isNamespaceAllowed(ns) {
+        if (this.config.namespaceAllowlist.length === 0)
+            return true;
+        return this.config.namespaceAllowlist.includes(ns);
+    }
+    isNamespaceProtected(ns) {
+        return this.config.protectedNamespaces.includes(ns);
+    }
+    isContextAllowed(ctx) {
+        if (this.config.contextAllowlist.length === 0)
+            return true;
+        return this.config.contextAllowlist.includes(ctx);
+    }
+    /** Whether the exec tool should even be registered. */
+    get execEnabled() {
+        return this.isCapabilityEnabled("admin") && this.config.allowExec;
+    }
+    guard(ctx) {
+        if (!this.isCapabilityEnabled(ctx.capability)) {
+            this.audit(ctx, "DENY", `capability '${ctx.capability}' exceeds mode '${this.config.mode}'`);
+            throw new PolicyError(`Operation '${ctx.tool}' requires '${ctx.capability}' access but the server runs in '${this.config.mode}' mode.`);
+        }
+        if (ctx.context !== undefined && !this.isContextAllowed(ctx.context)) {
+            this.audit(ctx, "DENY", `context '${ctx.context}' not in allowlist`);
+            throw new PolicyError(`Context '${ctx.context}' is not in the configured allowlist (K8S_CONTEXT_ALLOWLIST).`);
+        }
+        if (ctx.namespace !== undefined) {
+            if (!this.isNamespaceAllowed(ctx.namespace)) {
+                this.audit(ctx, "DENY", `namespace '${ctx.namespace}' not in allowlist`);
+                throw new PolicyError(`Namespace '${ctx.namespace}' is not in the configured allowlist (K8S_NAMESPACE_ALLOWLIST).`);
+            }
+            if (ctx.capability !== "read" && this.isNamespaceProtected(ctx.namespace)) {
+                this.audit(ctx, "DENY", `namespace '${ctx.namespace}' is protected`);
+                throw new PolicyError(`Namespace '${ctx.namespace}' is protected (K8S_PROTECTED_NAMESPACES); mutations are refused.`);
+            }
+        }
+        if (ctx.requiresApply && !this.config.allowApply) {
+            this.audit(ctx, "DENY", "apply not enabled");
+            throw new PolicyError(`Operation '${ctx.tool}' is disabled. Set K8S_ALLOW_APPLY=true to enable applying manifests.`);
+        }
+        if (ctx.requiresExec && !this.config.allowExec) {
+            this.audit(ctx, "DENY", "exec not enabled");
+            throw new PolicyError(`Operation '${ctx.tool}' is disabled. Set K8S_ALLOW_EXEC=true to enable exec into pods.`);
+        }
+        if (ctx.destructive && !this.config.allowDelete) {
+            this.audit(ctx, "DENY", "delete not enabled");
+            throw new PolicyError(`Destructive operation '${ctx.tool}' is disabled. Set K8S_ALLOW_DELETE=true to enable it.`);
+        }
+        const dryRun = ctx.capability !== "read" && this.config.dryRun;
+        this.audit(ctx, dryRun ? "DRY_RUN" : "ALLOW");
+        return { dryRun };
+    }
+    audit(ctx, decision, reason) {
+        if (!this.config.auditLog)
+            return;
+        const line = {
+            ts: new Date().toISOString(),
+            audit: "kubernetes-mcp",
+            decision,
+            tool: ctx.tool,
+            capability: ctx.capability,
+            context: ctx.context ?? null,
+            namespace: ctx.namespace ?? null,
+            destructive: ctx.destructive ?? false,
+            ...(reason ? { reason } : {}),
+        };
+        process.stderr.write(`${JSON.stringify(line)}\n`);
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,SAAS,GAA+B;IAC5C,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,eAAe,GAA+B;IAClD,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AAuBF,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAeD,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAEvD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,mBAAmB,CAAC,UAAsB;QACxC,OAAO,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,kBAAkB,CAAC,EAAU;QAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,oBAAoB,CAAC,EAAU;QAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,gBAAgB,CAAC,GAAW;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,uDAAuD;IACvD,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,GAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,GAAG,CAAC,UAAU,mBAAmB,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7F,MAAM,IAAI,WAAW,CACnB,cAAc,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,UAAU,oCAAoC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS,CACjH,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC;YACrE,MAAM,IAAI,WAAW,CACnB,YAAY,GAAG,CAAC,OAAO,+DAA+D,CACvF,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,SAAS,oBAAoB,CAAC,CAAC;gBACzE,MAAM,IAAI,WAAW,CACnB,cAAc,GAAG,CAAC,SAAS,iEAAiE,CAC7F,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,SAAS,gBAAgB,CAAC,CAAC;gBACrE,MAAM,IAAI,WAAW,CACnB,cAAc,GAAG,CAAC,SAAS,mEAAmE,CAC/F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAC7C,MAAM,IAAI,WAAW,CACnB,cAAc,GAAG,CAAC,IAAI,uEAAuE,CAC9F,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAC5C,MAAM,IAAI,WAAW,CACnB,cAAc,GAAG,CAAC,IAAI,kEAAkE,CACzF,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;YAC9C,MAAM,IAAI,WAAW,CACnB,0BAA0B,GAAG,CAAC,IAAI,wDAAwD,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,GAAiB,EAAE,QAAgB,EAAE,MAAe;QAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO;QAClC,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,gBAAgB;YACvB,QAAQ;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YAChC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;YACrC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/server.d.ts

@@ -0,0 +1,6 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { AppConfig } from "./config.js";
+export declare function buildServer(config: AppConfig): {
+    server: McpServer;
+    enabled: string[];
+};