mcp-server-kubernetes 4.1.8 → 4.1.10

package/README.md

@@ -77,18 +77,15 @@ To manually install, you can also get the .mcpb by going to the latest [Release]
 
 [![Install Kubernetes MCP in VS Code](https://img.shields.io/badge/Install%20Kubernetes%20MCP%20in%20VS%20Code-blue?logo=visualstudiocode)](vscode:mcp/install?%7B%22name%22%3A%20%22kubernetes%22%2C%20%22type%22%3A%20%22stdio%22%2C%20%22command%22%3A%20%22npx%22%2C%20%22args%22%3A%20%5B%22mcp-server-kubernetes%22%5D%7D)
 
-For VS Code integration, you can use the MCP server with extensions that support the Model Context Protocol:
-
-1. Install a compatible MCP extension (such as Claude Dev or similar MCP clients)
-2. Configure the extension to use this server:
+VS Code has built-in MCP support. Use the one-click install button above, or add the server to `.vscode/mcp.json` in your workspace (or to your user `mcp.json` via **MCP: Open User Configuration**):
 
 ```json
 {
-  "mcpServers": {
+  "servers": {
     "kubernetes": {
+      "type": "stdio",
       "command": "npx",
-      "args": ["mcp-server-kubernetes"],
-      "description": "Kubernetes cluster management and operations"
+      "args": ["mcp-server-kubernetes"]
     }
   }
 }
@@ -96,7 +93,7 @@ For VS Code integration, you can use the MCP server with extensions that support
 
 ### Cursor
 
-Cursor supports MCP servers through its AI integration. Add the server to your Cursor MCP configuration:
+Cursor supports MCP servers through its AI integration. Add the server to `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project):
 
 ```json
 {
@@ -111,6 +108,48 @@ Cursor supports MCP servers through its AI integration. Add the server to your C
 
 The server will automatically connect to your current kubectl context. You can verify the connection by asking the AI assistant to list your pods or create a test deployment.
 
+### Muse Code
+
+[Muse Code](https://dev.meta.ai/docs/muse-code/extending#mcp) reads MCP servers from the `mcp_servers` block of `~/.config/muse/settings.json`. The file must include `"schema_version": 1`:
+
+```json
+{
+  "schema_version": 1,
+  "mcp_servers": {
+    "kubernetes": {
+      "transport": "stdio",
+      "command": "npx",
+      "args": ["mcp-server-kubernetes"]
+    }
+  }
+}
+```
+
+To connect over Streamable HTTP instead, first start the server in HTTP mode (it serves `/mcp` on port `3000` by default; see [Streamable HTTP Transport](ADVANCED_README.md#streamable-http-transport)):
+
+```bash
+ENABLE_UNSAFE_STREAMABLE_HTTP_TRANSPORT=1 npx mcp-server-kubernetes
+```
+
+Then point Muse Code at that endpoint with the `streamable_http` transport (`headers` is optional):
+
+```json
+{
+  "schema_version": 1,
+  "mcp_servers": {
+    "kubernetes": {
+      "transport": "streamable_http",
+      "url": "http://localhost:3000/mcp",
+      "mode": "optional"
+    }
+  }
+}
+```
+
+`"mode": "optional"` lets Muse Code start with a warning if the HTTP server isn't running, instead of aborting.
+
+Start a new Muse Code session after editing the file, then run `/mcp` to confirm the `kubernetes` server and its tools are connected.
+
 ## Usage with mcp-chat
 
 [mcp-chat](https://github.com/Flux159/mcp-chat) is a CLI chat client for MCP servers. You can use it to interact with the Kubernetes server.
@@ -351,6 +390,7 @@ The following destructive operations are disabled:
 - `cleanup_pods`: Cleaning up problematic pods
 - `node_management`: Node management operations (can drain nodes)
 - `kubectl_generic`: General kubectl command access (may include destructive operations)
+- `exec_in_pod`: Arbitrary command execution inside a pod (can read service-account tokens and change state)
 
 For additional advanced features, see the [ADVANCED_README.md](ADVANCED_README.md) and also the [docs](https://github.com/Flux159/mcp-server-kubernetes/tree/main/docs) folder for specific information on `helm_install`, `helm_template_apply`, node management & pod cleanup.
 

package/dist/config/server-config.d.ts

@@ -1,6 +1,6 @@
 export declare const serverConfig: {
     readonly name: "kubernetes";
-    readonly version: "4.1.8";
+    readonly version: "4.1.10";
     readonly capabilities: {
         readonly resources: {};
         readonly tools: {};

package/dist/config/server-config.js

@@ -1,6 +1,6 @@
 export const serverConfig = {
     name: "kubernetes",
-    version: "4.1.8",
+    version: "4.1.10",
     capabilities: {
         resources: {},
         tools: {},

package/dist/index.d.ts

@@ -359,7 +359,9 @@ declare const allTools: ({
     readonly name: "kubectl_context";
     readonly description: "Manage Kubernetes contexts - list, get, or set the current context";
     readonly annotations: {
-        readonly readOnlyHint: true;
+        readonly readOnlyHint: false;
+        readonly destructiveHint: false;
+        readonly idempotentHint: true;
     };
     readonly inputSchema: {
         readonly type: "object";
@@ -601,8 +603,8 @@ declare const allTools: ({
             };
             readonly output: {
                 readonly type: "string";
-                readonly enum: readonly ["json", "yaml", "name", "go-template", "go-template-file", "template", "templatefile", "jsonpath", "jsonpath-as-json", "jsonpath-file"];
-                readonly description: "Output format. One of: json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file";
+                readonly enum: readonly ["json", "yaml", "name", "go-template", "template", "jsonpath", "jsonpath-as-json"];
+                readonly description: "Output format. One of: json|yaml|name|go-template|template|jsonpath|jsonpath-as-json. The template formats take their template inline, e.g. 'jsonpath={.metadata.name}'.";
                 readonly default: "yaml";
             };
             readonly validate: {

package/dist/index.js

@@ -69,6 +69,7 @@ const destructiveTools = [
     cleanupSchema, // Cleanup is also destructive as it deletes resources
     kubectlGenericSchema, // Generic kubectl command can perform destructive operations
     nodeManagementSchema, // Node management can drain nodes (destructive)
+    execInPodSchema, // Arbitrary command execution inside a pod; can read SA tokens and mutate state
 ];
 // Get all available tools
 const allTools = [

package/dist/security/kubectl-flags.d.ts

@@ -61,6 +61,27 @@ export declare function assertNoRemoteFileReads(args: readonly string[]): void;
  * Honours the same ALLOW_KUBECTL_UNSAFE_FLAGS escape hatch as the flag guard.
  */
 export declare function assertNotFlagLike(value: string | undefined, field: string): void;
+/**
+ * Apply kubectl_generic's verb policy to a fully-constructed argv, whose first
+ * token is the verb.
+ *
+ * The flag guards above can only see dash-prefixed tokens, but some kubectl
+ * verbs reach the same assets through plain operands: "config view --raw"
+ * prints the operator's credentials, "config set clusters.x.server <url>"
+ * persistently redirects the kubeconfig, "cp" reads and writes local paths
+ * given as positionals. Those are matched on the verb instead.
+ *
+ * kubectl cp resolves any operand without a ":" on the local machine. Under
+ * stdio a local *source* is the operator reading their own file, the same as
+ * "-f", and stays allowed; a local *destination* is a write to a path chosen
+ * by whoever steers the tool arguments, like --log-file, and is refused. Over
+ * a remote transport both sides would be the server host, so cp is refused
+ * outright.
+ *
+ * The remote-only checks have no escape hatch, matching
+ * assertNoRemoteFileReads; the rest honour ALLOW_KUBECTL_UNSAFE_FLAGS.
+ */
+export declare function assertAllowedGenericCommand(args: readonly string[]): void;
 /**
  * Drop-in replacement for child_process.execFileSync that scans the argv for
  * credential/target-redirecting flags before executing. Tool files import this

package/dist/security/kubectl-flags.js

@@ -132,11 +132,24 @@ const FILE_READ_SHORT_FLAGS = new Set([
 // assertSafeArgv refuses them in any argv, on any transport, rather than only
 // where a server-side path would be attacker-chosen. Every tool has positional
 // slots, read-only ones included, so a name-shaped denial is not enough.
+//
+// kubectl also accepts "templatefile" as an alias of "go-template-file", so
+// the set is a list of known spellings rather than the whole rule: every
+// file-reading format kubectl has ever shipped is named "...file", and
+// isFileReadOutputFormat refuses that suffix too, so an alias added upstream
+// is refused before anyone has to notice it here.
 const FILE_READ_OUTPUT_FORMATS = new Set([
     "go-template-file",
+    "templatefile",
     "jsonpath-file",
     "custom-columns-file",
 ]);
+// `format` is the full -o value, e.g. "templatefile=/etc/passwd" or just
+// "go-template-file" when the path arrives through --template instead.
+function isFileReadOutputFormat(format) {
+    const name = format.split("=")[0].toLowerCase();
+    return FILE_READ_OUTPUT_FORMATS.has(name) || name.endsWith("file");
+}
 function isUnsafeFlagsAllowed() {
     return process.env.ALLOW_KUBECTL_UNSAFE_FLAGS === "true";
 }
@@ -205,6 +218,19 @@ function isDangerousFlagName(rawName, fromArgs) {
     }
     return false;
 }
+// Tool inputs are typed string[] at compile time only: nothing validates the
+// JSON a client sends against the tool's inputSchema, so an `args` entry can be
+// an array, number or object. child_process stringifies every argv element, so
+// ["--server=https://attacker"] reaches kubectl as "--server=https://attacker"
+// — a token the scans below would never have looked at had they skipped it.
+// Refuse anything that is not a string rather than guess how it will print.
+function assertStringToken(tok) {
+    if (typeof tok === "string")
+        return;
+    throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl/helm with a non-string argument ` +
+        `(${JSON.stringify(tok) ?? typeof tok}): every command-line argument ` +
+        `must be a string.`);
+}
 function reject(flag) {
     throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl with flag "${flag}": this flag can redirect ` +
         `kubectl/helm to a different API server, substitute credentials, or ` +
@@ -232,8 +258,7 @@ export function assertNoDangerousFlags(flags, args) {
     }
     if (args) {
         for (const tok of args) {
-            if (typeof tok !== "string")
-                continue;
+            assertStringToken(tok);
             if (!tok.startsWith("-"))
                 continue;
             if (isDangerousFlagName(tok, true))
@@ -253,12 +278,11 @@ export function assertNoDangerousFlags(flags, args) {
  * flag unless ALLOW_KUBECTL_UNSAFE_FLAGS=true.
  */
 export function assertSafeArgv(args) {
+    args.forEach(assertStringToken);
     if (isUnsafeFlagsAllowed())
         return;
     for (let i = 0; i < args.length; i++) {
         const tok = args[i];
-        if (typeof tok !== "string")
-            continue;
         if (!tok.startsWith("-"))
             continue;
         const name = normalizeFlagName(tok);
@@ -273,8 +297,7 @@ export function assertSafeArgv(args) {
         // ("-o go-template-file=<path>"), so it has to be matched on the value
         // rather than on the flag name.
         const format = outputFormatValue(tok, args[i + 1]);
-        if (format !== undefined &&
-            FILE_READ_OUTPUT_FORMATS.has(format.split("=")[0])) {
+        if (format !== undefined && isFileReadOutputFormat(format)) {
             rejectOutputFileRead(tok, format);
         }
     }
@@ -348,7 +371,8 @@ export function assertNoRemoteFileReads(args) {
         return;
     for (let i = 0; i < args.length; i++) {
         const tok = args[i];
-        if (typeof tok !== "string" || !tok.startsWith("-"))
+        assertStringToken(tok);
+        if (!tok.startsWith("-"))
             continue;
         if (FILE_READ_FLAGS.has(normalizeFlagName(tok)))
             rejectFileRead(tok);
@@ -387,6 +411,109 @@ export function assertNotFlagLike(value, field) {
         `the ${field}, which would let the caller inject arbitrary flags. ` +
         `Provide a ${field} that does not begin with "-".`);
 }
+// kubectl verbs kubectl_generic refuses on every transport. Each one either
+// hands back or rewrites the operator's own credentials, or never returns:
+// execFileSync blocks the event loop, so a call that does not exit stalls the
+// server for every client until the child is killed. The structured tools
+// cover the legitimate uses (kubectl_context, port_forward).
+const GENERIC_DENIED_VERBS = new Map([
+    [
+        "config",
+        "it prints and rewrites the operator's kubeconfig (\"config view --raw\" " +
+            "returns the credentials, \"config set\" repoints a cluster at another " +
+            "server). Use the kubectl_context tool for context operations",
+    ],
+    [
+        "proxy",
+        "it serves the Kubernetes API with the operator's credentials on a " +
+            "local port and never exits",
+    ],
+    [
+        "port-forward",
+        "it never exits. Use the port_forward tool, which runs it in the " +
+            "background",
+    ],
+    ["attach", "it is interactive and never exits"],
+    ["edit", "it opens an interactive editor on the MCP server host"],
+]);
+// kubectl verbs whose positional operands are paths on the machine kubectl
+// runs on. Like FILE_READ_FLAGS they are only a problem on a remote transport,
+// where that machine is the server host rather than the caller's — but the
+// path is a positional operand, which assertNoRemoteFileReads cannot see.
+const GENERIC_REMOTE_DENIED_VERBS = new Set(["cp", "kustomize"]);
+// kubectl subcommand names, including plugin names ("kubectl foo" runs
+// kubectl-foo). Anything else is not a verb: kubectl skips an empty first
+// argument and takes the next token as the verb instead, so an empty
+// `command` would let the real verb ride in through a later slot unchecked.
+const VERB_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+function rejectVerb(verb, reason) {
+    throw new McpError(ErrorCode.InvalidParams, `Refusing to run "kubectl ${verb}" through kubectl_generic: ${reason}.`);
+}
+/**
+ * Apply kubectl_generic's verb policy to a fully-constructed argv, whose first
+ * token is the verb.
+ *
+ * The flag guards above can only see dash-prefixed tokens, but some kubectl
+ * verbs reach the same assets through plain operands: "config view --raw"
+ * prints the operator's credentials, "config set clusters.x.server <url>"
+ * persistently redirects the kubeconfig, "cp" reads and writes local paths
+ * given as positionals. Those are matched on the verb instead.
+ *
+ * kubectl cp resolves any operand without a ":" on the local machine. Under
+ * stdio a local *source* is the operator reading their own file, the same as
+ * "-f", and stays allowed; a local *destination* is a write to a path chosen
+ * by whoever steers the tool arguments, like --log-file, and is refused. Over
+ * a remote transport both sides would be the server host, so cp is refused
+ * outright.
+ *
+ * The remote-only checks have no escape hatch, matching
+ * assertNoRemoteFileReads; the rest honour ALLOW_KUBECTL_UNSAFE_FLAGS.
+ */
+export function assertAllowedGenericCommand(args) {
+    const verb = args[0];
+    if (typeof verb !== "string" || !VERB_PATTERN.test(verb)) {
+        throw new McpError(ErrorCode.InvalidParams, `Refusing to run kubectl_generic with command="${verb}": the command ` +
+            `must be a kubectl subcommand name such as "get" or "rollout".`);
+    }
+    if (isRemoteTransport() && GENERIC_REMOTE_DENIED_VERBS.has(verb)) {
+        rejectVerb(verb, "its operands are paths on the MCP server's own filesystem, which is " +
+            "disabled on remote (SSE/Streamable HTTP) transports because the " +
+            "path is chosen by the client but resolved on the server host");
+    }
+    if (isUnsafeFlagsAllowed())
+        return;
+    const reason = GENERIC_DENIED_VERBS.get(verb);
+    if (reason !== undefined)
+        rejectVerb(verb, reason);
+    if (verb === "cp") {
+        const destinations = cpOperands(args).slice(1);
+        const local = destinations.find((operand) => !operand.includes(":"));
+        if (local !== undefined) {
+            rejectVerb(verb, `"${local}" would be written to the MCP server's own filesystem. ` +
+                `kubectl_generic only copies into a pod ("<pod>:<path>"); ` +
+                `copying out of one would let the caller overwrite any file the ` +
+                `server user can write`);
+        }
+    }
+}
+// The operands of a "kubectl cp" argv, in order. Every token that does not
+// start with "-" counts, including the values of split flags ("-c main"):
+// telling those apart would need kubectl's flag table, and treating a value as
+// an operand can only refuse a call, never let one through. After "--" every
+// token is an operand.
+function cpOperands(args) {
+    const operands = [];
+    let afterSeparator = false;
+    for (const tok of args.slice(1)) {
+        if (!afterSeparator && tok === "--") {
+            afterSeparator = true;
+            continue;
+        }
+        if (afterSeparator || !tok.startsWith("-"))
+            operands.push(tok);
+    }
+    return operands;
+}
 /**
  * Drop-in replacement for child_process.execFileSync that scans the argv for
  * credential/target-redirecting flags before executing. Tool files import this

package/dist/tools/exec_in_pod.js

@@ -8,7 +8,7 @@
  * interpretation. Shell operators (pipes, redirects, etc.) are intentionally
  * not supported.
  */
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter } from "../models/common-parameters.js";
@@ -74,6 +74,9 @@ export async function execInPod(k8sManager, input) {
             throw new McpError(ErrorCode.InvalidParams, `Command array element at index ${i} must be a string`);
         }
     }
+    // The pod name is a positional operand; a leading "-" would make kubectl
+    // parse it as a flag (e.g. --filename=<server path>).
+    assertNotFlagLike(input.name, "name");
     try {
         const args = ["exec", input.name, "-n", namespace];
         if (input.container) {

package/dist/tools/helm-operations.js

@@ -6,7 +6,7 @@
  */
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
-import { writeFileSync, unlinkSync } from "fs";
+import { removeTempFile, writeTempFile } from "../utils/temp-file.js";
 import { dump } from "js-yaml";
 import { isRemoteTransport } from "../security/transport.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
@@ -226,8 +226,7 @@ async function installHelmChartTemplate(params) {
         }
         else if (params.values) {
             steps.push("Using provided values object");
-            tempValuesFile = `/tmp/values-${Date.now()}.yaml`;
-            writeFileSync(tempValuesFile, dump(params.values));
+            tempValuesFile = writeTempFile("values.yaml", dump(params.values));
             templateArgs.push("-f", tempValuesFile);
         }
         let yamlOutput;
@@ -237,20 +236,19 @@ async function installHelmChartTemplate(params) {
         finally {
             // Clean up temp file
             if (tempValuesFile) {
-                unlinkSync(tempValuesFile);
+                removeTempFile(tempValuesFile);
             }
         }
         // Step 4: Apply YAML using kubectl
         steps.push("Applying YAML using kubectl");
-        const tempYamlFile = `/tmp/helm-template-${Date.now()}.yaml`;
-        writeFileSync(tempYamlFile, yamlOutput);
+        const tempYamlFile = writeTempFile("template.yaml", yamlOutput);
         try {
             executeCommand("kubectl", ["apply", "-f", tempYamlFile]);
             steps.push("Helm chart installed successfully using template mode");
         }
         finally {
             // Clean up temp file
-            unlinkSync(tempYamlFile);
+            removeTempFile(tempYamlFile);
         }
         return {
             content: [
@@ -317,14 +315,13 @@ export async function installHelmChart(params) {
         // Add values object if provided
         if (params.values) {
             const valuesContent = dump(params.values);
-            const tempFile = `/tmp/values-${Date.now()}.yaml`;
-            writeFileSync(tempFile, valuesContent);
+            const tempFile = writeTempFile("values.yaml", valuesContent);
             try {
                 args.push("-f", tempFile);
                 executeCommand("helm", args);
             }
             finally {
-                unlinkSync(tempFile);
+                removeTempFile(tempFile);
             }
         }
         else {
@@ -385,14 +382,13 @@ export async function upgradeHelmChart(params) {
         // Add values object if provided
         if (params.values) {
             const valuesContent = dump(params.values);
-            const tempFile = `/tmp/values-${Date.now()}.yaml`;
-            writeFileSync(tempFile, valuesContent);
+            const tempFile = writeTempFile("values.yaml", valuesContent);
             try {
                 args.push("-f", tempFile);
                 executeCommand("helm", args);
             }
             finally {
-                unlinkSync(tempFile);
+                removeTempFile(tempFile);
             }
         }
         else {

package/dist/tools/kubectl-apply.js

@@ -1,9 +1,7 @@
 import { execFileSyncSafe } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
+import { removeTempFile, writeTempFile } from "../utils/temp-file.js";
 import { contextParameter, namespaceParameter, dryRunParameter } from "../models/common-parameters.js";
 import { isRemoteTransport } from "../security/transport.js";
 export const kubectlApplySchema = {
@@ -59,9 +57,7 @@ export async function kubectlApply(k8sManager, input) {
         // Process manifest content if provided
         if (input.manifest) {
             // Create temporary file for the manifest
-            const tmpDir = os.tmpdir();
-            tempFile = path.join(tmpDir, `manifest-${Date.now()}.yaml`);
-            fs.writeFileSync(tempFile, input.manifest);
+            tempFile = writeTempFile("manifest.yaml", input.manifest);
             args.push("-f", tempFile);
         }
         else if (input.filename) {
@@ -89,14 +85,8 @@ export async function kubectlApply(k8sManager, input) {
                 env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
             });
             // Clean up temp file if created
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            if (tempFile)
+                removeTempFile(tempFile);
             return {
                 content: [
                     {
@@ -108,14 +98,8 @@ export async function kubectlApply(k8sManager, input) {
         }
         catch (error) {
             // Clean up temp file if created, even if command failed
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            if (tempFile)
+                removeTempFile(tempFile);
             throw new McpError(ErrorCode.InternalError, `Failed to apply manifest: ${error.message}`);
         }
     }

package/dist/tools/kubectl-context.d.ts

@@ -3,7 +3,9 @@ export declare const kubectlContextSchema: {
     readonly name: "kubectl_context";
     readonly description: "Manage Kubernetes contexts - list, get, or set the current context";
     readonly annotations: {
-        readonly readOnlyHint: true;
+        readonly readOnlyHint: false;
+        readonly destructiveHint: false;
+        readonly idempotentHint: true;
     };
     readonly inputSchema: {
         readonly type: "object";

package/dist/tools/kubectl-context.js

@@ -4,8 +4,14 @@ import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 export const kubectlContextSchema = {
     name: "kubectl_context",
     description: "Manage Kubernetes contexts - list, get, or set the current context",
+    // Not read-only: "set" runs "kubectl config use-context", which rewrites
+    // the current-context in the kubeconfig and so retargets every later
+    // command. Under ALLOW_ONLY_READONLY_TOOLS the tool stays available for
+    // list/get, and "set" is refused at call time.
     annotations: {
-        readOnlyHint: true,
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
     },
     inputSchema: {
         type: "object",
@@ -205,6 +211,12 @@ export async function kubectlContext(k8sManager, input) {
                     throw error;
                 }
             case "set":
+                if (process.env.ALLOW_ONLY_READONLY_TOOLS === "true") {
+                    throw new McpError(ErrorCode.InvalidRequest, "Switching the current context is disabled in read-only mode " +
+                        "(ALLOW_ONLY_READONLY_TOOLS=true): it rewrites the kubeconfig " +
+                        "and retargets every later command. Pass a 'context' to " +
+                        "individual tools instead.");
+                }
                 // Validate input
                 if (!name) {
                     throw new McpError(ErrorCode.InvalidParams, "Name parameter is required for set operation");

package/dist/tools/kubectl-create.d.ts

@@ -12,8 +12,8 @@ export declare const kubectlCreateSchema: {
             };
             readonly output: {
                 readonly type: "string";
-                readonly enum: readonly ["json", "yaml", "name", "go-template", "go-template-file", "template", "templatefile", "jsonpath", "jsonpath-as-json", "jsonpath-file"];
-                readonly description: "Output format. One of: json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file";
+                readonly enum: readonly ["json", "yaml", "name", "go-template", "template", "jsonpath", "jsonpath-as-json"];
+                readonly description: "Output format. One of: json|yaml|name|go-template|template|jsonpath|jsonpath-as-json. The template formats take their template inline, e.g. 'jsonpath={.metadata.name}'.";
                 readonly default: "yaml";
             };
             readonly validate: {

package/dist/tools/kubectl-create.js

@@ -1,11 +1,26 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
+import { removeTempFile, writeTempFile } from "../utils/temp-file.js";
 import { contextParameter, namespaceParameter, dryRunParameter } from "../models/common-parameters.js";
 import { isRemoteTransport } from "../security/transport.js";
+// Valid ConfigMap / Secret data keys, as Kubernetes validates them.
+const DATA_KEY_PATTERN = /^[-._a-zA-Z0-9]{1,253}$/;
+// Output formats kubectl renders without reading anything from disk. The
+// template formats carry their template inline ("jsonpath={.metadata.name}").
+const INLINE_OUTPUT_FORMATS = new Set([
+    "json",
+    "yaml",
+    "name",
+    "go-template",
+    "template",
+    "jsonpath",
+    "jsonpath-as-json",
+]);
+function isInlineOutputFormat(output) {
+    return (typeof output === "string" &&
+        INLINE_OUTPUT_FORMATS.has(output.split("=")[0]));
+}
 export const kubectlCreateSchema = {
     name: "kubectl_create",
     description: "Create Kubernetes resources using various methods (from file or using subcommands)",
@@ -21,14 +36,11 @@ export const kubectlCreateSchema = {
                     "yaml",
                     "name",
                     "go-template",
-                    "go-template-file",
                     "template",
-                    "templatefile",
                     "jsonpath",
                     "jsonpath-as-json",
-                    "jsonpath-file",
                 ],
-                description: "Output format. One of: json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file",
+                description: "Output format. One of: json|yaml|name|go-template|template|jsonpath|jsonpath-as-json. The template formats take their template inline, e.g. 'jsonpath={.metadata.name}'.",
                 default: "yaml",
             },
             validate: {
@@ -163,6 +175,11 @@ export async function kubectlCreate(k8sManager, input) {
             input.resourceType !== "namespace") {
             throw new McpError(ErrorCode.InvalidRequest, `Name is required when creating a ${input.resourceType}`);
         }
+        // Positional operands of "kubectl create <type> [<subtype>] <name>": a
+        // leading "-" would make kubectl parse them as flags.
+        assertNotFlagLike(input.name, "name");
+        assertNotFlagLike(input.secretType, "secretType");
+        assertNotFlagLike(input.serviceType, "serviceType");
         // Reject server-side filesystem reads on remote transports. Over SSE /
         // Streamable HTTP the path resolves on the MCP server host, not the
         // client, so `filename` (-f) and `fromFile` (--from-file) would let any
@@ -178,21 +195,37 @@ export async function kubectlCreate(k8sManager, input) {
                 throw new McpError(ErrorCode.InvalidRequest, "The 'fromFile' parameter reads files from the MCP server's filesystem and is disabled on remote (SSE/Streamable HTTP) transports. Pass the file contents via 'fromFileContent' instead.");
             }
         }
+        // kubectl parses --from-file as a comma-separated list, so a
+        // fromFileContent key of "x=/etc/passwd,y" would add a second source that
+        // names a file on the server. Kubernetes only accepts these characters in
+        // ConfigMap and Secret data keys anyway, so no legitimate key is refused.
+        // Checked up front so a bad entry fails before any temp file is written.
+        for (const entry of input.fromFileContent ?? []) {
+            if (entry?.key && !DATA_KEY_PATTERN.test(String(entry.key))) {
+                throw new McpError(ErrorCode.InvalidRequest, `Invalid fromFileContent key ${JSON.stringify(entry.key)}: keys ` +
+                    `may only contain letters, digits, '-', '_' and '.'`);
+            }
+        }
         // Set up common parameters
         const namespace = input.namespace || "default";
         const dryRun = input.dryRun || false;
         const validate = input.validate ?? true;
         const output = input.output || "yaml";
+        // The schema's enum is not enforced at runtime, and kubectl reads a file
+        // for some formats ("templatefile=<path>"), so only the formats that
+        // render inline are passed through.
+        if (!isInlineOutputFormat(output)) {
+            throw new McpError(ErrorCode.InvalidParams, `Unsupported output format "${output}". Use one of: ` +
+                `${[...INLINE_OUTPUT_FORMATS].join(", ")}.`);
+        }
         const context = input.context || "";
         const command = "kubectl";
         const args = ["create"];
         const tempFiles = [];
         // Write client-provided content to a private temp file and return its
         // path. The file is tracked for cleanup after kubectl runs.
-        const writeTempFile = (contents, label, ext = "") => {
-            const tmpDir = os.tmpdir();
-            const tempFile = path.join(tmpDir, `create-${label}-${Date.now()}-${tempFiles.length}${ext}`);
-            fs.writeFileSync(tempFile, contents, { mode: 0o600 });
+        const trackTempFile = (name, contents) => {
+            const tempFile = writeTempFile(name, contents);
             tempFiles.push(tempFile);
             return tempFile;
         };
@@ -204,7 +237,7 @@ export async function kubectlCreate(k8sManager, input) {
                 if (!entry.key) {
                     throw new McpError(ErrorCode.InvalidRequest, "Each fromFileContent entry requires a non-empty 'key'");
                 }
-                const tempFile = writeTempFile(entry.content ?? "", "fromfile");
+                const tempFile = trackTempFile("fromfile", entry.content ?? "");
                 args.push(`--from-file=${entry.key}=${tempFile}`);
             });
         };
@@ -212,7 +245,7 @@ export async function kubectlCreate(k8sManager, input) {
         if (input.manifest || input.filename) {
             if (input.manifest) {
                 // Create temporary file for the manifest
-                args.push("-f", writeTempFile(input.manifest, "manifest", ".yaml"));
+                args.push("-f", trackTempFile("manifest.yaml", input.manifest));
             }
             else if (input.filename) {
                 args.push("-f", input.filename);
@@ -357,14 +390,7 @@ export async function kubectlCreate(k8sManager, input) {
         }
         // Remove any temp files created for inline content.
         const cleanupTempFiles = () => {
-            tempFiles.forEach((tempFile) => {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            });
+            tempFiles.forEach(removeTempFile);
         };
         // Execute the command
         try {

package/dist/tools/kubectl-delete.js

@@ -1,9 +1,7 @@
 import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
+import { removeTempFile, writeTempFile } from "../utils/temp-file.js";
 import { contextParameter, namespaceParameter, } from "../models/common-parameters.js";
 import { isRemoteTransport } from "../security/transport.js";
 export const kubectlDeleteSchema = {
@@ -84,9 +82,7 @@ export async function kubectlDelete(k8sManager, input) {
         // Handle deleting from manifest or file
         if (input.manifest) {
             // Create temporary file for the manifest
-            const tmpDir = os.tmpdir();
-            tempFile = path.join(tmpDir, `delete-manifest-${Date.now()}.yaml`);
-            fs.writeFileSync(tempFile, input.manifest);
+            tempFile = writeTempFile("manifest.yaml", input.manifest);
             args.push("-f", tempFile);
         }
         else if (input.filename) {
@@ -136,14 +132,8 @@ export async function kubectlDelete(k8sManager, input) {
                 env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
             });
             // Clean up temp file if created
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            if (tempFile)
+                removeTempFile(tempFile);
             return {
                 content: [
                     {
@@ -155,14 +145,8 @@ export async function kubectlDelete(k8sManager, input) {
         }
         catch (error) {
             // Clean up temp file if created, even if command failed
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            if (tempFile)
+                removeTempFile(tempFile);
             if (error.status === 404 || error.message.includes("not found")) {
                 return {
                     content: [

package/dist/tools/kubectl-generic.js

@@ -2,7 +2,7 @@ import { execFileSyncSafe } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter, } from "../models/common-parameters.js";
-import { assertNoDangerousFlags, assertNoRemoteFileReads, assertNotFlagLike, } from "../security/kubectl-flags.js";
+import { assertAllowedGenericCommand, assertNoDangerousFlags, assertNoRemoteFileReads, assertNotFlagLike, } from "../security/kubectl-flags.js";
 export const kubectlGenericSchema = {
     name: "kubectl_generic",
     description: "Execute any kubectl command with the provided arguments and flags",
@@ -121,6 +121,10 @@ export async function kubectlGeneric(k8sManager, input) {
         // matched in the argv. See src/security/transport.ts for the trust model.
         // No-op under stdio, where the files are the operator's own.
         assertNoRemoteFileReads(cmdArgs);
+        // Some verbs reach the operator's credentials or the server's filesystem
+        // through plain operands ("config view --raw", "config set ...server",
+        // "cp <path> ..."), which none of the flag scans above can see.
+        assertAllowedGenericCommand(cmdArgs);
         // Execute the command
         try {
             console.error(`Executing: kubectl ${cmdArgs.join(" ")}`);

package/dist/tools/kubectl-logs.js

@@ -1,4 +1,4 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter, } from "../models/common-parameters.js";
@@ -63,6 +63,9 @@ export const kubectlLogsSchema = {
 };
 export async function kubectlLogs(k8sManager, input) {
     try {
+        // The resource name is a positional operand; a leading "-" would make
+        // kubectl parse it as a flag.
+        assertNotFlagLike(input.name, "name");
         const resourceType = (input.resourceType ?? "pod").toLowerCase();
         const name = input.name;
         const namespace = input.namespace || "default";

package/dist/tools/kubectl-operations.js

@@ -1,4 +1,4 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter } from "../models/common-parameters.js";
 export const explainResourceSchema = {
@@ -86,6 +86,9 @@ const executeKubectlCommand = (command, args) => {
 };
 export async function explainResource(params) {
     try {
+        // The resource is a positional operand; a leading "-" would make kubectl
+        // parse it as a flag.
+        assertNotFlagLike(params.resource, "resource");
         const command = "kubectl";
         const args = ["explain"];
         if (params.apiVersion) {

package/dist/tools/kubectl-patch.js

@@ -1,10 +1,8 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { isRemoteTransport } from "../security/transport.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
+import { removeTempFile, writeTempFile } from "../utils/temp-file.js";
 import { contextParameter, dryRunParameter, namespaceParameter, } from "../models/common-parameters.js";
 export const kubectlPatchSchema = {
     name: "kubectl_patch",
@@ -65,6 +63,10 @@ export async function kubectlPatch(k8sManager, input) {
         const dryRun = input.dryRun || false;
         const context = input.context || "";
         let tempFile = null;
+        // Positional operands: a leading "-" would make kubectl parse them as
+        // flags (e.g. --filename=<server path>).
+        assertNotFlagLike(input.resourceType, "resourceType");
+        assertNotFlagLike(input.name, "name");
         const command = "kubectl";
         const args = ["patch", input.resourceType, input.name, "-n", namespace];
         // Add patch type flag
@@ -87,9 +89,7 @@ export async function kubectlPatch(k8sManager, input) {
                 throw new McpError(ErrorCode.InvalidRequest, "patchData must be a valid JSON object, not a string.");
             }
             // Create a temporary file for the patch data
-            const tmpDir = os.tmpdir();
-            tempFile = path.join(tmpDir, `patch-${Date.now()}.json`);
-            fs.writeFileSync(tempFile, JSON.stringify(input.patchData));
+            tempFile = writeTempFile("patch.json", JSON.stringify(input.patchData));
             args.push("--patch-file", tempFile);
         }
         else if (input.patchFile) {
@@ -111,14 +111,8 @@ export async function kubectlPatch(k8sManager, input) {
                 env: { ...process.env, KUBECONFIG: process.env.KUBECONFIG },
             });
             // Clean up temp file if created
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            if (tempFile)
+                removeTempFile(tempFile);
             return {
                 content: [
                     {
@@ -130,14 +124,8 @@ export async function kubectlPatch(k8sManager, input) {
         }
         catch (error) {
             // Clean up temp file if created, even if command failed
-            if (tempFile) {
-                try {
-                    fs.unlinkSync(tempFile);
-                }
-                catch (err) {
-                    console.warn(`Failed to delete temporary file ${tempFile}: ${err}`);
-                }
-            }
+            if (tempFile)
+                removeTempFile(tempFile);
             throw new McpError(ErrorCode.InternalError, `Failed to patch resource: ${error.message}`);
         }
     }

package/dist/tools/kubectl-rollout.js

@@ -1,4 +1,4 @@
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 import { contextParameter, namespaceParameter } from "../models/common-parameters.js";
@@ -55,6 +55,11 @@ export async function kubectlRollout(k8sManager, input) {
         const namespace = input.namespace || "default";
         const watch = input.watch || false;
         const context = input.context || "";
+        // The schema enums are not enforced at runtime, so the positional
+        // operands get the same flag-shape check as every other tool.
+        assertNotFlagLike(input.subCommand, "subCommand");
+        assertNotFlagLike(input.resourceType, "resourceType");
+        assertNotFlagLike(input.name, "name");
         const command = "kubectl";
         const args = [
             "rollout",

package/dist/tools/node-management.js

@@ -5,7 +5,7 @@
  * and confirmation requirements for destructive operations.
  * Note: Use kubectl_get with resourceType="nodes" to list nodes.
  */
-import { execFileSyncSafe } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, execFileSyncSafe, } from "../security/kubectl-flags.js";
 import { getSpawnMaxBuffer } from "../config/max-buffer.js";
 /**
  * Schema for node_management tool.
@@ -126,6 +126,9 @@ const getNodeStatus = (nodeName) => {
 export async function nodeManagement(params) {
     const { operation, nodeName, force = false, gracePeriod = -1, deleteLocalData = false, ignoreDaemonsets = true, timeout = "0", dryRun = false, confirmDrain = false, } = params;
     try {
+        // The node name is a positional operand of cordon/drain/uncordon; a
+        // leading "-" would make kubectl parse it as a flag.
+        assertNotFlagLike(nodeName, "nodeName");
         switch (operation) {
             case "cordon":
                 return handleCordonNode(nodeName);

package/dist/tools/port_forward.js

@@ -1,6 +1,6 @@
 import { spawn } from "child_process";
 import { McpError } from "@modelcontextprotocol/sdk/types.js";
-import { assertSafeArgv } from "../security/kubectl-flags.js";
+import { assertNotFlagLike, assertSafeArgv, } from "../security/kubectl-flags.js";
 // Use spawn instead of exec because port-forward is a long-running process
 async function executePortForward(args) {
     // port_forward uses spawn (long-running process) rather than the shared
@@ -60,6 +60,9 @@ export const PortForwardSchema = {
     },
 };
 export async function startPortForward(k8sManager, input) {
+    // resourceType leads the "<type>/<name>" operand, so a leading "-" would
+    // make kubectl parse the whole operand as a flag.
+    assertNotFlagLike(input.resourceType, "resourceType");
     const args = ["port-forward"];
     if (input.namespace) {
         args.push("-n", input.namespace);

package/dist/utils/temp-file.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Write `contents` to a new file named `name` inside a fresh private temp
+ * directory and return the file's path. Release it with removeTempFile.
+ */
+export declare function writeTempFile(name: string, contents: string): string;
+/**
+ * Remove a file created by writeTempFile, along with its private directory.
+ * Never throws: a failed cleanup is logged, not surfaced to the caller.
+ */
+export declare function removeTempFile(file: string): void;

package/dist/utils/temp-file.js

@@ -0,0 +1,46 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+// Tools hand kubectl/helm client-supplied content (manifests, patches, values)
+// through a file. The shared temp directory is writable by every local user,
+// so the file goes in a fresh directory of its own: mkdtemp picks an
+// unpredictable name and creates it 0700, so no one else can read the file or
+// stage anything at its path. The exclusive create ("wx") makes a path that
+// somehow already exists an error rather than a file — or a symlink — to
+// write through.
+/**
+ * Write `contents` to a new file named `name` inside a fresh private temp
+ * directory and return the file's path. Release it with removeTempFile.
+ */
+export function writeTempFile(name, contents) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "mcp-k8s-"));
+    const file = path.join(dir, name);
+    try {
+        fs.writeFileSync(file, contents, { flag: "wx", mode: 0o600 });
+    }
+    catch (err) {
+        fs.rmSync(dir, { recursive: true, force: true });
+        throw err;
+    }
+    return file;
+}
+/**
+ * Remove a file created by writeTempFile, along with its private directory.
+ * Never throws: a failed cleanup is logged, not surfaced to the caller.
+ */
+export function removeTempFile(file) {
+    const dir = path.dirname(file);
+    // Only ever remove a directory writeTempFile made: a caller-supplied path
+    // reaching here by mistake must not take its parent directory with it.
+    if (path.dirname(dir) !== os.tmpdir() ||
+        !path.basename(dir).startsWith("mcp-k8s-")) {
+        console.warn(`Refusing to remove ${file}: not a writeTempFile path`);
+        return;
+    }
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch (err) {
+        console.warn(`Failed to delete temporary file ${file}: ${err}`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "4.1.8",
+  "version": "4.1.10",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",
@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "@kubernetes/client-node": "1.3.0",
-    "@modelcontextprotocol/sdk": "1.26.0",
+    "@modelcontextprotocol/sdk": "1.32.0",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/auto-instrumentations-node": "0.77.0",
     "@opentelemetry/exporter-trace-otlp-grpc": "0.219.0",