mcp-server-kubernetes 4.1.3 → 4.1.5

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "4.1.3";
+    readonly version: "4.1.5";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "4.1.3",
+    version: "4.1.5",
     capabilities: {
         resources: {},
         tools: {},

package/dist/security/kubectl-flags.d.ts

@@ -21,6 +21,23 @@ export declare function assertNoDangerousFlags(flags?: Record<string, unknown>,
  * flag unless ALLOW_KUBECTL_UNSAFE_FLAGS=true.
  */
 export declare function assertSafeArgv(args: readonly string[]): void;
+/**
+ * Reject a caller-supplied value that a tool is about to place in a *positional*
+ * argv slot (a release name, a chart reference, a namespace) when it is shaped
+ * like a command-line flag.
+ *
+ * assertSafeArgv is a deny-list: it can only refuse the flags it knows about,
+ * so every dangerous flag added upstream is exploitable through any positional
+ * slot until the list is extended. This guard closes the injection point
+ * instead of chasing the flags: pflag treats any token starting with "-" as a
+ * flag no matter where it sits, and none of these operands is ever legitimately
+ * flag-shaped (helm release names and namespaces are RFC 1123 names; chart
+ * references are repo/name pairs, paths or URLs). Refusing a leading "-" here
+ * means caller data can never occupy a slot where it would be parsed as a flag.
+ *
+ * Honours the same ALLOW_KUBECTL_UNSAFE_FLAGS escape hatch as the flag guard.
+ */
+export declare function assertNotFlagLike(value: string | undefined, field: string): void;
 /**
  * Drop-in replacement for child_process.execFileSync that scans the argv for
  * credential/target-redirecting flags before executing. Tool files import this

package/dist/security/kubectl-flags.js

@@ -69,7 +69,8 @@ const SHORT_VALUE_FLAGS = new Set([
     "v", // --v (log level)
 ]);
 // helm exposes the same exfiltration surface as kubectl, but under "kube-"
-// prefixed flag names (e.g. --kube-apiserver instead of --server). We add
+// prefixed flag names (e.g. --kube-apiserver instead of --server), plus a few
+// helm-only flags that run or overwrite things on the MCP server host. We add
 // those here so the argv-level guard covers helm invocations too. Context
 // selection flags (--context / --kube-context) are intentionally omitted:
 // they can only select a cluster already present in the loaded kubeconfig,
@@ -83,6 +84,16 @@ const HELM_DANGEROUS_FLAGS = new Set([
     "kube-as-group",
     "kube-tls-server-name",
     "kube-insecure-skip-tls-verify",
+    // Runs a binary on the MCP server host: helm 3.x resolves --post-renderer to
+    // an executable path (or a $PATH name) and runs it over the rendered
+    // manifests. Nothing about installing a chart otherwise gives host-side
+    // execution, so this is never a flag a tool should emit.
+    "post-renderer",
+    "post-renderer-args",
+    // Writes to attacker-chosen filesystem paths: helm rewrites these files as
+    // part of "repo add" / registry login.
+    "repository-config",
+    "registry-config",
 ]);
 // Flag names that are dangerous when they appear anywhere in a fully
 // constructed argv (positional slots included), regardless of which tool
@@ -159,10 +170,10 @@ function isDangerousFlagName(rawName, fromArgs) {
 }
 function reject(flag) {
     throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl with flag "${flag}": this flag can redirect ` +
-        `kubectl to a different API server or substitute credentials, which ` +
-        `would allow exfiltration of the operator's bearer token. If you ` +
-        `genuinely need this flag, set ALLOW_KUBECTL_UNSAFE_FLAGS=true in the ` +
-        `server environment.`);
+        `kubectl/helm to a different API server, substitute credentials, or ` +
+        `act on the MCP server's own host, which would allow exfiltration of ` +
+        `the operator's bearer token. If you genuinely need this flag, set ` +
+        `ALLOW_KUBECTL_UNSAFE_FLAGS=true in the server environment.`);
 }
 /**
  * Validate user-supplied kubectl flags and args. Throws an McpError if any
@@ -222,6 +233,32 @@ export function assertSafeArgv(args) {
             reject(tok);
     }
 }
+/**
+ * Reject a caller-supplied value that a tool is about to place in a *positional*
+ * argv slot (a release name, a chart reference, a namespace) when it is shaped
+ * like a command-line flag.
+ *
+ * assertSafeArgv is a deny-list: it can only refuse the flags it knows about,
+ * so every dangerous flag added upstream is exploitable through any positional
+ * slot until the list is extended. This guard closes the injection point
+ * instead of chasing the flags: pflag treats any token starting with "-" as a
+ * flag no matter where it sits, and none of these operands is ever legitimately
+ * flag-shaped (helm release names and namespaces are RFC 1123 names; chart
+ * references are repo/name pairs, paths or URLs). Refusing a leading "-" here
+ * means caller data can never occupy a slot where it would be parsed as a flag.
+ *
+ * Honours the same ALLOW_KUBECTL_UNSAFE_FLAGS escape hatch as the flag guard.
+ */
+export function assertNotFlagLike(value, field) {
+    if (isUnsafeFlagsAllowed())
+        return;
+    if (typeof value !== "string" || !value.startsWith("-"))
+        return;
+    throw new McpError(ErrorCode.InvalidParams, `Refusing to run helm with ${field}="${value}": a value starting with ` +
+        `"-" is parsed as a command-line flag rather than as the ${field}, ` +
+        `which would let the caller inject arbitrary helm flags. Provide a ` +
+        `${field} that does not begin with "-".`);
+}
 /**
  * Drop-in replacement for child_process.execFileSync that scans the argv for
  * credential/target-redirecting flags before executing. Tool files import this

package/dist/tools/helm-operations.js

@@ -5,7 +5,7 @@
  * Supports local chart paths, remote repositories, and custom values.
  */
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { writeFileSync, unlinkSync } from "fs";
 import { dump } from "js-yaml";
 import { isRemoteTransport } from "../security/transport.js";
@@ -166,6 +166,19 @@ const rejectValuesFileOnRemoteTransport = (valuesFile) => {
         throw new McpError(ErrorCode.InvalidRequest, "The 'valuesFile' parameter reads a file from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the values inline via 'values' instead.");
     }
 };
+// The release name, chart reference, namespace and repo URL are all placed in
+// positional argv slots ("helm install <name> <chart>", "helm repo add
+// <name> <url>", "kubectl create namespace <ns>"). pflag parses any token
+// beginning with "-" as a flag regardless of position, so a caller-supplied
+// value such as "--post-renderer=/tmp/x.sh" would become a helm flag instead
+// of an operand. Reject flag-shaped operands up front rather than relying on
+// the argv deny-list to know every dangerous helm flag.
+const assertOperandsNotFlagLike = (params) => {
+    assertNotFlagLike(params.name, "release name");
+    assertNotFlagLike(params.chart, "chart");
+    assertNotFlagLike(params.namespace, "namespace");
+    assertNotFlagLike(params.repo, "repo");
+};
 /**
  * Install a Helm chart using template mode (helm template + kubectl apply).
  * This mode bypasses authentication issues and kubeconfig API version mismatches.
@@ -274,6 +287,7 @@ async function installHelmChartTemplate(params) {
  */
 export async function installHelmChart(params) {
     rejectValuesFileOnRemoteTransport(params.valuesFile);
+    assertOperandsNotFlagLike(params);
     // Use template mode if requested
     if (params.useTemplate) {
         return installHelmChartTemplate(params);
@@ -349,6 +363,7 @@ export async function installHelmChart(params) {
  */
 export async function upgradeHelmChart(params) {
     rejectValuesFileOnRemoteTransport(params.valuesFile);
+    assertOperandsNotFlagLike(params);
     try {
         // Add repository if provided
         if (params.repo) {
@@ -415,6 +430,7 @@ export async function upgradeHelmChart(params) {
  * @returns Promise with uninstall result
  */
 export async function uninstallHelmChart(params) {
+    assertOperandsNotFlagLike(params);
     try {
         executeCommand("helm", [
             "uninstall",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "4.1.3",
+  "version": "4.1.5",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",
@@ -46,7 +46,7 @@
     "@opentelemetry/sdk-node": "0.219.0",
     "@opentelemetry/semantic-conventions": "1.40.0",
     "express": "4.22.2",
-    "js-yaml": "4.3.0",
+    "js-yaml": "4.3.1",
     "yaml": "2.8.3",
     "zod": "3.25.76"
   },