mcp-server-kubernetes 4.1.4 → 4.1.6

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "4.1.4";
+    readonly version: "4.1.6";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "4.1.4",
+    version: "4.1.6",
     capabilities: {
         resources: {},
         tools: {},

package/dist/security/kubectl-flags.d.ts

@@ -21,6 +21,46 @@ export declare function assertNoDangerousFlags(flags?: Record<string, unknown>,
  * flag unless ALLOW_KUBECTL_UNSAFE_FLAGS=true.
  */
 export declare function assertSafeArgv(args: readonly string[]): void;
+/**
+ * Reject flags that make kubectl read a file from the MCP server's filesystem,
+ * on remote transports only. No-op under stdio.
+ *
+ * kubectl_generic lets a caller assemble an arbitrary kubectl argv, so the
+ * per-parameter guards the structured tools use (`filename`, `fromFile`,
+ * `patchFile`, `valuesFile`) have nothing to attach to: the same read is
+ * reachable as a raw "--from-file=leak=/etc/passwd" token. Under stdio that is
+ * the operator reading their own files and stays allowed; over SSE/Streamable
+ * HTTP the path comes from whoever can reach the endpoint but resolves on the
+ * server host, turning kubectl into an arbitrary file-read oracle (kubeconfig,
+ * service-account token, /proc/self/environ) — with --dry-run=client, without
+ * even a cluster.
+ *
+ * Takes a fully-constructed argv rather than the `flags`/`args` inputs so that
+ * flags built from the object form and file-shaped values smuggled through
+ * positional slots (resourceType, name) are covered by the same scan. Unlike
+ * assertNoDangerousFlags there is no ALLOW_KUBECTL_UNSAFE_FLAGS escape hatch:
+ * this mirrors the transport guards in the structured tools, which reject
+ * server-side paths unconditionally.
+ */
+export declare function assertNoRemoteFileReads(args: readonly string[]): void;
+/**
+ * Reject a caller-supplied value that a tool is about to place in a *positional*
+ * argv slot (a resource type, a resource name, a release name, a chart
+ * reference, a namespace) when it is shaped like a command-line flag.
+ *
+ * assertSafeArgv is a deny-list: it can only refuse the flags it knows about,
+ * so every dangerous flag added upstream is exploitable through any positional
+ * slot until the list is extended. This guard closes the injection point
+ * instead of chasing the flags: pflag treats any token starting with "-" as a
+ * flag no matter where it sits, and none of these operands is ever legitimately
+ * flag-shaped (Kubernetes resource types and names, helm release names and
+ * namespaces are RFC 1123 names; chart references are repo/name pairs, paths
+ * or URLs). Refusing a leading "-" here means caller data can never occupy a
+ * slot where it would be parsed as a flag.
+ *
+ * Honours the same ALLOW_KUBECTL_UNSAFE_FLAGS escape hatch as the flag guard.
+ */
+export declare function assertNotFlagLike(value: string | undefined, field: string): void;
 /**
  * Drop-in replacement for child_process.execFileSync that scans the argv for
  * credential/target-redirecting flags before executing. Tool files import this

package/dist/security/kubectl-flags.js

@@ -1,5 +1,6 @@
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { execFileSync, } from "child_process";
+import { isRemoteTransport } from "./transport.js";
 // Flags that would let a caller redirect kubectl to a different API server,
 // substitute credentials, or impersonate another identity. Allowing any of
 // these to flow in from tool inputs lets an attacker who can influence the
@@ -69,7 +70,8 @@ const SHORT_VALUE_FLAGS = new Set([
     "v", // --v (log level)
 ]);
 // helm exposes the same exfiltration surface as kubectl, but under "kube-"
-// prefixed flag names (e.g. --kube-apiserver instead of --server). We add
+// prefixed flag names (e.g. --kube-apiserver instead of --server), plus a few
+// helm-only flags that run or overwrite things on the MCP server host. We add
 // those here so the argv-level guard covers helm invocations too. Context
 // selection flags (--context / --kube-context) are intentionally omitted:
 // they can only select a cluster already present in the loaded kubeconfig,
@@ -83,12 +85,58 @@ const HELM_DANGEROUS_FLAGS = new Set([
     "kube-as-group",
     "kube-tls-server-name",
     "kube-insecure-skip-tls-verify",
+    // Runs a binary on the MCP server host: helm 3.x resolves --post-renderer to
+    // an executable path (or a $PATH name) and runs it over the rendered
+    // manifests. Nothing about installing a chart otherwise gives host-side
+    // execution, so this is never a flag a tool should emit.
+    "post-renderer",
+    "post-renderer-args",
+    // Writes to attacker-chosen filesystem paths: helm rewrites these files as
+    // part of "repo add" / registry login.
+    "repository-config",
+    "registry-config",
 ]);
 // Flag names that are dangerous when they appear anywhere in a fully
 // constructed argv (positional slots included), regardless of which tool
 // built it. This is DANGEROUS_FLAGS minus the context-selection flags, plus
 // the helm equivalents. See assertSafeArgv / execFileSyncSafe below.
 const ARGV_DANGEROUS_FLAGS = new Set([...DANGEROUS_FLAGS, ...HELM_DANGEROUS_FLAGS].filter((name) => name !== "context"));
+// Flags that make kubectl read a file from the machine it is running on.
+//
+// These are not in DANGEROUS_FLAGS: under stdio that machine is the operator's
+// own, and "-f manifest.yaml" is the whole point of the tool. They only become
+// a vulnerability on a remote (SSE / Streamable HTTP) transport, where the path
+// is chosen by a client but resolved on the server host — so they are rejected
+// by transport, in assertNoRemoteFileReads, rather than denied outright.
+//
+// Long names only; the single-dash spellings live in FILE_READ_SHORT_FLAGS.
+const FILE_READ_FLAGS = new Set([
+    "filename",
+    "from-file",
+    "from-env-file",
+    "kustomize",
+    "patch-file",
+]);
+// Single-letter spellings of the above. Unlike SHORT_ALIASES these are checked
+// against every letter pflag would parse out of a shorthand cluster, so the
+// attached ("-f/etc/passwd") and clustered ("-Rf/etc/passwd") forms are caught
+// alongside the split one ("-f", "/etc/passwd").
+const FILE_READ_SHORT_FLAGS = new Set([
+    "f", // --filename
+    "k", // --kustomize
+]);
+// Output formats whose argument is a file path on the machine kubectl runs on:
+// "-o go-template-file=<path>" makes kubectl read that file and render it into
+// the result. That is the same read as --from-file under a different flag
+// name, but unlike --from-file no tool here ever legitimately emits one — so
+// assertSafeArgv refuses them in any argv, on any transport, rather than only
+// where a server-side path would be attacker-chosen. Every tool has positional
+// slots, read-only ones included, so a name-shaped denial is not enough.
+const FILE_READ_OUTPUT_FORMATS = new Set([
+    "go-template-file",
+    "jsonpath-file",
+    "custom-columns-file",
+]);
 function isUnsafeFlagsAllowed() {
     return process.env.ALLOW_KUBECTL_UNSAFE_FLAGS === "true";
 }
@@ -159,10 +207,10 @@ function isDangerousFlagName(rawName, fromArgs) {
 }
 function reject(flag) {
     throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl with flag "${flag}": this flag can redirect ` +
-        `kubectl to a different API server or substitute credentials, which ` +
-        `would allow exfiltration of the operator's bearer token. If you ` +
-        `genuinely need this flag, set ALLOW_KUBECTL_UNSAFE_FLAGS=true in the ` +
-        `server environment.`);
+        `kubectl/helm to a different API server, substitute credentials, or ` +
+        `act on the MCP server's own host, which would allow exfiltration of ` +
+        `the operator's bearer token. If you genuinely need this flag, set ` +
+        `ALLOW_KUBECTL_UNSAFE_FLAGS=true in the server environment.`);
 }
 /**
  * Validate user-supplied kubectl flags and args. Throws an McpError if any
@@ -207,7 +255,8 @@ export function assertNoDangerousFlags(flags, args) {
 export function assertSafeArgv(args) {
     if (isUnsafeFlagsAllowed())
         return;
-    for (const tok of args) {
+    for (let i = 0; i < args.length; i++) {
+        const tok = args[i];
         if (typeof tok !== "string")
             continue;
         if (!tok.startsWith("-"))
@@ -220,7 +269,123 @@ export function assertSafeArgv(args) {
         // first one.
         if (hasDangerousShortFlag(tok))
             reject(tok);
+        // A file read hiding in the *value* of an otherwise ordinary flag
+        // ("-o go-template-file=<path>"), so it has to be matched on the value
+        // rather than on the flag name.
+        const format = outputFormatValue(tok, args[i + 1]);
+        if (format !== undefined &&
+            FILE_READ_OUTPUT_FORMATS.has(format.split("=")[0])) {
+            rejectOutputFileRead(tok, format);
+        }
+    }
+}
+/**
+ * Return the value kubectl would take for -o / --output in `tok`, or undefined
+ * if `tok` is not an output flag. The value may be attached to the token
+ * ("-ojson", "-o=json", "--output=json") or sit in the following one, which is
+ * why the caller passes `next`.
+ */
+function outputFormatValue(tok, next) {
+    if (tok.startsWith("--")) {
+        if (normalizeFlagName(tok) !== "output")
+            return undefined;
+        const eq = tok.indexOf("=");
+        return eq === -1 ? next : tok.slice(eq + 1);
     }
+    const letters = shortFlagLetters(tok);
+    if (letters === null)
+        return undefined;
+    const idx = letters.indexOf("o");
+    if (idx === -1)
+        return undefined;
+    // "o" takes a value, so pflag stops the cluster there and reads the rest of
+    // the token as the format ("-Aojson" -> "-A -o json"). An empty remainder
+    // means the format is the next argv token instead.
+    let rest = tok.slice(1 + idx + 1);
+    if (rest.startsWith("="))
+        rest = rest.slice(1);
+    return rest === "" ? next : rest;
+}
+function rejectOutputFileRead(tok, format) {
+    throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl with "${tok} ${format}": this output format ` +
+        `takes a file path and makes kubectl read that file from the MCP ` +
+        `server's own filesystem, rendering it into the result. No tool needs ` +
+        `it, and a resource name or type that parses as this flag is an ` +
+        `injection attempt. Use an inline template ("-o go-template=...") or a ` +
+        `jsonpath expression instead.`);
+}
+function rejectFileRead(flag) {
+    throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl with "${flag}": this flag reads a file from the ` +
+        `MCP server's own filesystem, which is disabled on remote (SSE/` +
+        `Streamable HTTP) transports because the path is chosen by the client ` +
+        `but resolved on the server host. Pass the file contents inline ` +
+        `instead (kubectl_apply/kubectl_create "manifest", kubectl_create ` +
+        `"fromFileContent", or install_helm_chart "values").`);
+}
+/**
+ * Reject flags that make kubectl read a file from the MCP server's filesystem,
+ * on remote transports only. No-op under stdio.
+ *
+ * kubectl_generic lets a caller assemble an arbitrary kubectl argv, so the
+ * per-parameter guards the structured tools use (`filename`, `fromFile`,
+ * `patchFile`, `valuesFile`) have nothing to attach to: the same read is
+ * reachable as a raw "--from-file=leak=/etc/passwd" token. Under stdio that is
+ * the operator reading their own files and stays allowed; over SSE/Streamable
+ * HTTP the path comes from whoever can reach the endpoint but resolves on the
+ * server host, turning kubectl into an arbitrary file-read oracle (kubeconfig,
+ * service-account token, /proc/self/environ) — with --dry-run=client, without
+ * even a cluster.
+ *
+ * Takes a fully-constructed argv rather than the `flags`/`args` inputs so that
+ * flags built from the object form and file-shaped values smuggled through
+ * positional slots (resourceType, name) are covered by the same scan. Unlike
+ * assertNoDangerousFlags there is no ALLOW_KUBECTL_UNSAFE_FLAGS escape hatch:
+ * this mirrors the transport guards in the structured tools, which reject
+ * server-side paths unconditionally.
+ */
+export function assertNoRemoteFileReads(args) {
+    if (!isRemoteTransport())
+        return;
+    for (let i = 0; i < args.length; i++) {
+        const tok = args[i];
+        if (typeof tok !== "string" || !tok.startsWith("-"))
+            continue;
+        if (FILE_READ_FLAGS.has(normalizeFlagName(tok)))
+            rejectFileRead(tok);
+        // Short spellings, including the attached and clustered forms pflag
+        // accepts: "-f/etc/passwd", "-Rf/etc/passwd".
+        const letters = shortFlagLetters(tok);
+        if (letters?.some((letter) => FILE_READ_SHORT_FLAGS.has(letter))) {
+            rejectFileRead(tok);
+        }
+    }
+}
+/**
+ * Reject a caller-supplied value that a tool is about to place in a *positional*
+ * argv slot (a resource type, a resource name, a release name, a chart
+ * reference, a namespace) when it is shaped like a command-line flag.
+ *
+ * assertSafeArgv is a deny-list: it can only refuse the flags it knows about,
+ * so every dangerous flag added upstream is exploitable through any positional
+ * slot until the list is extended. This guard closes the injection point
+ * instead of chasing the flags: pflag treats any token starting with "-" as a
+ * flag no matter where it sits, and none of these operands is ever legitimately
+ * flag-shaped (Kubernetes resource types and names, helm release names and
+ * namespaces are RFC 1123 names; chart references are repo/name pairs, paths
+ * or URLs). Refusing a leading "-" here means caller data can never occupy a
+ * slot where it would be parsed as a flag.
+ *
+ * Honours the same ALLOW_KUBECTL_UNSAFE_FLAGS escape hatch as the flag guard.
+ */
+export function assertNotFlagLike(value, field) {
+    if (isUnsafeFlagsAllowed())
+        return;
+    if (typeof value !== "string" || !value.startsWith("-"))
+        return;
+    throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl/helm with ${field}="${value}": a value ` +
+        `starting with "-" is parsed as a command-line flag rather than as ` +
+        `the ${field}, which would let the caller inject arbitrary flags. ` +
+        `Provide a ${field} that does not begin with "-".`);
 }
 /**
  * Drop-in replacement for child_process.execFileSync that scans the argv for

package/dist/tools/helm-operations.js

@@ -5,7 +5,7 @@
  * Supports local chart paths, remote repositories, and custom values.
  */
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { writeFileSync, unlinkSync } from "fs";
 import { dump } from "js-yaml";
 import { isRemoteTransport } from "../security/transport.js";
@@ -166,6 +166,19 @@ const rejectValuesFileOnRemoteTransport = (valuesFile) => {
         throw new McpError(ErrorCode.InvalidRequest, "The 'valuesFile' parameter reads a file from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the values inline via 'values' instead.");
     }
 };
+// The release name, chart reference, namespace and repo URL are all placed in
+// positional argv slots ("helm install <name> <chart>", "helm repo add
+// <name> <url>", "kubectl create namespace <ns>"). pflag parses any token
+// beginning with "-" as a flag regardless of position, so a caller-supplied
+// value such as "--post-renderer=/tmp/x.sh" would become a helm flag instead
+// of an operand. Reject flag-shaped operands up front rather than relying on
+// the argv deny-list to know every dangerous helm flag.
+const assertOperandsNotFlagLike = (params) => {
+    assertNotFlagLike(params.name, "release name");
+    assertNotFlagLike(params.chart, "chart");
+    assertNotFlagLike(params.namespace, "namespace");
+    assertNotFlagLike(params.repo, "repo");
+};
 /**
  * Install a Helm chart using template mode (helm template + kubectl apply).
  * This mode bypasses authentication issues and kubeconfig API version mismatches.
@@ -274,6 +287,7 @@ async function installHelmChartTemplate(params) {
  */
 export async function installHelmChart(params) {
     rejectValuesFileOnRemoteTransport(params.valuesFile);
+    assertOperandsNotFlagLike(params);
     // Use template mode if requested
     if (params.useTemplate) {
         return installHelmChartTemplate(params);
@@ -349,6 +363,7 @@ export async function installHelmChart(params) {
  */
 export async function upgradeHelmChart(params) {
     rejectValuesFileOnRemoteTransport(params.valuesFile);
+    assertOperandsNotFlagLike(params);
     try {
         // Add repository if provided
         if (params.repo) {
@@ -415,6 +430,7 @@ export async function upgradeHelmChart(params) {
  * @returns Promise with uninstall result
  */
 export async function uninstallHelmChart(params) {
+    assertOperandsNotFlagLike(params);
     try {
         executeCommand("helm", [
             "uninstall",

package/dist/tools/kubectl-delete.js

@@ -1,4 +1,4 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import * as fs from "fs";
 import * as path from "path";
@@ -94,6 +94,11 @@ export async function kubectlDelete(k8sManager, input) {
         }
         else {
             // Handle deleting by resource type and name/selector
+            // A resource type or name is an RFC 1123 name, never a flag. Refusing
+            // a leading "-" closes the positional injection slot itself rather than
+            // relying on the argv denylist to know every dangerous flag.
+            assertNotFlagLike(input.resourceType, "resourceType");
+            assertNotFlagLike(input.name, "name");
             args.push(input.resourceType);
             if (input.name) {
                 args.push(input.name);

package/dist/tools/kubectl-describe.js

@@ -1,4 +1,4 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { namespaceParameter, contextParameter, } from "../models/common-parameters.js";
@@ -32,6 +32,11 @@ export const kubectlDescribeSchema = {
 };
 export async function kubectlDescribe(k8sManager, input) {
     try {
+        // A resource type or name is an RFC 1123 name, never a flag. Refusing a
+        // leading "-" closes the positional injection slot itself rather than
+        // relying on the argv denylist to know every dangerous flag.
+        assertNotFlagLike(input.resourceType, "resourceType");
+        assertNotFlagLike(input.name, "name");
         const resourceType = input.resourceType.toLowerCase();
         const name = input.name;
         const namespace = input.namespace || "default";

package/dist/tools/kubectl-generic.js

@@ -2,7 +2,7 @@ import { execFileSyncSafe } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter, } from "../models/common-parameters.js";
-import { assertNoDangerousFlags } from "../security/kubectl-flags.js";
+import { assertNoDangerousFlags, assertNoRemoteFileReads, assertNotFlagLike, } from "../security/kubectl-flags.js";
 export const kubectlGenericSchema = {
     name: "kubectl_generic",
     description: "Execute any kubectl command with the provided arguments and flags",
@@ -59,6 +59,13 @@ export async function kubectlGeneric(k8sManager, input) {
         // Reject credential/target-redirecting flags before constructing the
         // command. See src/security/kubectl-flags.ts for the rationale.
         assertNoDangerousFlags(input.flags, input.args);
+        // The verb and the resource operands are never flags — only the free-form
+        // `args` array is. Refusing a leading "-" in the operand slots closes the
+        // positional injection point without narrowing what `args` can express.
+        assertNotFlagLike(input.command, "command");
+        assertNotFlagLike(input.subCommand, "subCommand");
+        assertNotFlagLike(input.resourceType, "resourceType");
+        assertNotFlagLike(input.name, "name");
         // Start building the kubectl command
         const command = "kubectl";
         const cmdArgs = [input.command];
@@ -107,6 +114,13 @@ export async function kubectlGeneric(k8sManager, input) {
         if (input.context) {
             cmdArgs.push("--context", input.context);
         }
+        // Reject server-side filesystem reads on remote transports, matching the
+        // per-parameter guards in the structured tools. This tool hands the caller
+        // a free-form kubectl argv, so there is no parameter to attach them to:
+        // "--from-file", "-f" and friends arrive as raw tokens and have to be
+        // matched in the argv. See src/security/transport.ts for the trust model.
+        // No-op under stdio, where the files are the operator's own.
+        assertNoRemoteFileReads(cmdArgs);
         // Execute the command
         try {
             console.error(`Executing: kubectl ${cmdArgs.join(" ")}`);

package/dist/tools/kubectl-get.js

@@ -1,4 +1,4 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import * as yaml from "js-yaml";
@@ -51,6 +51,11 @@ export const kubectlGetSchema = {
 };
 export async function kubectlGet(k8sManager, input) {
     try {
+        // A resource type or name is an RFC 1123 name, never a flag. Refusing a
+        // leading "-" closes the positional injection slot itself rather than
+        // relying on the argv denylist to know every dangerous flag.
+        assertNotFlagLike(input.resourceType, "resourceType");
+        assertNotFlagLike(input.name, "name");
         const resourceType = input.resourceType.toLowerCase();
         const name = input.name || "";
         const namespace = input.namespace || "default";

package/dist/tools/kubectl-scale.js

@@ -1,4 +1,4 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter } from "../models/common-parameters.js";
@@ -32,6 +32,11 @@ export const kubectlScaleSchema = {
 };
 export async function kubectlScale(k8sManager, input) {
     try {
+        // A resource type or name is an RFC 1123 name, never a flag. Refusing a
+        // leading "-" closes the positional injection slot itself rather than
+        // relying on the argv denylist to know every dangerous flag.
+        assertNotFlagLike(input.resourceType, "resourceType");
+        assertNotFlagLike(input.name, "name");
         const namespace = input.namespace || "default";
         const resourceType = input.resourceType || "deployment";
         const context = input.context || "";

package/dist/utils/allowed-hosts.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared construction of the allowedHosts list used by both HTTP transports
+ * for DNS rebinding protection.
+ */
+/**
+ * True when `host` is an all-interfaces bind address ("0.0.0.0", "::", and the
+ * bracketed IPv6 spelling).
+ */
+export declare function isAllInterfacesHost(host: string): boolean;
+/**
+ * Build the default allowedHosts list for DNS rebinding protection.
+ * Includes localhost variants with and without port.
+ *
+ * The configured HOST is added too, so that binding to a specific address also
+ * accepts that address as a Host header — but only when it names an actual
+ * interface. An all-interfaces bind ("0.0.0.0", "::") is deliberately excluded:
+ * it is a bind directive, not an address a client resolves, so accepting it
+ * would let any caller satisfy the allowlist by sending "Host: 0.0.0.0:<port>"
+ * — a value that is public knowledge rather than a property of the deployment.
+ * That would defeat the guard exactly where it matters most, since binding to
+ * all interfaces is what makes the server reachable off-host in the first
+ * place.
+ *
+ * Deployments that bind to all interfaces and need to accept a real hostname
+ * (a Kubernetes Service DNS name, an ingress host) set
+ * DNS_REBINDING_ALLOWED_HOST to that name; it replaces this list entirely.
+ */
+export declare function buildDefaultAllowedHosts(host: string, port: number): string[];

package/dist/utils/allowed-hosts.js

@@ -0,0 +1,65 @@
+/**
+ * Shared construction of the allowedHosts list used by both HTTP transports
+ * for DNS rebinding protection.
+ */
+// Bind addresses that mean "every interface". They are not hostnames: no
+// legitimate client resolves them, so no legitimate client sends one in a Host
+// header. See isAllInterfacesHost / buildDefaultAllowedHosts below.
+const ALL_INTERFACES_HOSTS = new Set(["0.0.0.0", "::", "::0", "0"]);
+/**
+ * True when `host` is an all-interfaces bind address ("0.0.0.0", "::", and the
+ * bracketed IPv6 spelling).
+ */
+export function isAllInterfacesHost(host) {
+    const bare = host.startsWith("[") && host.endsWith("]")
+        ? host.slice(1, -1)
+        : host;
+    return ALL_INTERFACES_HOSTS.has(bare);
+}
+/**
+ * Build the default allowedHosts list for DNS rebinding protection.
+ * Includes localhost variants with and without port.
+ *
+ * The configured HOST is added too, so that binding to a specific address also
+ * accepts that address as a Host header — but only when it names an actual
+ * interface. An all-interfaces bind ("0.0.0.0", "::") is deliberately excluded:
+ * it is a bind directive, not an address a client resolves, so accepting it
+ * would let any caller satisfy the allowlist by sending "Host: 0.0.0.0:<port>"
+ * — a value that is public knowledge rather than a property of the deployment.
+ * That would defeat the guard exactly where it matters most, since binding to
+ * all interfaces is what makes the server reachable off-host in the first
+ * place.
+ *
+ * Deployments that bind to all interfaces and need to accept a real hostname
+ * (a Kubernetes Service DNS name, an ingress host) set
+ * DNS_REBINDING_ALLOWED_HOST to that name; it replaces this list entirely.
+ */
+export function buildDefaultAllowedHosts(host, port) {
+    // Always allow the bare host and host:port for common localhost addresses
+    const localhostAliases = ["127.0.0.1", "localhost", "::1"];
+    const hosts = [];
+    for (const alias of localhostAliases) {
+        hosts.push(alias);
+        // HTTP Host header uses bracket notation for IPv6: [::1]:3000
+        if (alias.includes(":")) {
+            hosts.push(`[${alias}]`);
+            hosts.push(`[${alias}]:${port}`);
+        }
+        else {
+            hosts.push(`${alias}:${port}`);
+        }
+    }
+    // Also add the configured host if it's not already covered, unless it is an
+    // all-interfaces bind address (see above).
+    if (!localhostAliases.includes(host) && !isAllInterfacesHost(host)) {
+        hosts.push(host);
+        if (host.includes(":") && !host.startsWith("[")) {
+            hosts.push(`[${host}]`);
+            hosts.push(`[${host}]:${port}`);
+        }
+        else {
+            hosts.push(`${host}:${port}`);
+        }
+    }
+    return hosts;
+}

package/dist/utils/sse.js

@@ -1,38 +1,7 @@
 import express from "express";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { createAuthMiddleware, isAuthEnabled } from "./auth.js";
-/**
- * Build the default allowedHosts list for DNS rebinding protection.
- * Includes localhost variants with and without port.
- */
-function buildDefaultAllowedHosts(host, port) {
-    // Always allow the bare host and host:port for common localhost addresses
-    const localhostAliases = ["127.0.0.1", "localhost", "::1"];
-    const hosts = [];
-    for (const alias of localhostAliases) {
-        hosts.push(alias);
-        // HTTP Host header uses bracket notation for IPv6: [::1]:3000
-        if (alias.includes(":")) {
-            hosts.push(`[${alias}]`);
-            hosts.push(`[${alias}]:${port}`);
-        }
-        else {
-            hosts.push(`${alias}:${port}`);
-        }
-    }
-    // Also add the configured host if it's not already covered
-    if (!localhostAliases.includes(host)) {
-        hosts.push(host);
-        if (host.includes(":") && !host.startsWith("[")) {
-            hosts.push(`[${host}]`);
-            hosts.push(`[${host}]:${port}`);
-        }
-        else {
-            hosts.push(`${host}:${port}`);
-        }
-    }
-    return hosts;
-}
+import { buildDefaultAllowedHosts, isAllInterfacesHost, } from "./allowed-hosts.js";
 export function startSSEServer(server) {
     const app = express();
     // Create auth middleware - when MCP_AUTH_TOKEN is set, requires X-MCP-AUTH header
@@ -46,12 +15,24 @@ export function startSSEServer(server) {
         ? [process.env.DNS_REBINDING_ALLOWED_HOST]
         : buildDefaultAllowedHosts(host, port);
     // Warn when binding to all interfaces with DNS rebinding protection disabled
-    if (!enableDnsRebindingProtection && (host === "0.0.0.0" || host === "::")) {
+    if (!enableDnsRebindingProtection && isAllInterfacesHost(host)) {
         console.warn("WARNING: DNS rebinding protection is disabled while HOST is set to " +
             `'${host}'. This exposes the MCP server to DNS rebinding attacks ` +
             "from any browser on the network. Set DNS_REBINDING_PROTECTION=true " +
             "(the default) or restrict HOST to 'localhost' / '127.0.0.1'.");
     }
+    // Binding to all interfaces makes the server reachable off-host, but the
+    // default allowlist only covers localhost: a client reaching it under any
+    // other name gets a 403 until the operator names that hostname explicitly.
+    if (enableDnsRebindingProtection &&
+        isAllInterfacesHost(host) &&
+        !process.env.DNS_REBINDING_ALLOWED_HOST) {
+        console.warn(`NOTE: HOST is set to '${host}' (all interfaces) and DNS rebinding ` +
+            "protection is enabled, so only requests with a localhost Host header " +
+            "are accepted. Clients reaching this server under another hostname " +
+            "(a Kubernetes Service name, an ingress host) must be allowed by " +
+            "setting DNS_REBINDING_ALLOWED_HOST to that hostname.");
+    }
     // Currently just copying from docs & allowing for multiple transport connections: https://modelcontextprotocol.io/docs/concepts/transports#server-sent-events-sse
     // Note: When MCP_AUTH_TOKEN is set, requests require X-MCP-AUTH header for authentication
     let transports = [];
@@ -95,8 +76,12 @@ export function startSSEServer(server) {
             });
         }
     });
+    // An all-interfaces bind is not a hostname a client can use: with DNS
+    // rebinding protection on it is not in the allowlist either, so advertise a
+    // localhost URL that actually works rather than 'http://0.0.0.0:<port>'.
+    const advertisedHost = isAllInterfacesHost(host) ? "localhost" : host;
     app.listen(port, host, () => {
-        console.log(`mcp-kubernetes-server is listening on port ${port}\nUse the following url to connect to the server:\nhttp://${host}:${port}/sse`);
+        console.log(`mcp-kubernetes-server is listening on port ${port}\nUse the following url to connect to the server:\nhttp://${advertisedHost}:${port}/sse`);
         if (isAuthEnabled()) {
             console.log("Authentication enabled: X-MCP-AUTH header required for all MCP requests");
         }

package/dist/utils/streamable-http.js

@@ -1,38 +1,7 @@
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createAuthMiddleware, isAuthEnabled } from "./auth.js";
-/**
- * Build the default allowedHosts list for DNS rebinding protection.
- * Includes localhost variants with and without port.
- */
-function buildDefaultAllowedHosts(host, port) {
-    // Always allow the bare host and host:port for common localhost addresses
-    const localhostAliases = ["127.0.0.1", "localhost", "::1"];
-    const hosts = [];
-    for (const alias of localhostAliases) {
-        hosts.push(alias);
-        // HTTP Host header uses bracket notation for IPv6: [::1]:3000
-        if (alias.includes(":")) {
-            hosts.push(`[${alias}]`);
-            hosts.push(`[${alias}]:${port}`);
-        }
-        else {
-            hosts.push(`${alias}:${port}`);
-        }
-    }
-    // Also add the configured host if it's not already covered
-    if (!localhostAliases.includes(host)) {
-        hosts.push(host);
-        if (host.includes(":") && !host.startsWith("[")) {
-            hosts.push(`[${host}]`);
-            hosts.push(`[${host}]:${port}`);
-        }
-        else {
-            hosts.push(`${host}:${port}`);
-        }
-    }
-    return hosts;
-}
+import { buildDefaultAllowedHosts, isAllInterfacesHost, } from "./allowed-hosts.js";
 export function startStreamableHTTPServer(server) {
     const app = express();
     app.use(express.json());
@@ -47,12 +16,24 @@ export function startStreamableHTTPServer(server) {
         ? [process.env.DNS_REBINDING_ALLOWED_HOST]
         : buildDefaultAllowedHosts(host, port);
     // Warn when binding to all interfaces with DNS rebinding protection disabled
-    if (!enableDnsRebindingProtection && (host === "0.0.0.0" || host === "::")) {
+    if (!enableDnsRebindingProtection && isAllInterfacesHost(host)) {
         console.warn("WARNING: DNS rebinding protection is disabled while HOST is set to " +
             `'${host}'. This exposes the MCP server to DNS rebinding attacks ` +
             "from any browser on the network. Set DNS_REBINDING_PROTECTION=true " +
             "(the default) or restrict HOST to 'localhost' / '127.0.0.1'.");
     }
+    // Binding to all interfaces makes the server reachable off-host, but the
+    // default allowlist only covers localhost: a client reaching it under any
+    // other name gets a 403 until the operator names that hostname explicitly.
+    if (enableDnsRebindingProtection &&
+        isAllInterfacesHost(host) &&
+        !process.env.DNS_REBINDING_ALLOWED_HOST) {
+        console.warn(`NOTE: HOST is set to '${host}' (all interfaces) and DNS rebinding ` +
+            "protection is enabled, so only requests with a localhost Host header " +
+            "are accepted. Clients reaching this server under another hostname " +
+            "(a Kubernetes Service name, an ingress host) must be allowed by " +
+            "setting DNS_REBINDING_ALLOWED_HOST to that hostname.");
+    }
     app.post("/mcp", authMiddleware, async (req, res) => {
         // In stateless mode, create a new instance of transport and server for each request
         // to ensure complete isolation. A single instance would cause request ID collisions
@@ -132,8 +113,12 @@ export function startStreamableHTTPServer(server) {
             });
         }
     });
+    // An all-interfaces bind is not a hostname a client can use: with DNS
+    // rebinding protection on it is not in the allowlist either, so advertise a
+    // localhost URL that actually works rather than 'http://0.0.0.0:<port>'.
+    const advertisedHost = isAllInterfacesHost(host) ? "localhost" : host;
     const httpServer = app.listen(port, host, () => {
-        console.log(`mcp-kubernetes-server is listening on port ${port}\nUse the following url to connect to the server:\nhttp://${host}:${port}/mcp`);
+        console.log(`mcp-kubernetes-server is listening on port ${port}\nUse the following url to connect to the server:\nhttp://${advertisedHost}:${port}/mcp`);
         if (isAuthEnabled()) {
             console.log("Authentication enabled: X-MCP-AUTH header required for all MCP requests");
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",