mcp-server-kubernetes 4.1.0 → 4.1.2

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "4.1.0";
+    readonly version: "4.1.2";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "4.1.0",
+    version: "4.1.2",
     capabilities: {
         resources: {},
         tools: {},

package/dist/index.d.ts

@@ -810,4 +810,10 @@ declare const allTools: ({
         readOnlyHint: boolean;
     };
 })[];
+/**
+ * Returns the names in `allowedToolNames` that no tool actually provides.
+ *
+ * Exported for testing.
+ */
+export declare function findUnknownToolNames(allowedToolNames: Iterable<string>, knownToolNames: Iterable<string>): string[];
 export { allTools, destructiveTools };

package/dist/index.js

@@ -105,6 +105,28 @@ const allTools = [
     // Ping utility
     pingSchema,
 ];
+/**
+ * Returns the names in `allowedToolNames` that no tool actually provides.
+ *
+ * Exported for testing.
+ */
+export function findUnknownToolNames(allowedToolNames, knownToolNames) {
+    const known = new Set(knownToolNames);
+    return [...allowedToolNames].filter((name) => !known.has(name)).sort();
+}
+// A misspelled name in ALLOWED_TOOLS would otherwise be dropped silently,
+// leaving a narrower tool surface than was configured. Refuse to start instead.
+if (explicitlyAllowedToolNames) {
+    const unknownToolNames = findUnknownToolNames(explicitlyAllowedToolNames, allTools.map((tool) => tool.name));
+    if (unknownToolNames.length > 0) {
+        console.error(`ALLOWED_TOOLS contains unknown tool ${unknownToolNames.length === 1 ? "name" : "names"}: ${unknownToolNames.join(", ")}`);
+        console.error(`Available tools: ${allTools
+            .map((tool) => tool.name)
+            .sort()
+            .join(", ")}`);
+        process.exit(1);
+    }
+}
 const k8sManager = new KubernetesManager();
 const server = new Server({
     name: serverConfig.name,

package/dist/tools/kubectl-patch.js

@@ -1,4 +1,5 @@
 import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { isRemoteTransport } from "../security/transport.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import * as fs from "fs";
 import * as path from "path";
@@ -35,7 +36,7 @@ export const kubectlPatchSchema = {
             },
             patchFile: {
                 type: "string",
-                description: "Path to a file containing the patch data (alternative to patchData)",
+                description: "Path to a file containing the patch data (alternative to patchData). The path is read on the machine running the MCP server, so it is rejected when the server runs over a remote (SSE/Streamable HTTP) transport; use 'patchData' to pass the patch contents instead.",
             },
             dryRun: dryRunParameter,
             context: contextParameter,
@@ -48,6 +49,17 @@ export async function kubectlPatch(k8sManager, input) {
         if (!input.patchData && !input.patchFile) {
             throw new McpError(ErrorCode.InvalidRequest, "Either patchData or patchFile must be provided");
         }
+        // Reject server-side filesystem reads on remote transports. Over SSE /
+        // Streamable HTTP the path resolves on the MCP server host, not the
+        // client, so `patchFile` (--patch-file) would let any client that can
+        // reach the endpoint read arbitrary server files (kubeconfig,
+        // service-account token, /proc/self/environ, etc.) via kubectl's parse
+        // errors, or merge their contents into a resource that is then readable
+        // through kubectl_get. Clients on these transports must pass the patch
+        // inline via `patchData` instead.
+        if (isRemoteTransport() && input.patchFile) {
+            throw new McpError(ErrorCode.InvalidRequest, "The 'patchFile' parameter reads a file from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the patch contents via 'patchData' instead.");
+        }
         const namespace = input.namespace || "default";
         const patchType = input.patchType || "strategic";
         const dryRun = input.dryRun || false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "4.1.0",
+  "version": "4.1.2",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",