mcp-server-kubernetes 3.9.2 → 4.0.0

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "3.9.2";
+    readonly version: "4.0.0";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "3.9.2",
+    version: "4.0.0",
     capabilities: {
         resources: {},
         tools: {},

package/dist/tools/kubectl-generic.d.ts

@@ -29,6 +29,11 @@ export declare const kubectlGenericSchema: {
                 description: string;
                 default: string;
             };
+            allNamespaces: {
+                type: string;
+                description: string;
+                default: boolean;
+            };
             outputFormat: {
                 type: string;
                 description: string;
@@ -61,6 +66,7 @@ export declare function kubectlGeneric(k8sManager: KubernetesManager, input: {
     resourceType?: string;
     name?: string;
     namespace?: string;
+    allNamespaces?: boolean;
     outputFormat?: string;
     flags?: Record<string, any>;
     args?: string[];

package/dist/tools/kubectl-generic.js

@@ -29,6 +29,11 @@ export const kubectlGenericSchema = {
                 description: "Resource name",
             },
             namespace: namespaceParameter,
+            allNamespaces: {
+                type: "boolean",
+                description: "If true, run the command across all namespaces",
+                default: false,
+            },
             outputFormat: {
                 type: "string",
                 description: "Output format (e.g. json, yaml, wide)",
@@ -69,8 +74,12 @@ export async function kubectlGeneric(k8sManager, input) {
         if (input.name) {
             cmdArgs.push(input.name);
         }
-        // Add namespace if provided
-        if (input.namespace) {
+        // Add namespace scoping: --all-namespaces takes precedence over a
+        // specific namespace (kubectl rejects using both together)
+        if (input.allNamespaces) {
+            cmdArgs.push("--all-namespaces");
+        }
+        else if (input.namespace) {
             cmdArgs.push(`--namespace=${input.namespace}`);
         }
         // Add output format if provided

package/dist/tools/port_forward.js

@@ -1,6 +1,13 @@
 import { spawn } from "child_process";
+import { McpError } from "@modelcontextprotocol/sdk/types.js";
+import { assertSafeArgv } from "../security/kubectl-flags.js";
 // Use spawn instead of exec because port-forward is a long-running process
 async function executePortForward(args) {
+    // port_forward uses spawn (long-running process) rather than the shared
+    // execFileSyncSafe wrapper, so it must run the argv guard itself. Otherwise
+    // user-supplied values pushed into positional slots (e.g. resourceType) can
+    // smuggle credential/target-redirecting flags such as --server.
+    assertSafeArgv(args);
     return new Promise((resolve, reject) => {
         const process = spawn("kubectl", args);
         let output = "";
@@ -92,6 +99,10 @@ export async function startPortForward(k8sManager, input) {
         };
     }
     catch (error) {
+        // Preserve McpError (e.g. the argv safety guard's InvalidParams rejection)
+        // so the client sees the real reason instead of a generic InternalError.
+        if (error instanceof McpError)
+            throw error;
         throw new Error(`Failed to execute port-forward: ${error.message}`);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "3.9.2",
+  "version": "4.0.0",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",