mcp-server-kubernetes 4.0.4 → 4.0.6

package/README.md

@@ -425,7 +425,12 @@ Adding clusters to kubectx.
 
 ## Star History
 
-[![Star History Chart](https://api.star-history.com/svg?repos=Flux159/mcp-server-kubernetes&type=Date)](https://www.star-history.com/#Flux159/mcp-server-kubernetes&Date)
+<a href="https://github.com/Flux159/rust-star-history">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/Flux159/mcp-server-kubernetes/star-history/star-history-dark.svg">
+    <img alt="Star History Chart" src="https://raw.githubusercontent.com/Flux159/mcp-server-kubernetes/star-history/star-history.svg">
+  </picture>
+</a>
 
 ## 🖊️ Cite
 

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "4.0.4";
+    readonly version: "4.0.6";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "4.0.4",
+    version: "4.0.6",
     capabilities: {
         resources: {},
         tools: {},

package/dist/index.d.ts

@@ -123,7 +123,7 @@ declare const destructiveTools: ({
             };
             readonly filename: {
                 readonly type: "string";
-                readonly description: "Path to a YAML file to delete resources from (optional)";
+                readonly description: "Path to a YAML file to delete resources from (optional). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.";
             };
             readonly allNamespaces: {
                 readonly type: "boolean";
@@ -507,7 +507,7 @@ declare const allTools: ({
             };
             readonly filename: {
                 readonly type: "string";
-                readonly description: "Path to a YAML file to apply (optional - use either manifest or filename)";
+                readonly description: "Path to a YAML file to apply (optional - use either manifest or filename). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.";
             };
             readonly namespace: {
                 type: "string";
@@ -564,7 +564,7 @@ declare const allTools: ({
             };
             readonly filename: {
                 readonly type: "string";
-                readonly description: "Path to a YAML file to delete resources from (optional)";
+                readonly description: "Path to a YAML file to delete resources from (optional). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.";
             };
             readonly allNamespaces: {
                 readonly type: "boolean";

package/dist/security/kubectl-flags.js

@@ -71,14 +71,35 @@ function normalizeFlagName(raw) {
         name = name.slice(0, eq);
     return name.toLowerCase();
 }
+// Extract the short-flag letter from a single-dash token, or null if the token
+// is not a single-dash short flag. pflag lets a short flag carry its value
+// attached with no separator ("-shttp://x" == "--server http://x"), so the
+// letter that matters is always the first character after the dash; the rest of
+// the token is the attached value (or a boolean-flag cluster). Long "--" flags
+// never attach a value without "=", so normalizeFlagName already handles them.
+function shortFlagLetter(raw) {
+    if (!raw.startsWith("-") || raw.startsWith("--"))
+        return null;
+    const body = raw.slice(1);
+    if (body.length === 0)
+        return null;
+    return body[0].toLowerCase();
+}
 function isDangerousFlagName(rawName, fromArgs) {
     const name = normalizeFlagName(rawName);
     if (DANGEROUS_FLAGS.has(name))
         return true;
     // Short aliases (-s) are only meaningful when they appear as a CLI token,
-    // not as a key in the `flags` object.
-    if (fromArgs && SHORT_ALIASES.has(name))
-        return true;
+    // not as a key in the `flags` object. Match both the bare/split forms
+    // (normalizeFlagName -> "s") and the attached form "-sURL" (whose first
+    // post-dash character is the flag pflag actually parses).
+    if (fromArgs) {
+        if (SHORT_ALIASES.has(name))
+            return true;
+        const short = shortFlagLetter(rawName);
+        if (short !== null && SHORT_ALIASES.has(short))
+            return true;
+    }
     return false;
 }
 function reject(flag) {
@@ -139,6 +160,11 @@ export function assertSafeArgv(args) {
         const name = normalizeFlagName(tok);
         if (ARGV_DANGEROUS_FLAGS.has(name) || SHORT_ALIASES.has(name))
             reject(tok);
+        // Attached short-flag form ("-sURL"): match the first post-dash character,
+        // which is the flag pflag parses regardless of the trailing value.
+        const short = shortFlagLetter(tok);
+        if (short !== null && SHORT_ALIASES.has(short))
+            reject(tok);
     }
 }
 /**

package/dist/tools/helm-operations.js

@@ -4,9 +4,11 @@
  * Template mode bypasses authentication issues and kubeconfig API version mismatches.
  * Supports local chart paths, remote repositories, and custom values.
  */
+import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { execFileSyncSafe } from "../security/kubectl-flags.js";
 import { writeFileSync, unlinkSync } from "fs";
 import { dump } from "js-yaml";
+import { isRemoteTransport } from "../security/transport.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter, } from "../models/common-parameters.js";
 /**
@@ -49,7 +51,7 @@ export const installHelmChartSchema = {
             },
             valuesFile: {
                 type: "string",
-                description: "Path to values file (alternative to values object)",
+                description: "Path to values file (alternative to values object). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'values' to pass the values inline instead.",
             },
             useTemplate: {
                 type: "boolean",
@@ -103,7 +105,7 @@ export const upgradeHelmChartSchema = {
             },
             valuesFile: {
                 type: "string",
-                description: "Path to values file (alternative to values object)",
+                description: "Path to values file (alternative to values object). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'values' to pass the values inline instead.",
             },
         },
         required: ["name", "chart", "namespace"],
@@ -153,6 +155,17 @@ const executeCommand = (command, args) => {
         throw new Error(`${command} command failed: ${error.message}`);
     }
 };
+// Reject server-side filesystem reads on remote transports. Over SSE /
+// Streamable HTTP the path resolves on the MCP server host, not the client,
+// so `valuesFile` (-f) would let any client that can reach the endpoint read
+// arbitrary server files (kubeconfig, service-account token,
+// /proc/self/environ, etc.) via helm's parse errors. Clients on these
+// transports must pass values inline via `values` instead.
+const rejectValuesFileOnRemoteTransport = (valuesFile) => {
+    if (valuesFile && isRemoteTransport()) {
+        throw new McpError(ErrorCode.InvalidRequest, "The 'valuesFile' parameter reads a file from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the values inline via 'values' instead.");
+    }
+};
 /**
  * Install a Helm chart using template mode (helm template + kubectl apply).
  * This mode bypasses authentication issues and kubeconfig API version mismatches.
@@ -179,17 +192,7 @@ async function installHelmChartTemplate(params) {
             }
             steps.push(`Namespace ${params.namespace} already exists`);
         }
-        // Step 3: Prepare values
-        let valuesContent = "";
-        if (params.valuesFile) {
-            steps.push(`Using values file: ${params.valuesFile}`);
-            valuesContent = executeCommand("cat", [params.valuesFile]);
-        }
-        else if (params.values) {
-            steps.push("Using provided values object");
-            valuesContent = dump(params.values);
-        }
-        // Step 4: Generate YAML using helm template
+        // Step 3: Generate YAML using helm template
         steps.push("Generating YAML using helm template");
         const templateArgs = [
             "template",
@@ -201,40 +204,40 @@ async function installHelmChartTemplate(params) {
         if (params.repo) {
             templateArgs.push("--repo", params.repo);
         }
-        if (valuesContent) {
-            const tempValuesFile = `/tmp/values-${Date.now()}.yaml`;
-            writeFileSync(tempValuesFile, valuesContent);
+        let tempValuesFile = null;
+        if (params.valuesFile) {
+            // Hand the path to helm directly rather than reading the file's
+            // contents into this process.
+            steps.push(`Using values file: ${params.valuesFile}`);
+            templateArgs.push("-f", params.valuesFile);
+        }
+        else if (params.values) {
+            steps.push("Using provided values object");
+            tempValuesFile = `/tmp/values-${Date.now()}.yaml`;
+            writeFileSync(tempValuesFile, dump(params.values));
             templateArgs.push("-f", tempValuesFile);
-            const yamlOutput = executeCommand("helm", templateArgs);
+        }
+        let yamlOutput;
+        try {
+            yamlOutput = executeCommand("helm", templateArgs);
+        }
+        finally {
             // Clean up temp file
-            unlinkSync(tempValuesFile);
-            // Step 5: Apply YAML using kubectl
-            steps.push("Applying YAML using kubectl");
-            const tempYamlFile = `/tmp/helm-template-${Date.now()}.yaml`;
-            writeFileSync(tempYamlFile, yamlOutput);
-            try {
-                executeCommand("kubectl", ["apply", "-f", tempYamlFile]);
-                steps.push("Helm chart installed successfully using template mode");
-            }
-            finally {
-                // Clean up temp file
-                unlinkSync(tempYamlFile);
+            if (tempValuesFile) {
+                unlinkSync(tempValuesFile);
             }
         }
-        else {
-            const yamlOutput = executeCommand("helm", templateArgs);
-            // Step 5: Apply YAML using kubectl
-            steps.push("Applying YAML using kubectl");
-            const tempYamlFile = `/tmp/helm-template-${Date.now()}.yaml`;
-            writeFileSync(tempYamlFile, yamlOutput);
-            try {
-                executeCommand("kubectl", ["apply", "-f", tempYamlFile]);
-                steps.push("Helm chart installed successfully using template mode");
-            }
-            finally {
-                // Clean up temp file
-                unlinkSync(tempYamlFile);
-            }
+        // Step 4: Apply YAML using kubectl
+        steps.push("Applying YAML using kubectl");
+        const tempYamlFile = `/tmp/helm-template-${Date.now()}.yaml`;
+        writeFileSync(tempYamlFile, yamlOutput);
+        try {
+            executeCommand("kubectl", ["apply", "-f", tempYamlFile]);
+            steps.push("Helm chart installed successfully using template mode");
+        }
+        finally {
+            // Clean up temp file
+            unlinkSync(tempYamlFile);
         }
         return {
             content: [
@@ -270,6 +273,7 @@ async function installHelmChartTemplate(params) {
  * @returns Promise with installation result
  */
 export async function installHelmChart(params) {
+    rejectValuesFileOnRemoteTransport(params.valuesFile);
     // Use template mode if requested
     if (params.useTemplate) {
         return installHelmChartTemplate(params);
@@ -344,6 +348,7 @@ export async function installHelmChart(params) {
  * @returns Promise with upgrade result
  */
 export async function upgradeHelmChart(params) {
+    rejectValuesFileOnRemoteTransport(params.valuesFile);
     try {
         // Add repository if provided
         if (params.repo) {

package/dist/tools/kubectl-apply.d.ts

@@ -14,7 +14,7 @@ export declare const kubectlApplySchema: {
             };
             readonly filename: {
                 readonly type: "string";
-                readonly description: "Path to a YAML file to apply (optional - use either manifest or filename)";
+                readonly description: "Path to a YAML file to apply (optional - use either manifest or filename). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.";
             };
             readonly namespace: {
                 type: "string";

package/dist/tools/kubectl-apply.js

@@ -5,6 +5,7 @@ import * as path from "path";
 import * as os from "os";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter, dryRunParameter } from "../models/common-parameters.js";
+import { isRemoteTransport } from "../security/transport.js";
 export const kubectlApplySchema = {
     name: "kubectl_apply",
     description: "Apply a Kubernetes YAML manifest from a string or file",
@@ -20,7 +21,7 @@ export const kubectlApplySchema = {
             },
             filename: {
                 type: "string",
-                description: "Path to a YAML file to apply (optional - use either manifest or filename)",
+                description: "Path to a YAML file to apply (optional - use either manifest or filename). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.",
             },
             namespace: namespaceParameter,
             dryRun: dryRunParameter,
@@ -39,6 +40,15 @@ export async function kubectlApply(k8sManager, input) {
         if (!input.manifest && !input.filename) {
             throw new McpError(ErrorCode.InvalidRequest, "Either manifest or filename must be provided");
         }
+        // Reject server-side filesystem reads on remote transports. Over SSE /
+        // Streamable HTTP the path resolves on the MCP server host, not the
+        // client, so `filename` (-f) would let any client that can reach the
+        // endpoint read arbitrary server files (kubeconfig, service-account
+        // token, /proc/self/environ, etc.) via kubectl's parse errors. Clients
+        // on these transports must pass content inline via `manifest` instead.
+        if (isRemoteTransport() && input.filename) {
+            throw new McpError(ErrorCode.InvalidRequest, "The 'filename' parameter reads a file from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the file contents via 'manifest' instead.");
+        }
         const namespace = input.namespace || "default";
         const dryRun = input.dryRun || false;
         const force = input.force || false;

package/dist/tools/kubectl-delete.d.ts

@@ -31,7 +31,7 @@ export declare const kubectlDeleteSchema: {
             };
             readonly filename: {
                 readonly type: "string";
-                readonly description: "Path to a YAML file to delete resources from (optional)";
+                readonly description: "Path to a YAML file to delete resources from (optional). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.";
             };
             readonly allNamespaces: {
                 readonly type: "boolean";

package/dist/tools/kubectl-delete.js

@@ -5,6 +5,7 @@ import * as path from "path";
 import * as os from "os";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter, } from "../models/common-parameters.js";
+import { isRemoteTransport } from "../security/transport.js";
 export const kubectlDeleteSchema = {
     name: "kubectl_delete",
     description: "Delete Kubernetes resources by resource type, name, labels, or from a manifest file",
@@ -33,7 +34,7 @@ export const kubectlDeleteSchema = {
             },
             filename: {
                 type: "string",
-                description: "Path to a YAML file to delete resources from (optional)",
+                description: "Path to a YAML file to delete resources from (optional). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'manifest' to pass the file's contents instead.",
             },
             allNamespaces: {
                 type: "boolean",
@@ -64,6 +65,15 @@ export async function kubectlDelete(k8sManager, input) {
         if (input.resourceType && !input.name && !input.labelSelector) {
             throw new McpError(ErrorCode.InvalidRequest, "When using resourceType, either name or labelSelector must be provided");
         }
+        // Reject server-side filesystem reads on remote transports. Over SSE /
+        // Streamable HTTP the path resolves on the MCP server host, not the
+        // client, so `filename` (-f) would let any client that can reach the
+        // endpoint read arbitrary server files (kubeconfig, service-account
+        // token, /proc/self/environ, etc.) via kubectl's parse errors. Clients
+        // on these transports must pass content inline via `manifest` instead.
+        if (isRemoteTransport() && input.filename) {
+            throw new McpError(ErrorCode.InvalidRequest, "The 'filename' parameter reads a file from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the file contents via 'manifest' instead.");
+        }
         const namespace = input.namespace || "default";
         const allNamespaces = input.allNamespaces || false;
         const force = input.force || false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",