@dockndevai/mcp-kubernetes 0.1.0

package/dist/server.js

@@ -0,0 +1,52 @@
+import { ApiException } from "@kubernetes/client-node";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { K8sClient } from "./k8s/client.js";
+import { PolicyError, SecurityPolicy } from "./security.js";
+import { adminTools } from "./tools/admin.js";
+import { readTools } from "./tools/read.js";
+import { writeTools } from "./tools/write.js";
+const ALL_TOOLS = [...readTools, ...writeTools, ...adminTools];
+export function buildServer(config) {
+    const policy = new SecurityPolicy(config.security);
+    const client = new K8sClient(config.connection);
+    const ctx = { client, policy };
+    const server = new McpServer({ name: "mcp-kubernetes", version: "0.1.0" });
+    const enabled = [];
+    for (const tool of ALL_TOOLS) {
+        if (!policy.isCapabilityEnabled(tool.capability))
+            continue;
+        // Extra per-tool gate (e.g. exec_in_pod needs the exec opt-in on top of admin mode).
+        if (tool.enabledWhen && !tool.enabledWhen(policy))
+            continue;
+        enabled.push(tool.name);
+        server.registerTool(tool.name, tool.config, async (args) => {
+            try {
+                return await tool.handler(args ?? {}, ctx);
+            }
+            catch (err) {
+                return toErrorResult(err);
+            }
+        });
+    }
+    return { server, enabled };
+}
+function toErrorResult(err) {
+    let message;
+    if (err instanceof PolicyError) {
+        message = `Policy denied: ${err.message}`;
+    }
+    else if (err instanceof ApiException) {
+        message = `Kubernetes API error (${err.code}): ${truncate(String(err.body ?? err.message))}`;
+    }
+    else if (err instanceof Error) {
+        message = err.message;
+    }
+    else {
+        message = String(err);
+    }
+    return { content: [{ type: "text", text: message }], isError: true };
+}
+function truncate(s, max = 800) {
+    return s.length > max ? `${s.slice(0, max)}…` : s;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,SAAS,GAAc,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,CAAC,CAAC;AAE1E,MAAM,UAAU,WAAW,CAAC,MAAiB;IAC3C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,GAAG,GAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,SAAS;QAC3D,qFAAqF;QACrF,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAA6B,EAAE,EAAE;YAClF,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;QAC/B,OAAO,GAAG,kBAAkB,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5C,CAAC;SAAM,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;QACvC,OAAO,GAAG,yBAAyB,GAAG,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;SAAM,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QAChC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAG,GAAG,GAAG;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/tools/admin.d.ts

@@ -0,0 +1,6 @@
+import type { ToolDef } from "./types.js";
+/**
+ * Admin tools are registered only in admin mode, and the two most dangerous
+ * (delete, exec) have their own additional opt-in flags on top of that.
+ */
+export declare const adminTools: ToolDef[];

package/dist/tools/admin.js

@@ -0,0 +1,78 @@
+import { z } from "zod";
+import { jsonResult, textResult } from "./types.js";
+const contextArg = {
+    context: z.string().optional().describe("kube-config context to target (defaults to current-context)"),
+};
+/**
+ * Admin tools are registered only in admin mode, and the two most dangerous
+ * (delete, exec) have their own additional opt-in flags on top of that.
+ */
+export const adminTools = [
+    {
+        name: "delete_resource",
+        capability: "admin",
+        config: {
+            title: "Delete a resource",
+            description: "Delete an arbitrary Kubernetes object by apiVersion/kind/name. Requires admin mode AND " +
+                "K8S_ALLOW_DELETE=true. Protected namespaces are refused. Irreversible.",
+            inputSchema: {
+                apiVersion: z.string().describe("e.g. v1, apps/v1"),
+                kind: z.string().describe("e.g. Pod, Deployment"),
+                name: z.string().describe("Resource name"),
+                namespace: z.string().optional().describe("Namespace (omit for cluster-scoped resources)"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            const { dryRun } = policy.guard({
+                tool: "delete_resource",
+                capability: "admin",
+                namespace,
+                context,
+                destructive: true,
+            });
+            const ref = `${args.kind}/${args.name}${namespace ? ` in ${namespace}` : ""}`;
+            if (dryRun)
+                return textResult(`[dry-run] Would delete ${ref}.`);
+            await client.deleteObject(args.apiVersion, args.kind, args.name, namespace, context);
+            return jsonResult({ deleted: true, kind: args.kind, name: args.name, namespace });
+        },
+    },
+    {
+        name: "exec_in_pod",
+        capability: "admin",
+        // Only ever registered when admin mode AND the exec opt-in are both on.
+        enabledWhen: (p) => p.execEnabled,
+        config: {
+            title: "Exec in pod",
+            description: "Run a command inside a pod container and return its output. Requires admin mode AND " +
+                "K8S_ALLOW_EXEC=true. This is powerful — treat with care.",
+            inputSchema: {
+                name: z.string().describe("Pod name"),
+                namespace: z.string().describe("Namespace"),
+                container: z.string().describe("Container name"),
+                command: z.array(z.string()).min(1).describe("Command and args, e.g. [\"sh\",\"-c\",\"ls /\"]"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            const { dryRun } = policy.guard({
+                tool: "exec_in_pod",
+                capability: "admin",
+                namespace,
+                context,
+                requiresExec: true,
+            });
+            const command = args.command;
+            if (dryRun)
+                return textResult(`[dry-run] Would exec in ${namespace}/${args.name} [${args.container}]: ${command.join(" ")}`);
+            const result = await client.execInPod(args.name, namespace, args.container, command, context);
+            return jsonResult(result);
+        },
+    },
+];
+//# sourceMappingURL=admin.js.map

package/dist/tools/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/tools/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,UAAU,GAAG;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;CACvG,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAc;IACnC;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE;YACN,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACT,yFAAyF;gBACzF,wEAAwE;YAC1E,WAAW,EAAE;gBACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;gBAC1F,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAA+B,CAAC;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,iBAAiB;gBACvB,UAAU,EAAE,OAAO;gBACnB,SAAS;gBACT,OAAO;gBACP,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9E,IAAI,MAAM;gBAAE,OAAO,UAAU,CAAC,0BAA0B,GAAG,GAAG,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,YAAY,CACvB,IAAI,CAAC,UAAoB,EACzB,IAAI,CAAC,IAAc,EACnB,IAAI,CAAC,IAAc,EACnB,SAAS,EACT,OAAO,CACR,CAAC;YACF,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,OAAO;QACnB,wEAAwE;QACxE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;QACjC,MAAM,EAAE;YACN,KAAK,EAAE,aAAa;YACpB,WAAW,EACT,sFAAsF;gBACtF,0DAA0D;YAC5D,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAChD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;gBAC/F,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,OAAO;gBACnB,SAAS;gBACT,OAAO;gBACP,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAmB,CAAC;YACzC,IAAI,MAAM;gBACR,OAAO,UAAU,CACf,2BAA2B,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CACnC,IAAI,CAAC,IAAc,EACnB,SAAS,EACT,IAAI,CAAC,SAAmB,EACxB,OAAO,EACP,OAAO,CACR,CAAC;YACF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;KACF;CACF,CAAC"}

package/dist/tools/read.d.ts

@@ -0,0 +1,2 @@
+import type { ToolDef } from "./types.js";
+export declare const readTools: ToolDef[];

package/dist/tools/read.js

@@ -0,0 +1,222 @@
+import { z } from "zod";
+import { jsonResult, summarizePods } from "./types.js";
+const contextArg = {
+    context: z.string().optional().describe("kube-config context to target (defaults to current-context)"),
+};
+export const readTools = [
+    {
+        name: "list_contexts",
+        capability: "read",
+        config: {
+            title: "List kube-config contexts",
+            description: "List the contexts (clusters) available in the loaded kube-config.",
+            inputSchema: {},
+        },
+        handler: async (_args, { client, policy }) => {
+            policy.guard({ tool: "list_contexts", capability: "read" });
+            const contexts = client
+                .listContextNames()
+                .filter((c) => policy.isContextAllowed(c.name));
+            return jsonResult(contexts);
+        },
+    },
+    {
+        name: "list_namespaces",
+        capability: "read",
+        config: {
+            title: "List namespaces",
+            description: "List namespaces in the cluster. Namespaces outside the allowlist are filtered out.",
+            inputSchema: { ...contextArg },
+        },
+        handler: async (args, { client, policy }) => {
+            const context = args.context;
+            policy.guard({ tool: "list_namespaces", capability: "read", context });
+            const res = await client.listNamespaces(context);
+            const namespaces = (res.items ?? [])
+                .map((n) => ({
+                name: n.metadata?.name,
+                status: n.status?.phase,
+                protected: n.metadata?.name ? policy.isNamespaceProtected(n.metadata.name) : false,
+            }))
+                .filter((n) => n.name && policy.isNamespaceAllowed(n.name));
+            return jsonResult(namespaces);
+        },
+    },
+    {
+        name: "list_pods",
+        capability: "read",
+        config: {
+            title: "List pods",
+            description: "List pods in a namespace with status, readiness, restarts, and node.",
+            inputSchema: { namespace: z.string().describe("Namespace"), ...contextArg },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            policy.guard({ tool: "list_pods", capability: "read", namespace, context });
+            const res = await client.listPods(namespace, context);
+            return jsonResult(summarizePods(res));
+        },
+    },
+    {
+        name: "get_pod",
+        capability: "read",
+        config: {
+            title: "Get pod",
+            description: "Fetch the full representation of a single pod.",
+            inputSchema: {
+                name: z.string().describe("Pod name"),
+                namespace: z.string().describe("Namespace"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            policy.guard({ tool: "get_pod", capability: "read", namespace, context });
+            const res = await client.getPod(args.name, namespace, context);
+            return jsonResult(res);
+        },
+    },
+    {
+        name: "get_pod_logs",
+        capability: "read",
+        config: {
+            title: "Get pod logs",
+            description: "Fetch recent logs from a pod container.",
+            inputSchema: {
+                name: z.string().describe("Pod name"),
+                namespace: z.string().describe("Namespace"),
+                container: z.string().optional().describe("Container name (defaults to first container)"),
+                tailLines: z.number().int().min(1).max(5000).optional().describe("Lines from the end (default 200)"),
+                previous: z.boolean().optional().describe("Fetch logs from the previous terminated container"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            policy.guard({ tool: "get_pod_logs", capability: "read", namespace, context });
+            const logs = await client.getPodLogs(args.name, namespace, {
+                container: args.container,
+                tailLines: args.tailLines ?? 200,
+                previous: args.previous,
+            }, context);
+            return { content: [{ type: "text", text: String(logs) || "(no output)" }] };
+        },
+    },
+    {
+        name: "list_deployments",
+        capability: "read",
+        config: {
+            title: "List deployments",
+            description: "List deployments in a namespace with replica status.",
+            inputSchema: { namespace: z.string().describe("Namespace"), ...contextArg },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            policy.guard({ tool: "list_deployments", capability: "read", namespace, context });
+            const res = await client.listDeployments(namespace, context);
+            const deployments = (res.items ?? []).map((d) => ({
+                name: d.metadata?.name,
+                namespace: d.metadata?.namespace,
+                replicas: d.spec?.replicas,
+                ready: d.status?.readyReplicas ?? 0,
+                available: d.status?.availableReplicas ?? 0,
+                images: (d.spec?.template?.spec?.containers ?? []).map((c) => `${c.name}=${c.image}`),
+            }));
+            return jsonResult(deployments);
+        },
+    },
+    {
+        name: "list_services",
+        capability: "read",
+        config: {
+            title: "List services",
+            description: "List services in a namespace with type and cluster IP.",
+            inputSchema: { namespace: z.string().describe("Namespace"), ...contextArg },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            policy.guard({ tool: "list_services", capability: "read", namespace, context });
+            const res = await client.listServices(namespace, context);
+            const services = (res.items ?? []).map((s) => ({
+                name: s.metadata?.name,
+                type: s.spec?.type,
+                clusterIP: s.spec?.clusterIP,
+                ports: (s.spec?.ports ?? []).map((p) => `${p.port}/${p.protocol}`),
+            }));
+            return jsonResult(services);
+        },
+    },
+    {
+        name: "list_nodes",
+        capability: "read",
+        config: {
+            title: "List nodes",
+            description: "List cluster nodes with readiness and kubelet version.",
+            inputSchema: { ...contextArg },
+        },
+        handler: async (args, { client, policy }) => {
+            const context = args.context;
+            policy.guard({ tool: "list_nodes", capability: "read", context });
+            const res = await client.listNodes(context);
+            const nodes = (res.items ?? []).map((n) => ({
+                name: n.metadata?.name,
+                ready: (n.status?.conditions ?? []).find((c) => c.type === "Ready")?.status,
+                version: n.status?.nodeInfo?.kubeletVersion,
+                os: n.status?.nodeInfo?.osImage,
+            }));
+            return jsonResult(nodes);
+        },
+    },
+    {
+        name: "list_events",
+        capability: "read",
+        config: {
+            title: "List events",
+            description: "List recent events in a namespace — useful for diagnosing failures.",
+            inputSchema: { namespace: z.string().describe("Namespace"), ...contextArg },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            policy.guard({ tool: "list_events", capability: "read", namespace, context });
+            const res = await client.listEvents(namespace, context);
+            const events = (res.items ?? []).map((e) => ({
+                type: e.type,
+                reason: e.reason,
+                object: `${e.involvedObject?.kind}/${e.involvedObject?.name}`,
+                message: e.message,
+                count: e.count,
+                lastSeen: e.lastTimestamp,
+            }));
+            return jsonResult(events);
+        },
+    },
+    {
+        name: "get_resource",
+        capability: "read",
+        config: {
+            title: "Get any resource",
+            description: "Read an arbitrary Kubernetes object by apiVersion/kind/name (e.g. apiVersion=apps/v1, kind=Deployment).",
+            inputSchema: {
+                apiVersion: z.string().describe("e.g. v1, apps/v1, networking.k8s.io/v1"),
+                kind: z.string().describe("e.g. Pod, Deployment, Ingress"),
+                name: z.string().describe("Resource name"),
+                namespace: z.string().optional().describe("Namespace (omit for cluster-scoped resources)"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const namespace = args.namespace;
+            const context = args.context;
+            policy.guard({ tool: "get_resource", capability: "read", namespace, context });
+            const res = await client.getObject(args.apiVersion, args.kind, args.name, namespace, context);
+            return jsonResult(res);
+        },
+    },
+];
+//# sourceMappingURL=read.js.map

package/dist/tools/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/tools/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,UAAU,GAAG;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;CACvG,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAc;IAClC;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,mEAAmE;YAChF,WAAW,EAAE,EAAE;SAChB;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM;iBACpB,gBAAgB,EAAE;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,oFAAoF;YACjG,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE;SAC/B;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;iBACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;gBACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK;gBACvB,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,sEAAsE;YACnF,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE;SAC5E;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;KACF;IACD;QACE,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,gDAAgD;YAC7D,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC3C,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAc,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACzE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,yCAAyC;YACtD,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;gBACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;gBACzF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;gBACpG,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;gBAC9F,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAClC,IAAI,CAAC,IAAc,EACnB,SAAS,EACT;gBACE,SAAS,EAAE,IAAI,CAAC,SAA+B;gBAC/C,SAAS,EAAG,IAAI,CAAC,SAAgC,IAAI,GAAG;gBACxD,QAAQ,EAAE,IAAI,CAAC,QAA+B;aAC/C,EACD,OAAO,CACR,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,EAAE,CAAC,EAAE,CAAC;QACvF,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,sDAAsD;YACnE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE;SAC5E;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;gBACtB,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS;gBAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ;gBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC;gBACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,iBAAiB,IAAI,CAAC;gBAC3C,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;aACtF,CAAC,CAAC,CAAC;YACJ,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,wDAAwD;YACrE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE;SAC5E;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;gBACtB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI;gBAClB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS;gBAC5B,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;aACnE,CAAC,CAAC,CAAC;YACJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;KACF;IACD;QACE,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,wDAAwD;YACrE,WAAW,EAAE,EAAE,GAAG,UAAU,EAAE;SAC/B;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1C,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;gBACtB,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,MAAM;gBAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc;gBAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO;aAChC,CAAC,CAAC,CAAC;YACJ,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,aAAa;YACpB,WAAW,EAAE,qEAAqE;YAClF,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE;SAC5E;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE;gBAC7D,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,aAAa;aAC1B,CAAC,CAAC,CAAC;YACJ,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB;YACzB,WAAW,EACT,yGAAyG;YAC3G,WAAW,EAAE;gBACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;gBACzE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;gBAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;gBAC1F,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAA+B,CAAC;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,IAAI,CAAC,UAAoB,EACzB,IAAI,CAAC,IAAc,EACnB,IAAI,CAAC,IAAc,EACnB,SAAS,EACT,OAAO,CACR,CAAC;YACF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;KACF;CACF,CAAC"}

package/dist/tools/types.d.ts

@@ -0,0 +1,41 @@
+import type { ZodRawShape } from "zod";
+import type { K8sClient } from "../k8s/client.js";
+import type { Capability, SecurityPolicy } from "../security.js";
+export interface ToolContext {
+    client: K8sClient;
+    policy: SecurityPolicy;
+}
+export interface ToolResult {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+    [key: string]: unknown;
+}
+export interface ToolDef<Shape extends ZodRawShape = ZodRawShape> {
+    name: string;
+    capability: Capability;
+    /** If set, the tool is only registered when this predicate passes. */
+    enabledWhen?: (policy: SecurityPolicy) => boolean;
+    config: {
+        title: string;
+        description: string;
+        inputSchema: Shape;
+    };
+    handler: (args: Record<string, unknown>, ctx: ToolContext) => Promise<ToolResult>;
+}
+export declare function jsonResult(value: unknown): ToolResult;
+export declare function textResult(text: string): ToolResult;
+/** Trim large list responses to the essential, model-friendly fields. */
+export declare function summarizePods(list: {
+    items?: Array<Record<string, any>>;
+}): {
+    name: any;
+    namespace: any;
+    phase: any;
+    ready: string;
+    restarts: any;
+    node: any;
+    startTime: any;
+}[];

package/dist/tools/types.js

@@ -0,0 +1,21 @@
+export function jsonResult(value) {
+    return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] };
+}
+export function textResult(text) {
+    return { content: [{ type: "text", text }] };
+}
+/** Trim large list responses to the essential, model-friendly fields. */
+export function summarizePods(list) {
+    return (list.items ?? []).map((p) => ({
+        name: p.metadata?.name,
+        namespace: p.metadata?.namespace,
+        phase: p.status?.phase,
+        ready: (p.status?.containerStatuses ?? []).filter((c) => c.ready).length +
+            "/" +
+            (p.status?.containerStatuses ?? []).length,
+        restarts: (p.status?.containerStatuses ?? []).reduce((n, c) => n + (c.restartCount ?? 0), 0),
+        node: p.spec?.nodeName,
+        startTime: p.status?.startTime,
+    }));
+}
+//# sourceMappingURL=types.js.map

package/dist/tools/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tools/types.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,IAA4C;IACxE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK;QACtB,KAAK,EACH,CAAC,CAAC,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;YACtE,GAAG;YACH,CAAC,CAAC,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM;QAC5C,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAS,EAAE,CAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,EAChD,CAAC,CACF;QACD,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS;KAC/B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/tools/write.d.ts

@@ -0,0 +1,2 @@
+import type { ToolDef } from "./types.js";
+export declare const writeTools: ToolDef[];

package/dist/tools/write.js

@@ -0,0 +1,148 @@
+import { z } from "zod";
+import { jsonResult, textResult } from "./types.js";
+const contextArg = {
+    context: z.string().optional().describe("kube-config context to target (defaults to current-context)"),
+};
+export const writeTools = [
+    {
+        name: "scale_deployment",
+        capability: "write",
+        config: {
+            title: "Scale deployment",
+            description: "Set the replica count of a deployment.",
+            inputSchema: {
+                name: z.string().describe("Deployment name"),
+                namespace: z.string().describe("Namespace"),
+                replicas: z.number().int().min(0).max(1000).describe("Desired replica count"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const name = args.name;
+            const namespace = args.namespace;
+            const replicas = args.replicas;
+            const context = args.context;
+            const { dryRun } = policy.guard({ tool: "scale_deployment", capability: "write", namespace, context });
+            if (dryRun)
+                return textResult(`[dry-run] Would scale ${namespace}/${name} to ${replicas} replicas.`);
+            await client.scaleDeployment(name, namespace, replicas, context);
+            return jsonResult({ scaled: true, namespace, name, replicas });
+        },
+    },
+    {
+        name: "restart_deployment",
+        capability: "write",
+        config: {
+            title: "Restart deployment",
+            description: "Trigger a rolling restart of a deployment (equivalent to `kubectl rollout restart`).",
+            inputSchema: {
+                name: z.string().describe("Deployment name"),
+                namespace: z.string().describe("Namespace"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const name = args.name;
+            const namespace = args.namespace;
+            const context = args.context;
+            const { dryRun } = policy.guard({ tool: "restart_deployment", capability: "write", namespace, context });
+            if (dryRun)
+                return textResult(`[dry-run] Would restart deployment ${namespace}/${name}.`);
+            await client.restartDeployment(name, namespace, context);
+            return jsonResult({ restarted: true, namespace, name });
+        },
+    },
+    {
+        name: "set_deployment_image",
+        capability: "write",
+        config: {
+            title: "Set deployment image",
+            description: "Update the image of a named container in a deployment.",
+            inputSchema: {
+                name: z.string().describe("Deployment name"),
+                namespace: z.string().describe("Namespace"),
+                container: z.string().describe("Container name within the pod template"),
+                image: z.string().describe("New image reference, e.g. nginx:1.27"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const name = args.name;
+            const namespace = args.namespace;
+            const container = args.container;
+            const image = args.image;
+            const context = args.context;
+            const { dryRun } = policy.guard({
+                tool: "set_deployment_image",
+                capability: "write",
+                namespace,
+                context,
+            });
+            if (dryRun)
+                return textResult(`[dry-run] Would set ${namespace}/${name} container '${container}' to ${image}.`);
+            await client.setDeploymentImage(name, namespace, container, image, context);
+            return jsonResult({ updated: true, namespace, name, container, image });
+        },
+    },
+    {
+        name: "create_namespace",
+        capability: "write",
+        config: {
+            title: "Create namespace",
+            description: "Create a new namespace.",
+            inputSchema: { name: z.string().describe("Namespace name"), ...contextArg },
+        },
+        handler: async (args, { client, policy }) => {
+            const name = args.name;
+            const context = args.context;
+            // The new namespace itself is the target, so scope-check it.
+            const { dryRun } = policy.guard({
+                tool: "create_namespace",
+                capability: "write",
+                namespace: name,
+                context,
+            });
+            if (dryRun)
+                return textResult(`[dry-run] Would create namespace '${name}'.`);
+            await client.createNamespace(name, context);
+            return jsonResult({ created: true, namespace: name });
+        },
+    },
+    {
+        name: "apply_manifest",
+        capability: "write",
+        enabledWhen: (p) => p.isCapabilityEnabled("write"),
+        config: {
+            title: "Apply a manifest",
+            description: "Create or replace an arbitrary Kubernetes object from a manifest. Requires K8S_ALLOW_APPLY=true. " +
+                "Pass the manifest as a JSON object with apiVersion, kind, metadata, and spec.",
+            inputSchema: {
+                manifest: z
+                    .record(z.any())
+                    .describe("The Kubernetes object as JSON (apiVersion, kind, metadata, spec, ...)"),
+                ...contextArg,
+            },
+        },
+        handler: async (args, { client, policy }) => {
+            const manifest = args.manifest;
+            const namespace = manifest.metadata?.namespace;
+            const context = args.context;
+            const { dryRun } = policy.guard({
+                tool: "apply_manifest",
+                capability: "write",
+                namespace,
+                context,
+                requiresApply: true,
+            });
+            if (!manifest.apiVersion || !manifest.kind || !manifest.metadata?.name) {
+                return { content: [{ type: "text", text: "Manifest must include apiVersion, kind, and metadata.name." }], isError: true };
+            }
+            if (dryRun)
+                return textResult(`[dry-run] Would apply ${manifest.kind}/${manifest.metadata.name}` +
+                    `${namespace ? ` in ${namespace}` : ""}.`);
+            const { action } = await client.applyObject(manifest, context);
+            return jsonResult({ applied: true, action, kind: manifest.kind, name: manifest.metadata.name, namespace });
+        },
+    },
+];
+//# sourceMappingURL=write.js.map

package/dist/tools/write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.js","sourceRoot":"","sources":["../../src/tools/write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,UAAU,GAAG;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;CACvG,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAc;IACnC;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,wCAAwC;YACrD,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBAC7E,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAkB,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACvG,IAAI,MAAM;gBAAE,OAAO,UAAU,CAAC,yBAAyB,SAAS,IAAI,IAAI,OAAO,QAAQ,YAAY,CAAC,CAAC;YACrG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE;YACN,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,sFAAsF;YACnG,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC3C,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACzG,IAAI,MAAM;gBAAE,OAAO,UAAU,CAAC,sCAAsC,SAAS,IAAI,IAAI,GAAG,CAAC,CAAC;YAC1F,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACzD,OAAO,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE;YACN,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wDAAwD;YACrE,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;gBACxE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;gBAClE,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAe,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,sBAAsB;gBAC5B,UAAU,EAAE,OAAO;gBACnB,SAAS;gBACT,OAAO;aACR,CAAC,CAAC;YACH,IAAI,MAAM;gBACR,OAAO,UAAU,CAAC,uBAAuB,SAAS,IAAI,IAAI,eAAe,SAAS,QAAQ,KAAK,GAAG,CAAC,CAAC;YACtG,MAAM,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC5E,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,yBAAyB;YACtC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,GAAG,UAAU,EAAE;SAC5E;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,6DAA6D;YAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,kBAAkB;gBACxB,UAAU,EAAE,OAAO;gBACnB,SAAS,EAAE,IAAI;gBACf,OAAO;aACR,CAAC,CAAC;YACH,IAAI,MAAM;gBAAE,OAAO,UAAU,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YAC7E,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,OAAO;QACnB,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAClD,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB;YACzB,WAAW,EACT,mGAAmG;gBACnG,+EAA+E;YACjF,WAAW,EAAE;gBACX,QAAQ,EAAE,CAAC;qBACR,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;qBACf,QAAQ,CAAC,uEAAuE,CAAC;gBACpF,GAAG,UAAU;aACd;SACF;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAgD,CAAC;YACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,gBAAgB;gBACtB,UAAU,EAAE,OAAO;gBACnB,SAAS;gBACT,OAAO;gBACP,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,4DAA4D,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACrI,CAAC;YACD,IAAI,MAAM;gBACR,OAAO,UAAU,CACf,yBAAyB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;oBAChE,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAC5C,CAAC;YACJ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/D,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7G,CAAC;KACF;CACF,CAAC"}