@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/docs/safety-index/artifacts/kubernetes-server.json

@@ -0,0 +1,1573 @@
+{
+  "artifactType": "run",
+  "schemaVersion": "1.0.0",
+  "gate": "fail",
+  "runId": "run_2026-07-06T194958878Z_b41bb221",
+  "createdAt": "2026-07-06T19:49:58.878Z",
+  "toolVersion": "0.28.0",
+  "target": {
+    "targetId": "kubernetes-server",
+    "adapter": "local-process",
+    "command": "npx",
+    "args": [
+      "-y",
+      "mcp-server-kubernetes"
+    ],
+    "cwd": ".",
+    "metadata": {
+      "package": "mcp-server-kubernetes",
+      "purpose": "mcp-safety-index",
+      "riskClass": "Kubernetes control plane",
+      "failureClass": "Command and cluster mutation boundary",
+      "whyItMatters": "Kubernetes MCP servers can expose cluster mutation, pod exec, manifest apply/delete, and broad kubectl command surfaces to agents."
+    },
+    "serverName": "kubernetes",
+    "serverVersion": "3.9.3"
+  },
+  "environment": {
+    "platform": "darwin 25.5.0",
+    "nodeVersion": "v22.22.1"
+  },
+  "summary": {
+    "total": 8,
+    "pass": 4,
+    "fail": 3,
+    "partial": 1,
+    "unsupported": 0,
+    "flaky": 0,
+    "skipped": 0,
+    "gate": "fail"
+  },
+  "checks": [
+    {
+      "id": "tools",
+      "capability": "tools",
+      "status": "pass",
+      "durationMs": 1.2567500000004657,
+      "message": "Advertised capability responded with the minimal expected shape (23 items).",
+      "evidence": [
+        {
+          "endpoint": "tools/list",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 23,
+          "identifiers": [
+            "cleanup",
+            "kubectl_get",
+            "kubectl_describe",
+            "kubectl_apply",
+            "kubectl_delete",
+            "kubectl_create",
+            "kubectl_logs",
+            "kubectl_scale",
+            "kubectl_patch",
+            "kubectl_rollout",
+            "kubectl_context",
+            "kubectl_reconnect",
+            "explain_resource",
+            "install_helm_chart",
+            "upgrade_helm_chart",
+            "uninstall_helm_chart",
+            "node_management",
+            "port_forward",
+            "stop_port_forward",
+            "exec_in_pod",
+            "list_api_resources",
+            "kubectl_generic",
+            "ping"
+          ],
+          "diagnostics": [
+            "Starting Kubernetes MCP server v3.9.3, handling commands...",
+            "Telemetry: Disabled",
+            "(node:13988) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.",
+            "(Use `node --trace-deprecation ...` to show where the warning was created)"
+          ],
+          "schemas": {
+            "cleanup": {
+              "type": "object",
+              "properties": {}
+            },
+            "kubectl_get": {
+              "type": "object",
+              "properties": {
+                "resourceType": {
+                  "type": "string",
+                  "description": "Type of resource to get (e.g., pods, deployments, services, configmaps, events, etc.)"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the resource (optional - if not provided, lists all resources of the specified type)"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "output": {
+                  "type": "string",
+                  "enum": [
+                    "json",
+                    "yaml",
+                    "wide",
+                    "name",
+                    "custom"
+                  ],
+                  "description": "Output format",
+                  "default": "json"
+                },
+                "allNamespaces": {
+                  "type": "boolean",
+                  "description": "If true, list resources across all namespaces",
+                  "default": false
+                },
+                "labelSelector": {
+                  "type": "string",
+                  "description": "Filter resources by label selector (e.g. 'app=nginx')"
+                },
+                "fieldSelector": {
+                  "type": "string",
+                  "description": "Filter resources by field selector (e.g. 'metadata.name=my-pod')"
+                },
+                "sortBy": {
+                  "type": "string",
+                  "description": "Sort events by a field (default: lastTimestamp). Only applicable for events."
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "resourceType"
+              ]
+            },
+            "kubectl_describe": {
+              "type": "object",
+              "properties": {
+                "resourceType": {
+                  "type": "string",
+                  "description": "Type of resource to describe (e.g., pods, deployments, services, etc.)"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the resource to describe"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                },
+                "allNamespaces": {
+                  "type": "boolean",
+                  "description": "If true, describe resources across all namespaces",
+                  "default": false
+                }
+              },
+              "required": [
+                "resourceType",
+                "name"
+              ]
+            },
+            "kubectl_apply": {
+              "type": "object",
+              "properties": {
+                "manifest": {
+                  "type": "string",
+                  "description": "YAML manifest to apply"
+                },
+                "filename": {
+                  "type": "string",
+                  "description": "Path to a YAML file to apply (optional - use either manifest or filename)"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "dryRun": {
+                  "type": "boolean",
+                  "description": "If true, only validate the resource, don't actually execute the operation",
+                  "default": false
+                },
+                "force": {
+                  "type": "boolean",
+                  "description": "If true, immediately remove resources from API and bypass graceful deletion",
+                  "default": false
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": []
+            },
+            "kubectl_delete": {
+              "type": "object",
+              "properties": {
+                "resourceType": {
+                  "type": "string",
+                  "description": "Type of resource to delete (e.g., pods, deployments, services, etc.)"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the resource to delete"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "labelSelector": {
+                  "type": "string",
+                  "description": "Delete resources matching this label selector (e.g. 'app=nginx')"
+                },
+                "manifest": {
+                  "type": "string",
+                  "description": "YAML manifest defining resources to delete (optional)"
+                },
+                "filename": {
+                  "type": "string",
+                  "description": "Path to a YAML file to delete resources from (optional)"
+                },
+                "allNamespaces": {
+                  "type": "boolean",
+                  "description": "If true, delete resources across all namespaces",
+                  "default": false
+                },
+                "force": {
+                  "type": "boolean",
+                  "description": "If true, immediately remove resources from API and bypass graceful deletion",
+                  "default": false
+                },
+                "gracePeriodSeconds": {
+                  "type": "number",
+                  "description": "Period of time in seconds given to the resource to terminate gracefully"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": []
+            },
+            "kubectl_create": {
+              "type": "object",
+              "properties": {
+                "dryRun": {
+                  "type": "boolean",
+                  "description": "If true, only validate the resource, don't actually execute the operation",
+                  "default": false
+                },
+                "output": {
+                  "type": "string",
+                  "enum": [
+                    "json",
+                    "yaml",
+                    "name",
+                    "go-template",
+                    "go-template-file",
+                    "template",
+                    "templatefile",
+                    "jsonpath",
+                    "jsonpath-as-json",
+                    "jsonpath-file"
+                  ],
+                  "description": "Output format. One of: json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file",
+                  "default": "yaml"
+                },
+                "validate": {
+                  "type": "boolean",
+                  "description": "If true, validate resource schema against server schema",
+                  "default": true
+                },
+                "manifest": {
+                  "type": "string",
+                  "description": "YAML manifest to create resources from"
+                },
+                "filename": {
+                  "type": "string",
+                  "description": "Path to a YAML file to create resources from"
+                },
+                "resourceType": {
+                  "type": "string",
+                  "description": "Type of resource to create (namespace, configmap, deployment, service, etc.)"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the resource to create"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "fromLiteral": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Key-value pair for creating configmap (e.g. [\"key1=value1\", \"key2=value2\"])"
+                },
+                "fromFile": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Path to file for creating configmap (e.g. [\"key1=/path/to/file1\", \"key2=/path/to/file2\"])"
+                },
+                "secretType": {
+                  "type": "string",
+                  "enum": [
+                    "generic",
+                    "docker-registry",
+                    "tls"
+                  ],
+                  "description": "Type of secret to create (generic, docker-registry, tls)"
+                },
+                "serviceType": {
+                  "type": "string",
+                  "enum": [
+                    "clusterip",
+                    "nodeport",
+                    "loadbalancer",
+                    "externalname"
+                  ],
+                  "description": "Type of service to create (clusterip, nodeport, loadbalancer, externalname)"
+                },
+                "tcpPort": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Port pairs for tcp service (e.g. [\"80:8080\", \"443:8443\"])"
+                },
+                "image": {
+                  "type": "string",
+                  "description": "Image to use for the containers in the deployment"
+                },
+                "replicas": {
+                  "type": "number",
+                  "description": "Number of replicas to create for the deployment",
+                  "default": 1
+                },
+                "port": {
+                  "type": "number",
+                  "description": "Port that the container exposes"
+                },
+                "schedule": {
+                  "type": "string",
+                  "description": "Cron schedule expression for the CronJob (e.g. \"*/5 * * * *\")"
+                },
+                "suspend": {
+                  "type": "boolean",
+                  "description": "Whether to suspend the CronJob",
+                  "default": false
+                },
+                "command": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Command to run in the container"
+                },
+                "labels": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Labels to apply to the resource (e.g. [\"key1=value1\", \"key2=value2\"])"
+                },
+                "annotations": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Annotations to apply to the resource (e.g. [\"key1=value1\", \"key2=value2\"])"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": []
+            },
+            "kubectl_logs": {
+              "type": "object",
+              "properties": {
+                "resourceType": {
+                  "type": "string",
+                  "enum": [
+                    "pod",
+                    "deployment",
+                    "job",
+                    "cronjob"
+                  ],
+                  "description": "Type of resource to get logs from"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the resource"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "container": {
+                  "type": "string",
+                  "description": "Container name (required when pod has multiple containers)"
+                },
+                "tail": {
+                  "type": "number",
+                  "description": "Number of lines to show from end of logs"
+                },
+                "since": {
+                  "type": "string",
+                  "description": "Show logs since relative time (e.g. '5s', '2m', '3h')"
+                },
+                "sinceTime": {
+                  "type": "string",
+                  "description": "Show logs since absolute time (RFC3339)"
+                },
+                "timestamps": {
+                  "type": "boolean",
+                  "description": "Include timestamps in logs",
+                  "default": false
+                },
+                "previous": {
+                  "type": "boolean",
+                  "description": "Include logs from previously terminated containers",
+                  "default": false
+                },
+                "follow": {
+                  "type": "boolean",
+                  "description": "Follow logs output (not recommended, may cause timeouts)",
+                  "default": false
+                },
+                "labelSelector": {
+                  "type": "string",
+                  "description": "Filter resources by label selector"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "resourceType",
+                "name",
+                "namespace"
+              ]
+            },
+            "kubectl_scale": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Name of the deployment to scale"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "replicas": {
+                  "type": "number",
+                  "description": "Number of replicas to scale to"
+                },
+                "resourceType": {
+                  "type": "string",
+                  "description": "Resource type to scale (deployment, replicaset, statefulset)",
+                  "default": "deployment"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "name",
+                "replicas"
+              ]
+            },
+            "kubectl_patch": {
+              "type": "object",
+              "properties": {
+                "resourceType": {
+                  "type": "string",
+                  "description": "Type of resource to patch (e.g., pods, deployments, services)"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the resource to patch"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "patchType": {
+                  "type": "string",
+                  "description": "Type of patch to apply",
+                  "enum": [
+                    "strategic",
+                    "merge",
+                    "json"
+                  ],
+                  "default": "strategic"
+                },
+                "patchData": {
+                  "type": "object",
+                  "description": "Patch data as a JSON object"
+                },
+                "patchFile": {
+                  "type": "string",
+                  "description": "Path to a file containing the patch data (alternative to patchData)"
+                },
+                "dryRun": {
+                  "type": "boolean",
+                  "description": "If true, only validate the resource, don't actually execute the operation",
+                  "default": false
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "resourceType",
+                "name"
+              ]
+            },
+            "kubectl_rollout": {
+              "type": "object",
+              "properties": {
+                "subCommand": {
+                  "type": "string",
+                  "description": "Rollout subcommand to execute",
+                  "enum": [
+                    "history",
+                    "pause",
+                    "restart",
+                    "resume",
+                    "status",
+                    "undo"
+                  ],
+                  "default": "status"
+                },
+                "resourceType": {
+                  "type": "string",
+                  "description": "Type of resource to manage rollout for",
+                  "enum": [
+                    "deployment",
+                    "daemonset",
+                    "statefulset"
+                  ],
+                  "default": "deployment"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the resource"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "revision": {
+                  "type": "number",
+                  "description": "Revision to rollback to (for undo subcommand)"
+                },
+                "toRevision": {
+                  "type": "number",
+                  "description": "Revision to roll back to (for history subcommand)"
+                },
+                "timeout": {
+                  "type": "string",
+                  "description": "The length of time to wait before giving up (e.g., '30s', '1m', '2m30s')"
+                },
+                "watch": {
+                  "type": "boolean",
+                  "description": "Watch the rollout status in real-time until completion",
+                  "default": false
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "subCommand",
+                "resourceType",
+                "name",
+                "namespace"
+              ]
+            },
+            "kubectl_context": {
+              "type": "object",
+              "properties": {
+                "operation": {
+                  "type": "string",
+                  "enum": [
+                    "list",
+                    "get",
+                    "set"
+                  ],
+                  "description": "Operation to perform: list contexts, get current context, or set current context",
+                  "default": "list"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Name of the context to set as current (required for set operation)"
+                },
+                "showCurrent": {
+                  "type": "boolean",
+                  "description": "When listing contexts, highlight which one is currently active",
+                  "default": true
+                },
+                "detailed": {
+                  "type": "boolean",
+                  "description": "Include detailed information about the context",
+                  "default": false
+                },
+                "output": {
+                  "type": "string",
+                  "enum": [
+                    "json",
+                    "yaml",
+                    "name",
+                    "custom"
+                  ],
+                  "description": "Output format",
+                  "default": "json"
+                }
+              },
+              "required": [
+                "operation"
+              ]
+            },
+            "kubectl_reconnect": {
+              "type": "object",
+              "properties": {},
+              "required": []
+            },
+            "explain_resource": {
+              "type": "object",
+              "properties": {
+                "resource": {
+                  "type": "string",
+                  "description": "Resource name or field path (e.g. 'pods' or 'pods.spec.containers')"
+                },
+                "apiVersion": {
+                  "type": "string",
+                  "description": "API version to use (e.g. 'apps/v1')"
+                },
+                "recursive": {
+                  "type": "boolean",
+                  "description": "Print the fields of fields recursively",
+                  "default": false
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                },
+                "output": {
+                  "type": "string",
+                  "description": "Output format (plaintext or plaintext-openapiv2)",
+                  "enum": [
+                    "plaintext",
+                    "plaintext-openapiv2"
+                  ],
+                  "default": "plaintext"
+                }
+              },
+              "required": [
+                "resource"
+              ]
+            },
+            "install_helm_chart": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Name of the Helm release"
+                },
+                "chart": {
+                  "type": "string",
+                  "description": "Chart name (e.g., 'nginx') or path to chart directory"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                },
+                "repo": {
+                  "type": "string",
+                  "description": "Helm repository URL (optional if using local chart path)"
+                },
+                "values": {
+                  "type": "object",
+                  "description": "Custom values to override chart defaults"
+                },
+                "valuesFile": {
+                  "type": "string",
+                  "description": "Path to values file (alternative to values object)"
+                },
+                "useTemplate": {
+                  "type": "boolean",
+                  "description": "Use helm template + kubectl apply instead of helm install (bypasses auth issues)",
+                  "default": false
+                },
+                "createNamespace": {
+                  "type": "boolean",
+                  "description": "Create namespace if it doesn't exist",
+                  "default": true
+                }
+              },
+              "required": [
+                "name",
+                "chart",
+                "namespace"
+              ]
+            },
+            "upgrade_helm_chart": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Name of the Helm release to upgrade"
+                },
+                "chart": {
+                  "type": "string",
+                  "description": "Chart name or path to chart directory"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                },
+                "repo": {
+                  "type": "string",
+                  "description": "Helm repository URL (optional if using local chart path)"
+                },
+                "values": {
+                  "type": "object",
+                  "description": "Custom values to override chart defaults"
+                },
+                "valuesFile": {
+                  "type": "string",
+                  "description": "Path to values file (alternative to values object)"
+                }
+              },
+              "required": [
+                "name",
+                "chart",
+                "namespace"
+              ]
+            },
+            "uninstall_helm_chart": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Name of the Helm release to uninstall"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "name",
+                "namespace"
+              ]
+            },
+            "node_management": {
+              "type": "object",
+              "properties": {
+                "operation": {
+                  "type": "string",
+                  "description": "Node operation to perform",
+                  "enum": [
+                    "cordon",
+                    "drain",
+                    "uncordon"
+                  ]
+                },
+                "nodeName": {
+                  "type": "string",
+                  "description": "Name of the node to operate on (required for cordon, drain, uncordon)"
+                },
+                "force": {
+                  "type": "boolean",
+                  "description": "Force the operation even if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet (for drain operation)",
+                  "default": false
+                },
+                "gracePeriod": {
+                  "type": "number",
+                  "description": "Period of time in seconds given to each pod to terminate gracefully (for drain operation). If set to -1, uses the kubectl default grace period.",
+                  "default": -1
+                },
+                "deleteLocalData": {
+                  "type": "boolean",
+                  "description": "Delete local data even if emptyDir volumes are used (for drain operation)",
+                  "default": false
+                },
+                "ignoreDaemonsets": {
+                  "type": "boolean",
+                  "description": "Ignore DaemonSet-managed pods (for drain operation)",
+                  "default": true
+                },
+                "timeout": {
+                  "type": "string",
+                  "description": "The length of time to wait before giving up (for drain operation, e.g., '5m', '1h')",
+                  "default": "0"
+                },
+                "dryRun": {
+                  "type": "boolean",
+                  "description": "Show what would be done without actually doing it (for drain operation)",
+                  "default": false
+                },
+                "confirmDrain": {
+                  "type": "boolean",
+                  "description": "Explicit confirmation to drain the node (required for drain operation)",
+                  "default": false
+                }
+              },
+              "required": [
+                "operation"
+              ]
+            },
+            "port_forward": {
+              "type": "object",
+              "properties": {
+                "resourceType": {
+                  "type": "string"
+                },
+                "resourceName": {
+                  "type": "string"
+                },
+                "localPort": {
+                  "type": "number"
+                },
+                "targetPort": {
+                  "type": "number"
+                },
+                "namespace": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "resourceType",
+                "resourceName",
+                "localPort",
+                "targetPort"
+              ]
+            },
+            "stop_port_forward": {
+              "type": "object",
+              "properties": {
+                "id": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "id"
+              ]
+            },
+            "exec_in_pod": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Name of the pod to execute the command in"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "command": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Command to execute as an array of strings (e.g. [\"ls\", \"-la\", \"/app\"]). First element is the executable, remaining are arguments. Shell operators like pipes, redirects, or command chaining are not supported - use explicit array format for security."
+                },
+                "container": {
+                  "type": "string",
+                  "description": "Container name (required when pod has multiple containers)"
+                },
+                "timeout": {
+                  "type": "number",
+                  "description": "Timeout for command - 60000 milliseconds if not specified"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "name",
+                "command"
+              ]
+            },
+            "list_api_resources": {
+              "type": "object",
+              "properties": {
+                "apiGroup": {
+                  "type": "string",
+                  "description": "API group to filter by"
+                },
+                "namespaced": {
+                  "type": "boolean",
+                  "description": "If true, only show namespaced resources"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                },
+                "verbs": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "List of verbs to filter by"
+                },
+                "output": {
+                  "type": "string",
+                  "description": "Output format (wide, name, or no-headers)",
+                  "enum": [
+                    "wide",
+                    "name",
+                    "no-headers"
+                  ],
+                  "default": "wide"
+                }
+              }
+            },
+            "kubectl_generic": {
+              "type": "object",
+              "properties": {
+                "command": {
+                  "type": "string",
+                  "description": "The kubectl command to execute (e.g. patch, rollout, top)"
+                },
+                "subCommand": {
+                  "type": "string",
+                  "description": "Subcommand if applicable (e.g. 'history' for rollout)"
+                },
+                "resourceType": {
+                  "type": "string",
+                  "description": "Resource type (e.g. pod, deployment)"
+                },
+                "name": {
+                  "type": "string",
+                  "description": "Resource name"
+                },
+                "namespace": {
+                  "type": "string",
+                  "description": "Kubernetes namespace",
+                  "default": "default"
+                },
+                "allNamespaces": {
+                  "type": "boolean",
+                  "description": "If true, run the command across all namespaces",
+                  "default": false
+                },
+                "outputFormat": {
+                  "type": "string",
+                  "description": "Output format (e.g. json, yaml, wide)",
+                  "enum": [
+                    "json",
+                    "yaml",
+                    "wide",
+                    "name",
+                    "custom"
+                  ]
+                },
+                "flags": {
+                  "type": "object",
+                  "description": "Command flags as key-value pairs",
+                  "additionalProperties": true
+                },
+                "args": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Additional command arguments"
+                },
+                "context": {
+                  "type": "string",
+                  "description": "Kubeconfig Context to use for the command (optional - defaults to null)",
+                  "default": ""
+                }
+              },
+              "required": [
+                "command"
+              ]
+            },
+            "ping": {
+              "type": "object",
+              "properties": {},
+              "required": []
+            }
+          }
+        }
+      ]
+    },
+    {
+      "id": "prompts",
+      "capability": "prompts",
+      "status": "pass",
+      "durationMs": 0.29662500000085856,
+      "message": "Advertised capability responded with the minimal expected shape (1 item).",
+      "evidence": [
+        {
+          "endpoint": "prompts/list",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 1,
+          "identifiers": [
+            "k8s-diagnose"
+          ],
+          "diagnostics": [
+            "Starting Kubernetes MCP server v3.9.3, handling commands...",
+            "Telemetry: Disabled",
+            "(node:13988) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.",
+            "(Use `node --trace-deprecation ...` to show where the warning was created)"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "resources",
+      "capability": "resources",
+      "status": "pass",
+      "durationMs": 0.38045899999997346,
+      "message": "Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported.",
+      "evidence": [
+        {
+          "endpoint": "resources/list",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 5,
+          "identifiers": [
+            "k8s://default/pods",
+            "k8s://default/deployments",
+            "k8s://default/services",
+            "k8s://namespaces",
+            "k8s://nodes"
+          ],
+          "diagnostics": [
+            "Starting Kubernetes MCP server v3.9.3, handling commands...",
+            "Telemetry: Disabled",
+            "(node:13988) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.",
+            "(Use `node --trace-deprecation ...` to show where the warning was created)"
+          ]
+        },
+        {
+          "endpoint": "resources/templates/list",
+          "advertised": true,
+          "responded": false,
+          "minimalShapePresent": false,
+          "diagnostics": [
+            "MCP error -32601: Method not found",
+            "Starting Kubernetes MCP server v3.9.3, handling commands...",
+            "Telemetry: Disabled",
+            "(node:13988) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.",
+            "(Use `node --trace-deprecation ...` to show where the warning was created)"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "security-lite",
+      "capability": "security-lite",
+      "status": "fail",
+      "durationMs": 0.06358300000101735,
+      "message": "Found 8 security finding(s): 3 high, 3 medium, 2 low.",
+      "evidence": [
+        {
+          "endpoint": "security/scan-lite",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 8,
+          "identifiers": [
+            "cleanup",
+            "kubectl_apply",
+            "kubectl_delete",
+            "kubectl_create",
+            "kubectl_reconnect",
+            "exec_in_pod",
+            "kubectl_generic"
+          ],
+          "diagnostics": [
+            "[low] Tool \"cleanup\" has an empty schema but is marked as destructive.",
+            "[medium] Tool \"kubectl_apply\" accepts filesystem paths and has destructive capabilities.",
+            "[medium] Tool \"kubectl_delete\" accepts filesystem paths and has destructive capabilities.",
+            "[high] Tool \"kubectl_create\" has parameter \"command\" which may allow arbitrary command execution.",
+            "[medium] Tool \"kubectl_create\" accepts filesystem paths and has destructive capabilities.",
+            "[low] Tool \"kubectl_reconnect\" has an empty schema but is marked as destructive.",
+            "[high] Tool \"exec_in_pod\" has parameter \"command\" which may allow arbitrary command execution.",
+            "[high] Tool \"kubectl_generic\" has parameter \"command\" which may allow arbitrary command execution."
+          ],
+          "findings": [
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "cleanup",
+              "message": "Tool \"cleanup\" has an empty schema but is marked as destructive."
+            },
+            {
+              "ruleId": "broad-filesystem",
+              "severity": "medium",
+              "toolName": "kubectl_apply",
+              "message": "Tool \"kubectl_apply\" accepts filesystem paths and has destructive capabilities."
+            },
+            {
+              "ruleId": "broad-filesystem",
+              "severity": "medium",
+              "toolName": "kubectl_delete",
+              "message": "Tool \"kubectl_delete\" accepts filesystem paths and has destructive capabilities."
+            },
+            {
+              "ruleId": "shell-injection",
+              "severity": "high",
+              "toolName": "kubectl_create",
+              "message": "Tool \"kubectl_create\" has parameter \"command\" which may allow arbitrary command execution."
+            },
+            {
+              "ruleId": "broad-filesystem",
+              "severity": "medium",
+              "toolName": "kubectl_create",
+              "message": "Tool \"kubectl_create\" accepts filesystem paths and has destructive capabilities."
+            },
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "kubectl_reconnect",
+              "message": "Tool \"kubectl_reconnect\" has an empty schema but is marked as destructive."
+            },
+            {
+              "ruleId": "shell-injection",
+              "severity": "high",
+              "toolName": "exec_in_pod",
+              "message": "Tool \"exec_in_pod\" has parameter \"command\" which may allow arbitrary command execution."
+            },
+            {
+              "ruleId": "shell-injection",
+              "severity": "high",
+              "toolName": "kubectl_generic",
+              "message": "Tool \"kubectl_generic\" has parameter \"command\" which may allow arbitrary command execution."
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "conformance",
+      "capability": "conformance",
+      "status": "pass",
+      "durationMs": 1.6942920000001322,
+      "message": "All 7 conformance checks passed.",
+      "evidence": [
+        {
+          "endpoint": "conformance/check",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 7,
+          "identifiers": [],
+          "diagnostics": [
+            "[pass] capabilities-present: Server returned capabilities object.",
+            "[pass] server-info: Server provided initialization info.",
+            "[pass] tools-capability-match: tools/list returned 23 tool(s).",
+            "[pass] prompts-capability-match: prompts/list returned 1 prompt(s).",
+            "[pass] resources-capability-match: resources/list returned 5 resource(s).",
+            "[pass] tool-response-content: Tool \"cleanup\" response has valid content array.",
+            "[pass] error-handling: Server returned proper error code -32601 for unknown method."
+          ]
+        }
+      ]
+    },
+    {
+      "id": "schema-quality",
+      "capability": "schema-quality",
+      "status": "partial",
+      "durationMs": 0.48933300000135205,
+      "message": "Found 7 quality finding(s) across 29 item(s): 0 warnings, 7 info.",
+      "evidence": [
+        {
+          "endpoint": "schema-quality/scan",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 7,
+          "identifiers": [
+            "port_forward",
+            "stop_port_forward",
+            "list_api_resources"
+          ],
+          "diagnostics": [
+            "[info] tool \"port_forward\": Property 'resourceType' missing description",
+            "[info] tool \"port_forward\": Property 'resourceName' missing description",
+            "[info] tool \"port_forward\": Property 'localPort' missing description",
+            "[info] tool \"port_forward\": Property 'targetPort' missing description",
+            "[info] tool \"port_forward\": Property 'namespace' missing description",
+            "[info] tool \"stop_port_forward\": Property 'id' missing description",
+            "[info] tool \"list_api_resources\": Has properties but no 'required' array declared"
+          ],
+          "findings": [
+            {
+              "itemType": "tool",
+              "itemName": "port_forward",
+              "issue": "Property 'resourceType' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "port_forward",
+              "issue": "Property 'resourceName' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "port_forward",
+              "issue": "Property 'localPort' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "port_forward",
+              "issue": "Property 'targetPort' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "port_forward",
+              "issue": "Property 'namespace' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "stop_port_forward",
+              "issue": "Property 'id' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "list_api_resources",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "security",
+      "capability": "security",
+      "status": "fail",
+      "durationMs": 0.2782920000008744,
+      "message": "Found 8 security finding(s): 3 high, 3 medium, 2 low.",
+      "evidence": [
+        {
+          "endpoint": "security/scan",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 8,
+          "identifiers": [
+            "cleanup",
+            "kubectl_apply",
+            "kubectl_delete",
+            "kubectl_create",
+            "kubectl_reconnect",
+            "exec_in_pod",
+            "kubectl_generic"
+          ],
+          "diagnostics": [
+            "[low] Tool \"cleanup\" has an empty schema but is marked as destructive.",
+            "[medium] Tool \"kubectl_apply\" accepts filesystem paths and has destructive capabilities.",
+            "[medium] Tool \"kubectl_delete\" accepts filesystem paths and has destructive capabilities.",
+            "[high] Tool \"kubectl_create\" has parameter \"command\" which may allow arbitrary command execution.",
+            "[medium] Tool \"kubectl_create\" accepts filesystem paths and has destructive capabilities.",
+            "[low] Tool \"kubectl_reconnect\" has an empty schema but is marked as destructive.",
+            "[high] Tool \"exec_in_pod\" has parameter \"command\" which may allow arbitrary command execution.",
+            "[high] Tool \"kubectl_generic\" has parameter \"command\" which may allow arbitrary command execution."
+          ],
+          "findings": [
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "cleanup",
+              "message": "Tool \"cleanup\" has an empty schema but is marked as destructive."
+            },
+            {
+              "ruleId": "broad-filesystem",
+              "severity": "medium",
+              "toolName": "kubectl_apply",
+              "message": "Tool \"kubectl_apply\" accepts filesystem paths and has destructive capabilities."
+            },
+            {
+              "ruleId": "broad-filesystem",
+              "severity": "medium",
+              "toolName": "kubectl_delete",
+              "message": "Tool \"kubectl_delete\" accepts filesystem paths and has destructive capabilities."
+            },
+            {
+              "ruleId": "shell-injection",
+              "severity": "high",
+              "toolName": "kubectl_create",
+              "message": "Tool \"kubectl_create\" has parameter \"command\" which may allow arbitrary command execution."
+            },
+            {
+              "ruleId": "broad-filesystem",
+              "severity": "medium",
+              "toolName": "kubectl_create",
+              "message": "Tool \"kubectl_create\" accepts filesystem paths and has destructive capabilities."
+            },
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "kubectl_reconnect",
+              "message": "Tool \"kubectl_reconnect\" has an empty schema but is marked as destructive."
+            },
+            {
+              "ruleId": "shell-injection",
+              "severity": "high",
+              "toolName": "exec_in_pod",
+              "message": "Tool \"exec_in_pod\" has parameter \"command\" which may allow arbitrary command execution."
+            },
+            {
+              "ruleId": "shell-injection",
+              "severity": "high",
+              "toolName": "kubectl_generic",
+              "message": "Tool \"kubectl_generic\" has parameter \"command\" which may allow arbitrary command execution."
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "fail",
+      "durationMs": 0.750292000000627,
+      "message": "Safe attack simulation found 5 finding(s): 3 high, 2 medium, 0 low.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 5,
+          "identifiers": [
+            "kubectl_apply",
+            "kubectl_delete",
+            "kubectl_create",
+            "exec_in_pod",
+            "kubectl_generic"
+          ],
+          "diagnostics": [
+            "[medium] Tool \"kubectl_apply\" combines broad parameters (filename) with destructive or non-read-only behavior.",
+            "[medium] Tool \"kubectl_delete\" combines broad parameters (filename) with destructive or non-read-only behavior.",
+            "[high] Tool \"kubectl_create\" combines broad parameters (filename, command) with destructive or non-read-only behavior.",
+            "[high] Tool \"exec_in_pod\" combines broad parameters (command) with destructive or non-read-only behavior.",
+            "[high] Tool \"kubectl_generic\" combines broad parameters (command) with destructive or non-read-only behavior."
+          ],
+          "findings": [
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "medium",
+              "itemType": "tool",
+              "itemName": "kubectl_apply",
+              "message": "Tool \"kubectl_apply\" combines broad parameters (filename) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "filename"
+                ],
+                "annotations": {
+                  "destructiveHint": true
+                },
+                "description": "Apply a Kubernetes YAML manifest from a string or file"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "gate"
+            },
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "medium",
+              "itemType": "tool",
+              "itemName": "kubectl_delete",
+              "message": "Tool \"kubectl_delete\" combines broad parameters (filename) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "filename"
+                ],
+                "annotations": {
+                  "destructiveHint": true
+                },
+                "description": "Delete Kubernetes resources by resource type, name, labels, or from a manifest file"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "gate"
+            },
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "high",
+              "itemType": "tool",
+              "itemName": "kubectl_create",
+              "message": "Tool \"kubectl_create\" combines broad parameters (filename, command) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "filename",
+                  "command"
+                ],
+                "description": "Create Kubernetes resources using various methods (from file or using subcommands)"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "quarantine"
+            },
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "high",
+              "itemType": "tool",
+              "itemName": "exec_in_pod",
+              "message": "Tool \"exec_in_pod\" combines broad parameters (command) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "command"
+                ],
+                "annotations": {
+                  "destructiveHint": true
+                },
+                "description": "Execute a command in a Kubernetes pod or container and return the output. Command must be an array of strings where the first element is the executable and remaining elements are arguments. This executes directly without shell interpretation for security."
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "quarantine"
+            },
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "high",
+              "itemType": "tool",
+              "itemName": "kubectl_generic",
+              "message": "Tool \"kubectl_generic\" combines broad parameters (command) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "command"
+                ],
+                "annotations": {
+                  "destructiveHint": true
+                },
+                "description": "Execute any kubectl command with the provided arguments and flags"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "quarantine"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "healthScore": {
+    "overall": 72,
+    "grade": "C",
+    "dimensions": [
+      {
+        "name": "Protocol Compliance",
+        "weight": 0.3,
+        "score": 100,
+        "details": [
+          "conformance: pass (100/100)"
+        ]
+      },
+      {
+        "name": "Schema Quality",
+        "weight": 0.2,
+        "score": 60,
+        "details": [
+          "schema-quality: partial (60/100)"
+        ]
+      },
+      {
+        "name": "Security",
+        "weight": 0.2,
+        "score": 0,
+        "details": [
+          "security-lite: fail (0/100)",
+          "security: fail (0/100)",
+          "attack-sim: fail (0/100)"
+        ]
+      },
+      {
+        "name": "Reliability",
+        "weight": 0.2,
+        "score": 100,
+        "details": [
+          "tools: pass (100/100)",
+          "prompts: pass (100/100)",
+          "resources: pass (100/100)"
+        ]
+      },
+      {
+        "name": "Performance",
+        "weight": 0.1,
+        "score": 100,
+        "details": [
+          "Connect: 1296ms",
+          "p95 latency: 1ms (3 operations)"
+        ]
+      }
+    ]
+  },
+  "performanceMetrics": {
+    "connectMs": 1295.9490000000005,
+    "toolsListMs": 1.2567500000004657,
+    "promptsListMs": 0.29662500000085856,
+    "resourcesListMs": 0.38045899999997346
+  }
+}