mcp-server-kubernetes 4.0.0 → 4.0.2

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "4.0.0";
+    readonly version: "4.0.2";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "4.0.0",
+    version: "4.0.2",
     capabilities: {
         resources: {},
         tools: {},

package/dist/index.d.ts

@@ -616,7 +616,7 @@ declare const allTools: ({
             };
             readonly filename: {
                 readonly type: "string";
-                readonly description: "Path to a YAML file to create resources from";
+                readonly description: "Path to a YAML file to create resources from. The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.";
             };
             readonly resourceType: {
                 readonly type: "string";
@@ -643,7 +643,26 @@ declare const allTools: ({
                 readonly items: {
                     readonly type: "string";
                 };
-                readonly description: "Path to file for creating configmap (e.g. [\"key1=/path/to/file1\", \"key2=/path/to/file2\"])";
+                readonly description: "Path to file for creating configmap/secret (e.g. [\"key1=/path/to/file1\", \"key2=/path/to/file2\"]). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use \"fromFileContent\" to pass file contents directly instead.";
+            };
+            readonly fromFileContent: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "object";
+                    readonly properties: {
+                        readonly key: {
+                            readonly type: "string";
+                            readonly description: "Key to store the content under in the configmap/secret";
+                        };
+                        readonly content: {
+                            readonly type: "string";
+                            readonly description: "The file content to store";
+                        };
+                    };
+                    readonly required: readonly ["key", "content"];
+                    readonly additionalProperties: false;
+                };
+                readonly description: "Inline file contents for creating a configmap/secret, provided by the client instead of a server-side path (e.g. [{\"key\": \"app.conf\", \"content\": \"...\"}]). Safe on all transports; use this instead of \"fromFile\" on remote (SSE/Streamable HTTP) servers.";
             };
             readonly secretType: {
                 readonly type: "string";

package/dist/security/transport.d.ts

@@ -0,0 +1 @@
+export declare function isRemoteTransport(): boolean;

package/dist/security/transport.js

@@ -0,0 +1,17 @@
+// Transport-mode detection for security decisions.
+//
+// The server selects its transport at startup based on these env vars (see
+// src/index.ts): if either is set the server listens over HTTP (SSE or
+// Streamable HTTP) and serves remote clients; otherwise it uses stdio and is
+// driven by a local process that already runs as the operator.
+//
+// Some tool inputs are only safe under the stdio trust model. A server-side
+// filesystem path (e.g. `--from-file` / `-f`) is read on the machine running
+// the server: over stdio that machine is the operator's own, but over HTTP it
+// is the server host, so any client that can reach the endpoint could read
+// arbitrary files (kubeconfig, service-account token, /proc/self/environ).
+// Guards use this helper to reject path-based reads on remote transports.
+export function isRemoteTransport() {
+    return Boolean(process.env.ENABLE_UNSAFE_SSE_TRANSPORT ||
+        process.env.ENABLE_UNSAFE_STREAMABLE_HTTP_TRANSPORT);
+}

package/dist/tools/kubectl-create.d.ts

@@ -27,7 +27,7 @@ export declare const kubectlCreateSchema: {
             };
             readonly filename: {
                 readonly type: "string";
-                readonly description: "Path to a YAML file to create resources from";
+                readonly description: "Path to a YAML file to create resources from. The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.";
             };
             readonly resourceType: {
                 readonly type: "string";
@@ -54,7 +54,26 @@ export declare const kubectlCreateSchema: {
                 readonly items: {
                     readonly type: "string";
                 };
-                readonly description: "Path to file for creating configmap (e.g. [\"key1=/path/to/file1\", \"key2=/path/to/file2\"])";
+                readonly description: "Path to file for creating configmap/secret (e.g. [\"key1=/path/to/file1\", \"key2=/path/to/file2\"]). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use \"fromFileContent\" to pass file contents directly instead.";
+            };
+            readonly fromFileContent: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "object";
+                    readonly properties: {
+                        readonly key: {
+                            readonly type: "string";
+                            readonly description: "Key to store the content under in the configmap/secret";
+                        };
+                        readonly content: {
+                            readonly type: "string";
+                            readonly description: "The file content to store";
+                        };
+                    };
+                    readonly required: readonly ["key", "content"];
+                    readonly additionalProperties: false;
+                };
+                readonly description: "Inline file contents for creating a configmap/secret, provided by the client instead of a server-side path (e.g. [{\"key\": \"app.conf\", \"content\": \"...\"}]). Safe on all transports; use this instead of \"fromFile\" on remote (SSE/Streamable HTTP) servers.";
             };
             readonly secretType: {
                 readonly type: "string";
@@ -136,6 +155,10 @@ export declare function kubectlCreate(k8sManager: KubernetesManager, input: {
     namespace?: string;
     fromLiteral?: string[];
     fromFile?: string[];
+    fromFileContent?: {
+        key: string;
+        content: string;
+    }[];
     secretType?: "generic" | "docker-registry" | "tls";
     serviceType?: "clusterip" | "nodeport" | "loadbalancer" | "externalname";
     tcpPort?: string[];

package/dist/tools/kubectl-create.js

@@ -5,6 +5,7 @@ import * as path from "path";
 import * as os from "os";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter, dryRunParameter } from "../models/common-parameters.js";
+import { isRemoteTransport } from "../security/transport.js";
 export const kubectlCreateSchema = {
     name: "kubectl_create",
     description: "Create Kubernetes resources using various methods (from file or using subcommands)",
@@ -42,7 +43,7 @@ export const kubectlCreateSchema = {
             },
             filename: {
                 type: "string",
-                description: "Path to a YAML file to create resources from",
+                description: "Path to a YAML file to create resources from. The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.",
             },
             // Resource type to create (determines which subcommand to use)
             resourceType: {
@@ -64,7 +65,26 @@ export const kubectlCreateSchema = {
             fromFile: {
                 type: "array",
                 items: { type: "string" },
-                description: 'Path to file for creating configmap (e.g. ["key1=/path/to/file1", "key2=/path/to/file2"])',
+                description: 'Path to file for creating configmap/secret (e.g. ["key1=/path/to/file1", "key2=/path/to/file2"]). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use "fromFileContent" to pass file contents directly instead.',
+            },
+            fromFileContent: {
+                type: "array",
+                items: {
+                    type: "object",
+                    properties: {
+                        key: {
+                            type: "string",
+                            description: "Key to store the content under in the configmap/secret",
+                        },
+                        content: {
+                            type: "string",
+                            description: "The file content to store",
+                        },
+                    },
+                    required: ["key", "content"],
+                    additionalProperties: false,
+                },
+                description: 'Inline file contents for creating a configmap/secret, provided by the client instead of a server-side path (e.g. [{"key": "app.conf", "content": "..."}]). Safe on all transports; use this instead of "fromFile" on remote (SSE/Streamable HTTP) servers.',
             },
             // Namespace specific parameters
             // No special parameters for namespace, just name is needed
@@ -143,6 +163,21 @@ export async function kubectlCreate(k8sManager, input) {
             input.resourceType !== "namespace") {
             throw new McpError(ErrorCode.InvalidRequest, `Name is required when creating a ${input.resourceType}`);
         }
+        // Reject server-side filesystem reads on remote transports. Over SSE /
+        // Streamable HTTP the path resolves on the MCP server host, not the
+        // client, so `filename` (-f) and `fromFile` (--from-file) would let any
+        // client that can reach the endpoint read arbitrary server files
+        // (kubeconfig, service-account token, /proc/self/environ, etc.). See
+        // GHSA-m67f-jxm9-cvx8. Clients on these transports must pass content
+        // inline via `manifest` or `fromFileContent` instead.
+        if (isRemoteTransport()) {
+            if (input.filename) {
+                throw new McpError(ErrorCode.InvalidRequest, "The 'filename' parameter reads a file from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the file contents via 'manifest' instead.");
+            }
+            if (input.fromFile && input.fromFile.length > 0) {
+                throw new McpError(ErrorCode.InvalidRequest, "The 'fromFile' parameter reads files from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the file contents via 'fromFileContent' instead.");
+            }
+        }
         // Set up common parameters
         const namespace = input.namespace || "default";
         const dryRun = input.dryRun || false;
@@ -151,15 +186,33 @@ export async function kubectlCreate(k8sManager, input) {
         const context = input.context || "";
         const command = "kubectl";
         const args = ["create"];
-        let tempFile = null;
+        const tempFiles = [];
+        // Write client-provided content to a private temp file and return its
+        // path. The file is tracked for cleanup after kubectl runs.
+        const writeTempFile = (contents, label, ext = "") => {
+            const tmpDir = os.tmpdir();
+            const tempFile = path.join(tmpDir, `create-${label}-${Date.now()}-${tempFiles.length}${ext}`);
+            fs.writeFileSync(tempFile, contents, { mode: 0o600 });
+            tempFiles.push(tempFile);
+            return tempFile;
+        };
+        // Emit `--from-file=<key>=<tempfile>` args for inline content supplied by
+        // the client. Each entry's content is written to a server-side temp file
+        // (never a client-controlled path), so this is safe on all transports.
+        const pushFromFileContent = (entries) => {
+            entries.forEach((entry) => {
+                if (!entry.key) {
+                    throw new McpError(ErrorCode.InvalidRequest, "Each fromFileContent entry requires a non-empty 'key'");
+                }
+                const tempFile = writeTempFile(entry.content ?? "", "fromfile");
+                args.push(`--from-file=${entry.key}=${tempFile}`);
+            });
+        };
         // Process manifest content if provided (file-based creation)
         if (input.manifest || input.filename) {
             if (input.manifest) {
                 // Create temporary file for the manifest
-                const tmpDir = os.tmpdir();
-                tempFile = path.join(tmpDir, `create-manifest-${Date.now()}.yaml`);
-                fs.writeFileSync(tempFile, input.manifest);
-                args.push("-f", tempFile);
+                args.push("-f", writeTempFile(input.manifest, "manifest", ".yaml"));
             }
             else if (input.filename) {
                 args.push("-f", input.filename);
@@ -179,12 +232,17 @@ export async function kubectlCreate(k8sManager, input) {
                             args.push(`--from-literal=${literal}`);
                         });
                     }
-                    // Add --from-file arguments
+                    // Add --from-file arguments (server-side paths; blocked on remote
+                    // transports by the guard above)
                     if (input.fromFile && input.fromFile.length > 0) {
                         input.fromFile.forEach((file) => {
                             args.push(`--from-file=${file}`);
                         });
                     }
+                    // Add inline file contents (safe on all transports)
+                    if (input.fromFileContent && input.fromFileContent.length > 0) {
+                        pushFromFileContent(input.fromFileContent);
+                    }
                     break;
                 case "secret":
                     if (!input.secretType) {
@@ -197,12 +255,17 @@ export async function kubectlCreate(k8sManager, input) {
                             args.push(`--from-literal=${literal}`);
                         });
                     }
-                    // Add --from-file arguments
+                    // Add --from-file arguments (server-side paths; blocked on remote
+                    // transports by the guard above)
                     if (input.fromFile && input.fromFile.length > 0) {
                         input.fromFile.forEach((file) => {
                             args.push(`--from-file=${file}`);
                         });
                     }
+                    // Add inline file contents (safe on all transports)
+                    if (input.fromFileContent && input.fromFileContent.length > 0) {
+                        pushFromFileContent(input.fromFileContent);
+                    }
                     break;
                 case "service":
                     if (!input.serviceType) {
@@ -292,6 +355,17 @@ export async function kubectlCreate(k8sManager, input) {
         if (context) {
             args.push("--context", context);
         }
+        // Remove any temp files created for inline content.
+        const cleanupTempFiles = () => {
+            tempFiles.forEach((tempFile) => {
+                try {
+                    fs.unlinkSync(tempFile);
+                }
+                catch (err) {
+                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
+                }
+            });
+        };
         // Execute the command
         try {
             const result = execFileSyncSafe(command, args, {
@@ -299,15 +373,8 @@ export async function kubectlCreate(k8sManager, input) {
                 maxBuffer: getSpawnMaxBuffer(),
                 env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
             });
-            // Clean up temp file if created
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            // Clean up temp files if created
+            cleanupTempFiles();
             return {
                 content: [
                     {
@@ -318,15 +385,8 @@ export async function kubectlCreate(k8sManager, input) {
             };
         }
         catch (error) {
-            // Clean up temp file if created, even if command failed
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            // Clean up temp files if created, even if command failed
+            cleanupTempFiles();
             throw new McpError(ErrorCode.InternalError, `Failed to create resource: ${error.message}`);
         }
     }

package/dist/tools/kubectl-get.d.ts

@@ -76,3 +76,26 @@ export declare function kubectlGet(k8sManager: KubernetesManager, input: {
     }[];
     isError: boolean;
 }>;
+/**
+ * Determine whether a (already lower-cased) resourceType string references
+ * Kubernetes Secrets in any of the syntaxes kubectl accepts. This backs the
+ * masking decision, so it must recognize every way a caller could name a
+ * Secret without tripping the naive "=== 'secret'" check:
+ *   - plain:            "secret", "secrets"
+ *   - resource/name:    "secret/my-secret"
+ *   - group-qualified:  "secrets.v1.", "secret.example.com/my-secret"
+ *   - comma-separated:  "secret,configmap"
+ *
+ * @param {string} resourceType - The lower-cased resourceType argument.
+ * @returns {boolean} True if any referenced resource is a Secret.
+ */
+export declare function resourceReferencesSecret(resourceType: string): boolean;
+/**
+ * Masks sensitive data in Kubernetes secrets by parsing the raw output and replacing
+ * all leaf values in the "data" section with a placeholder value ("***").
+ *
+ * @param {string} output - The raw output from a `kubectl` command, containing secrets data.
+ * @param {string} format - The format of the output, either "json" or "yaml".
+ * @returns {string} - The masked output in the same format as the input.
+ */
+export declare function maskSecretsData(output: string, format: string): string;

package/dist/tools/kubectl-get.js

@@ -126,9 +126,13 @@ export async function kubectlGet(k8sManager, input) {
                 maxBuffer: getSpawnMaxBuffer(),
                 env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
             });
-            // Apply secrets masking if enabled and dealing with secrets
+            // Apply secrets masking if enabled and dealing with secrets.
+            // resourceReferencesSecret normalizes combined forms like
+            // "secret/my-secret", group-qualified "secrets.v1./my-secret", and
+            // comma-separated lists ("secret,configmap") so the masking decision
+            // cannot be bypassed by addressing a Secret through an alternate syntax.
             const shouldMaskSecrets = process.env.MASK_SECRETS !== "false" &&
-                (resourceType === "secrets" || resourceType === "secret");
+                resourceReferencesSecret(resourceType);
             let processedResult = result;
             if (shouldMaskSecrets) {
                 processedResult = maskSecretsData(result, output);
@@ -356,10 +360,54 @@ function isNonNamespacedResource(resourceType) {
     return nonNamespacedResources.includes(resourceType.toLowerCase());
 }
 /**
- * Recursively traverses an object and masks values in 'data' sections of Kubernetes secrets.
+ * Determine whether a (already lower-cased) resourceType string references
+ * Kubernetes Secrets in any of the syntaxes kubectl accepts. This backs the
+ * masking decision, so it must recognize every way a caller could name a
+ * Secret without tripping the naive "=== 'secret'" check:
+ *   - plain:            "secret", "secrets"
+ *   - resource/name:    "secret/my-secret"
+ *   - group-qualified:  "secrets.v1.", "secret.example.com/my-secret"
+ *   - comma-separated:  "secret,configmap"
+ *
+ * @param {string} resourceType - The lower-cased resourceType argument.
+ * @returns {boolean} True if any referenced resource is a Secret.
+ */
+export function resourceReferencesSecret(resourceType) {
+    return resourceType
+        .split(",")
+        .map((part) => {
+        // Drop the "/name" portion of a resource/name reference, then the
+        // ".group"/".version" suffix of a group-qualified reference.
+        const resource = part.trim().split("/")[0].split(".")[0];
+        return resource.toLowerCase();
+    })
+        .some((resource) => resource === "secret" || resource === "secrets");
+}
+// Mask the leaf values of a single Secret object's `data` (and write-only
+// `stringData`) fields, leaving metadata and every other field intact.
+function maskSecretObject(secret) {
+    const result = {};
+    for (const key in secret) {
+        if ((key === "data" || key === "stringData") &&
+            typeof secret[key] === "object" &&
+            secret[key] !== null) {
+            result[key] = maskAllLeafValues(secret[key]);
+        }
+        else {
+            result[key] = maskDataValues(secret[key]);
+        }
+    }
+    return result;
+}
+/**
+ * Recursively traverses a parsed kubectl response and masks the `data` values
+ * of Kubernetes Secrets only. Masking is scoped by object kind rather than by
+ * the presence of a "data" key, so that Secret values are always masked (even
+ * inside a mixed `List` returned by e.g. `kubectl get secret,configmap`) while
+ * non-Secret resources such as ConfigMaps keep their data.
  *
  * @param {any} obj - The object to traverse. Can be an array, object, or primitive value.
- * @returns {any} A new object with masked values in 'data' sections.
+ * @returns {any} A new object with masked values in Secret 'data' sections.
  */
 function maskDataValues(obj) {
     if (obj == null) {
@@ -369,15 +417,24 @@ function maskDataValues(obj) {
         return obj.map((item) => maskDataValues(item));
     }
     if (typeof obj === "object") {
+        const kind = typeof obj.kind === "string" ? obj.kind.toLowerCase() : undefined;
+        // A single Secret object.
+        if (kind === "secret") {
+            return maskSecretObject(obj);
+        }
+        // A SecretList: every item is a Secret, even when kubectl omits the
+        // per-item `kind` field in list output, so mask them unconditionally.
+        if (kind === "secretlist" && Array.isArray(obj.items)) {
+            return {
+                ...obj,
+                items: obj.items.map((item) => maskSecretObject(item)),
+            };
+        }
+        // Any other object (including a heterogeneous "List"): recurse so nested
+        // Secret objects are still masked without touching non-Secret data.
         const result = {};
         for (const key in obj) {
-            if (key === "data" && typeof obj[key] === "object" && obj[key] !== null) {
-                // This is a data section - mask all leaf values within it
-                result[key] = maskAllLeafValues(obj[key]);
-            }
-            else {
-                result[key] = maskDataValues(obj[key]);
-            }
+            result[key] = maskDataValues(obj[key]);
         }
         return result;
     }
@@ -415,7 +472,7 @@ function maskAllLeafValues(obj) {
  * @param {string} format - The format of the output, either "json" or "yaml".
  * @returns {string} - The masked output in the same format as the input.
  */
-function maskSecretsData(output, format) {
+export function maskSecretsData(output, format) {
     try {
         if (format === "json") {
             const parsed = JSON.parse(output);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",