mcp-server-kubernetes 2.4.9 → 2.5.0

package/dist/config/max-buffer.d.ts

@@ -0,0 +1 @@
+export declare function getSpawnMaxBuffer(): number;

package/dist/config/max-buffer.js

@@ -0,0 +1,3 @@
+export function getSpawnMaxBuffer() {
+    return parseInt(process.env.SPAWN_MAX_BUFFER || "1048577", 10);
+}

package/dist/index.js

@@ -24,8 +24,20 @@ import { kubectlPatch, kubectlPatchSchema } from "./tools/kubectl-patch.js";
 import { kubectlRollout, kubectlRolloutSchema, } from "./tools/kubectl-rollout.js";
 import { registerPromptHandlers } from "./prompts/index.js";
 import { ping, pingSchema } from "./tools/ping.js";
-// Check if non-destructive tools only mode is enabled
+// Check environment variables for tool filtering
+const allowOnlyReadonlyTools = process.env.ALLOW_ONLY_READONLY_TOOLS === "true";
+const allowedToolsEnv = process.env.ALLOWED_TOOLS;
 const nonDestructiveTools = process.env.ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS === "true";
+// Define readonly tools
+const readonlyTools = [
+    kubectlGetSchema,
+    kubectlDescribeSchema,
+    kubectlLogsSchema,
+    kubectlContextSchema,
+    explainResourceSchema,
+    listApiResourcesSchema,
+    pingSchema,
+];
 // Define destructive tools (delete and uninstall operations)
 const destructiveTools = [
     kubectlDeleteSchema, // This replaces all individual delete operations
@@ -85,10 +97,20 @@ server.setRequestHandler(ReadResourceRequestSchema, resourceHandlers.readResourc
 registerPromptHandlers(server, k8sManager);
 // Tools handlers
 server.setRequestHandler(ListToolsRequestSchema, async () => {
-    // Filter out destructive tools if ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS is set to 'true'
-    const tools = nonDestructiveTools
-        ? allTools.filter((tool) => !destructiveTools.some((dt) => dt.name === tool.name))
-        : allTools;
+    let tools;
+    if (allowedToolsEnv) {
+        const allowedToolNames = allowedToolsEnv.split(",").map((t) => t.trim());
+        tools = allTools.filter((tool) => allowedToolNames.includes(tool.name));
+    }
+    else if (allowOnlyReadonlyTools) {
+        tools = readonlyTools;
+    }
+    else if (nonDestructiveTools) {
+        tools = allTools.filter((tool) => !destructiveTools.some((dt) => dt.name === tool.name));
+    }
+    else {
+        tools = allTools;
+    }
     return { tools };
 });
 server.setRequestHandler(CallToolRequestSchema, async (request) => {

package/dist/tools/exec_in_pod.d.ts

@@ -42,17 +42,14 @@ export declare const execInPodSchema: {
             container: {
                 type: string;
                 description: string;
-                optional: boolean;
             };
             shell: {
                 type: string;
                 description: string;
-                optional: boolean;
             };
             timeout: {
                 type: string;
                 description: string;
-                optional: boolean;
             };
         };
         required: string[];

package/dist/tools/exec_in_pod.js

@@ -39,17 +39,14 @@ export const execInPodSchema = {
             container: {
                 type: "string",
                 description: "Container name (required when pod has multiple containers)",
-                optional: true,
             },
             shell: {
                 type: "string",
                 description: "Shell to use for command execution (e.g. '/bin/sh', '/bin/bash'). If not provided, will use command as-is.",
-                optional: true,
             },
             timeout: {
                 type: "number",
                 description: "Timeout for command - 60000 milliseconds if not specified",
-                optional: true,
             },
         },
         required: ["name", "command"],

package/dist/tools/helm-operations.js

@@ -1,6 +1,7 @@
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { writeFileSync, unlinkSync } from "fs";
 import yaml from "yaml";
+import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 export const installHelmChartSchema = {
     name: "install_helm_chart",
     description: "Install a Helm chart",
@@ -83,13 +84,14 @@ export const uninstallHelmChartSchema = {
         required: ["name", "namespace"],
     },
 };
-const executeHelmCommand = (command) => {
+const executeHelmCommand = (command, args) => {
     try {
         // Add a generous timeout of 60 seconds for Helm operations
-        return execSync(command, {
+        return execFileSync(command, args, {
             encoding: "utf8",
             timeout: 60000, // 60 seconds timeout
-            env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG }
+            maxBuffer: getSpawnMaxBuffer(),
+            env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
         });
     }
     catch (error) {
@@ -106,16 +108,24 @@ export async function installHelmChart(params) {
         // Add helm repository if provided
         if (params.repo) {
             const repoName = params.chart.split("/")[0];
-            executeHelmCommand(`helm repo add ${repoName} ${params.repo}`);
-            executeHelmCommand("helm repo update");
+            executeHelmCommand("helm", ["repo", "add", repoName, params.repo]);
+            executeHelmCommand("helm", ["repo", "update"]);
         }
-        let command = `helm install ${params.name} ${params.chart} --namespace ${params.namespace} --create-namespace`;
+        let command = "helm";
+        let args = [
+            "install",
+            params.name,
+            params.chart,
+            "--namespace",
+            params.namespace,
+            "--create-namespace",
+        ];
         // Handle values if provided
         if (params.values) {
             const valuesFile = writeValuesFile(params.name, params.values);
-            command += ` -f ${valuesFile}`;
+            args.push("-f", valuesFile);
             try {
-                executeHelmCommand(command);
+                executeHelmCommand(command, args);
             }
             finally {
                 // Cleanup values file
@@ -123,7 +133,7 @@ export async function installHelmChart(params) {
             }
         }
         else {
-            executeHelmCommand(command);
+            executeHelmCommand(command, args);
         }
         const response = {
             status: "installed",
@@ -147,16 +157,23 @@ export async function upgradeHelmChart(params) {
         // Add helm repository if provided
         if (params.repo) {
             const repoName = params.chart.split("/")[0];
-            executeHelmCommand(`helm repo add ${repoName} ${params.repo}`);
-            executeHelmCommand("helm repo update");
+            executeHelmCommand("helm", ["repo", "add", repoName, params.repo]);
+            executeHelmCommand("helm", ["repo", "update"]);
         }
-        let command = `helm upgrade ${params.name} ${params.chart} --namespace ${params.namespace}`;
+        let command = "helm";
+        let args = [
+            "upgrade",
+            params.name,
+            params.chart,
+            "--namespace",
+            params.namespace,
+        ];
         // Handle values if provided
         if (params.values) {
             const valuesFile = writeValuesFile(params.name, params.values);
-            command += ` -f ${valuesFile}`;
+            args.push("-f", valuesFile);
             try {
-                executeHelmCommand(command);
+                executeHelmCommand(command, args);
             }
             finally {
                 // Cleanup values file
@@ -164,7 +181,7 @@ export async function upgradeHelmChart(params) {
             }
         }
         else {
-            executeHelmCommand(command);
+            executeHelmCommand(command, args);
         }
         const response = {
             status: "upgraded",
@@ -185,7 +202,12 @@ export async function upgradeHelmChart(params) {
 }
 export async function uninstallHelmChart(params) {
     try {
-        executeHelmCommand(`helm uninstall ${params.name} --namespace ${params.namespace}`);
+        executeHelmCommand("helm", [
+            "uninstall",
+            params.name,
+            "--namespace",
+            params.namespace,
+        ]);
         const response = {
             status: "uninstalled",
             message: `Successfully uninstalled ${params.name}`,

package/dist/tools/kubectl-apply.js

@@ -1,8 +1,9 @@
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
+import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 export const kubectlApplySchema = {
     name: "kubectl_apply",
     description: "Apply a Kubernetes YAML manifest from a string or file",
@@ -11,27 +12,27 @@ export const kubectlApplySchema = {
         properties: {
             manifest: {
                 type: "string",
-                description: "YAML manifest to apply"
+                description: "YAML manifest to apply",
             },
             filename: {
                 type: "string",
-                description: "Path to a YAML file to apply (optional - use either manifest or filename)"
+                description: "Path to a YAML file to apply (optional - use either manifest or filename)",
             },
             namespace: {
                 type: "string",
                 description: "Namespace to apply the resource to (optional)",
-                default: "default"
+                default: "default",
             },
             dryRun: {
                 type: "boolean",
                 description: "If true, only validate the resource, don't apply it",
-                default: false
+                default: false,
             },
             force: {
                 type: "boolean",
                 description: "If true, immediately remove resources from API and bypass graceful deletion",
-                default: false
-            }
+                default: false,
+            },
         },
         required: [],
     },
@@ -44,7 +45,8 @@ export async function kubectlApply(k8sManager, input) {
         const namespace = input.namespace || "default";
         const dryRun = input.dryRun || false;
         const force = input.force || false;
-        let command = "kubectl apply";
+        let command = "kubectl";
+        let args = ["apply"];
         let tempFile = null;
         // Process manifest content if provided
         if (input.manifest) {
@@ -52,24 +54,28 @@ export async function kubectlApply(k8sManager, input) {
             const tmpDir = os.tmpdir();
             tempFile = path.join(tmpDir, `manifest-${Date.now()}.yaml`);
             fs.writeFileSync(tempFile, input.manifest);
-            command += ` -f ${tempFile}`;
+            args.push("-f", tempFile);
         }
         else if (input.filename) {
-            command += ` -f ${input.filename}`;
+            args.push("-f", input.filename);
         }
         // Add namespace
-        command += ` -n ${namespace}`;
+        args.push("-n", namespace);
         // Add dry-run flag if requested
         if (dryRun) {
-            command += " --dry-run=client";
+            args.push("--dry-run=client");
         }
         // Add force flag if requested
         if (force) {
-            command += " --force";
+            args.push("--force");
         }
         // Execute the command
         try {
-            const result = execSync(command, { encoding: "utf8", env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG } });
+            const result = execFileSync(command, args, {
+                encoding: "utf8",
+                maxBuffer: getSpawnMaxBuffer(),
+                env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
+            });
             // Clean up temp file if created
             if (tempFile) {
                 try {

package/dist/tools/kubectl-context.js

@@ -1,5 +1,6 @@
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 export const kubectlContextSchema = {
     name: "kubectl_context",
     description: "Manage Kubernetes contexts - list, get, or set the current context",
@@ -10,28 +11,28 @@ export const kubectlContextSchema = {
                 type: "string",
                 enum: ["list", "get", "set"],
                 description: "Operation to perform: list contexts, get current context, or set current context",
-                default: "list"
+                default: "list",
             },
             name: {
                 type: "string",
-                description: "Name of the context to set as current (required for set operation)"
+                description: "Name of the context to set as current (required for set operation)",
             },
             showCurrent: {
                 type: "boolean",
                 description: "When listing contexts, highlight which one is currently active",
-                default: true
+                default: true,
             },
             detailed: {
                 type: "boolean",
                 description: "Include detailed information about the context",
-                default: false
+                default: false,
             },
             output: {
                 type: "string",
                 enum: ["json", "yaml", "name", "custom"],
                 description: "Output format",
-                default: "json"
-            }
+                default: "json",
+            },
         },
         required: ["operation"],
     },
@@ -41,18 +42,22 @@ export async function kubectlContext(k8sManager, input) {
         const { operation, name, output = "json" } = input;
         const showCurrent = input.showCurrent !== false; // Default to true if not specified
         const detailed = input.detailed === true; // Default to false if not specified
-        let command = "";
+        const command = "kubectl";
         let result = "";
         switch (operation) {
             case "list":
                 // Build command to list contexts
-                command = "kubectl config get-contexts";
+                let listArgs = ["config", "get-contexts"];
                 if (output === "name") {
-                    command += " -o name";
+                    listArgs.push("-o", "name");
                 }
                 else if (output === "custom" || output === "json") {
                     // For custom or JSON output, we'll format it ourselves
-                    const rawResult = execSync(command, { encoding: "utf8", env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG } });
+                    const rawResult = execFileSync(command, listArgs, {
+                        encoding: "utf8",
+                        maxBuffer: getSpawnMaxBuffer(),
+                        env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
+                    });
                     // Parse the tabular output from kubectl
                     const lines = rawResult.trim().split("\n");
                     const headers = lines[0].trim().split(/\s+/);
@@ -70,7 +75,7 @@ export async function kubectlContext(k8sManager, input) {
                             cluster: columns[clusterIndex]?.trim(),
                             user: columns[authInfoIndex]?.trim(),
                             namespace: columns[namespaceIndex]?.trim() || "default",
-                            isCurrent: isCurrent
+                            isCurrent: isCurrent,
                         });
                     }
                     return {
@@ -83,17 +88,29 @@ export async function kubectlContext(k8sManager, input) {
                     };
                 }
                 // Execute the command for non-json outputs
-                result = execSync(command, { encoding: "utf8", env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG } });
+                result = execFileSync(command, listArgs, {
+                    encoding: "utf8",
+                    maxBuffer: getSpawnMaxBuffer(),
+                    env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
+                });
                 break;
             case "get":
                 // Build command to get current context
-                command = "kubectl config current-context";
+                const getArgs = ["config", "current-context"];
                 // Execute the command
                 try {
-                    const currentContext = execSync(command, { encoding: "utf8", env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG } }).trim();
+                    const currentContext = execFileSync(command, getArgs, {
+                        encoding: "utf8",
+                        maxBuffer: getSpawnMaxBuffer(),
+                        env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
+                    }).trim();
                     if (detailed) {
                         // For detailed context info, we need to use get-contexts and filter
-                        const allContextsOutput = execSync("kubectl config get-contexts", { encoding: "utf8", env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG } });
+                        const allContextsOutput = execFileSync(command, ["config", "get-contexts"], {
+                            encoding: "utf8",
+                            maxBuffer: getSpawnMaxBuffer(),
+                            env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
+                        });
                         // Parse the tabular output from kubectl
                         const lines = allContextsOutput.trim().split("\n");
                         const headers = lines[0].trim().split(/\s+/);
@@ -105,7 +122,7 @@ export async function kubectlContext(k8sManager, input) {
                             name: currentContext,
                             cluster: "",
                             user: "",
-                            namespace: "default"
+                            namespace: "default",
                         };
                         // Find the current context in the output
                         for (let i = 1; i < lines.length; i++) {
@@ -117,7 +134,7 @@ export async function kubectlContext(k8sManager, input) {
                                     name: currentContext,
                                     cluster: columns[clusterIndex]?.trim() || "",
                                     user: columns[authInfoIndex]?.trim() || "",
-                                    namespace: columns[namespaceIndex]?.trim() || "default"
+                                    namespace: columns[namespaceIndex]?.trim() || "default",
                                 };
                                 break;
                             }
@@ -155,7 +172,10 @@ export async function kubectlContext(k8sManager, input) {
                             content: [
                                 {
                                     type: "text",
-                                    text: JSON.stringify({ currentContext: null, error: "No current context is set" }, null, 2),
+                                    text: JSON.stringify({
+                                        currentContext: null,
+                                        error: "No current context is set",
+                                    }, null, 2),
                                 },
                             ],
                         };
@@ -169,7 +189,11 @@ export async function kubectlContext(k8sManager, input) {
                 }
                 // First check if the context exists
                 try {
-                    const allContextsOutput = execSync("kubectl config get-contexts -o name", { encoding: "utf8", env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG } });
+                    const allContextsOutput = execFileSync(command, ["config", "get-contexts", "-o", "name"], {
+                        encoding: "utf8",
+                        maxBuffer: getSpawnMaxBuffer(),
+                        env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
+                    });
                     const availableContexts = allContextsOutput.trim().split("\n");
                     // Extract the short name from the ARN if needed
                     let contextName = name;
@@ -180,13 +204,18 @@ export async function kubectlContext(k8sManager, input) {
                         }
                     }
                     // Check if the context exists
-                    if (!availableContexts.includes(contextName) && !availableContexts.includes(name)) {
+                    if (!availableContexts.includes(contextName) &&
+                        !availableContexts.includes(name)) {
                         throw new McpError(ErrorCode.InvalidParams, `Context '${name}' not found`);
                     }
                     // Build command to set context
-                    command = `kubectl config use-context "${contextName}"`;
+                    const setArgs = ["config", "use-context", contextName];
                     // Execute the command
-                    result = execSync(command, { encoding: "utf8", env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG } });
+                    result = execFileSync(command, setArgs, {
+                        encoding: "utf8",
+                        maxBuffer: getSpawnMaxBuffer(),
+                        env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
+                    });
                     // For tests to pass, we need to return the original name format that was passed in
                     return {
                         content: [
@@ -195,7 +224,7 @@ export async function kubectlContext(k8sManager, input) {
                                 text: JSON.stringify({
                                     success: true,
                                     message: `Current context set to '${name}'`,
-                                    context: name
+                                    context: name,
                                 }, null, 2),
                             },
                         ],