mcp-server-kubernetes 4.0.8 → 4.1.0

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "4.0.8";
+    readonly version: "4.1.0";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "4.0.8",
+    version: "4.1.0",
     capabilities: {
         resources: {},
         tools: {},

package/dist/security/kubectl-flags.js

@@ -35,10 +35,39 @@ const DANGEROUS_FLAGS = new Set([
     "as",
     "as-group",
     "as-uid",
+    // Writes to attacker-chosen filesystem paths
+    "profile-output",
+    "log-file",
+    "cache-dir",
 ]);
 const SHORT_ALIASES = new Set([
     "s", // -s is an alias for --server
 ]);
+// Short flags that consume a value. pflag stops parsing a shorthand cluster at
+// the first of these: everything after it inside the token is that flag's
+// value ("-ojsonpath={.items[0]}"), not more flags. Every other letter is a
+// boolean shorthand, which pflag parses and then keeps going past — so the
+// scan in shortFlagLetters() must keep going too.
+//
+// Comparison is case-sensitive, exactly like pflag: "-A" (--all-namespaces)
+// and "-a" are different flags.
+//
+// Only letters that take a value in *every* command that defines them belong
+// here. "-f" is deliberately absent: it is --filename for apply/delete but the
+// boolean --follow for logs, so pflag keeps parsing the cluster after it.
+// Leaving a letter out is always the safe direction — at worst an attached
+// value containing "s" is refused, and the split form ("-f /path") or the long
+// form ("--filename=/path") still works.
+const SHORT_VALUE_FLAGS = new Set([
+    "c", // --container
+    "k", // --kustomize
+    "l", // --selector
+    "L", // --label-columns
+    "n", // --namespace
+    "o", // --output
+    "s", // --server (dangerous; listed so the scan stops after it as well)
+    "v", // --v (log level)
+]);
 // helm exposes the same exfiltration surface as kubectl, but under "kube-"
 // prefixed flag names (e.g. --kube-apiserver instead of --server). We add
 // those here so the argv-level guard covers helm invocations too. Context
@@ -69,21 +98,48 @@ function normalizeFlagName(raw) {
     const eq = name.indexOf("=");
     if (eq !== -1)
         name = name.slice(0, eq);
-    return name.toLowerCase();
+    // kubectl and helm install pflag's WordSepNormalizeFunc, which treats "_" as
+    // equivalent to "-" in long flag names: "--insecure_skip_tls_verify" and
+    // "--insecure-skip-tls-verify" are the same flag. Normalize the same way so
+    // both spellings compare equal against the sets above.
+    return name.toLowerCase().replace(/_/g, "-");
 }
-// Extract the short-flag letter from a single-dash token, or null if the token
-// is not a single-dash short flag. pflag lets a short flag carry its value
-// attached with no separator ("-shttp://x" == "--server http://x"), so the
-// letter that matters is always the first character after the dash; the rest of
-// the token is the attached value (or a boolean-flag cluster). Long "--" flags
-// never attach a value without "=", so normalizeFlagName already handles them.
-function shortFlagLetter(raw) {
+// Return every letter pflag would parse as a flag out of a single-dash token,
+// in order, or null if the token is not a single-dash short flag.
+//
+// pflag walks a shorthand cluster letter by letter: a boolean shorthand is
+// consumed and parsing continues with the next letter, while a value-taking
+// shorthand swallows the remainder of the token as its value. "-Aowide" is
+// therefore "-A -o wide", not a single unknown flag, so every letter pflag
+// reaches has to be checked — not just the first one after the dash.
+//
+// Long "--" flags never attach a value without "=", so normalizeFlagName
+// already handles them.
+function shortFlagLetters(raw) {
     if (!raw.startsWith("-") || raw.startsWith("--"))
         return null;
     const body = raw.slice(1);
     if (body.length === 0)
         return null;
-    return body[0].toLowerCase();
+    const letters = [];
+    for (let i = 0; i < body.length; i++) {
+        const letter = body[i];
+        letters.push(letter);
+        // "-o=json": the "=" and everything after it is the value.
+        if (body[i + 1] === "=")
+            break;
+        // A value-taking shorthand consumes the rest of the token as its value,
+        // so no further letters are parsed as flags.
+        if (SHORT_VALUE_FLAGS.has(letter))
+            break;
+    }
+    return letters;
+}
+function hasDangerousShortFlag(raw) {
+    const letters = shortFlagLetters(raw);
+    if (letters === null)
+        return false;
+    return letters.some((letter) => SHORT_ALIASES.has(letter));
 }
 function isDangerousFlagName(rawName, fromArgs) {
     const name = normalizeFlagName(rawName);
@@ -91,13 +147,12 @@ function isDangerousFlagName(rawName, fromArgs) {
         return true;
     // Short aliases (-s) are only meaningful when they appear as a CLI token,
     // not as a key in the `flags` object. Match both the bare/split forms
-    // (normalizeFlagName -> "s") and the attached form "-sURL" (whose first
-    // post-dash character is the flag pflag actually parses).
+    // (normalizeFlagName -> "s") and the attached/clustered forms ("-sURL",
+    // "-Ashttps://attacker"), where pflag parses the alias out of the cluster.
     if (fromArgs) {
         if (SHORT_ALIASES.has(name))
             return true;
-        const short = shortFlagLetter(rawName);
-        if (short !== null && SHORT_ALIASES.has(short))
+        if (hasDangerousShortFlag(rawName))
             return true;
     }
     return false;
@@ -160,10 +215,10 @@ export function assertSafeArgv(args) {
         const name = normalizeFlagName(tok);
         if (ARGV_DANGEROUS_FLAGS.has(name) || SHORT_ALIASES.has(name))
             reject(tok);
-        // Attached short-flag form ("-sURL"): match the first post-dash character,
-        // which is the flag pflag parses regardless of the trailing value.
-        const short = shortFlagLetter(tok);
-        if (short !== null && SHORT_ALIASES.has(short))
+        // Attached/clustered short-flag forms ("-sURL", "-Ashttps://attacker"):
+        // match every letter pflag would parse out of the cluster, not just the
+        // first one.
+        if (hasDangerousShortFlag(tok))
             reject(tok);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "4.0.8",
+  "version": "4.1.0",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",
@@ -46,7 +46,7 @@
     "@opentelemetry/sdk-node": "0.219.0",
     "@opentelemetry/semantic-conventions": "1.40.0",
     "express": "4.21.2",
-    "js-yaml": "4.1.1",
+    "js-yaml": "4.3.0",
     "yaml": "2.8.3",
     "zod": "3.25.76"
   },