Is mcp-server-kubernetes safe?

The component can run operating-system commands or spawn processes.

import { type ExecFileSyncOptionsWithStringEncoding } from "child_process";

import { execFileSync, } from "child_process";

import { spawn } from "child_process";

const process = spawn("kubectl", args);

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component writes or deletes files on disk.

fs.writeFileSync(tempKubeconfigPath, kubeconfigYaml, {

fs.unlinkSync(tempKubeconfigPath);

fs.writeFileSync(file, contents, { flag: "wx", mode: 0o600 });

fs.rmSync(dir, { recursive: true, force: true });

fs.rmSync(dir, { recursive: true, force: true });

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component makes outbound network requests.

import http from "http";

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

A short-lived, scoped, assumed identity was detected - an STS AssumeRole / session token, a cloud managed or workload identity, an impersonated service account, a projected Kubernetes service-account token, or a dynamic-secret broker. Tools authenticate with a narrowly-scoped credential that expires, rather than a long-lived embedded service credential.

const serviceAccountPath = "/var/run/secrets/kubernetes.io/serviceaccount/token";

Fix: A scoped, short-lived identity is the smallest-blast-radius execution context. Confirm the assumed role / requested scope grants only the permissions the tool needs, and that the token lifetime is minimal.

An MCP tool surface (manifest or tool definitions) was found.

const server = new Server({

server.setRequestHandler(ListToolsRequestSchema, async () => {

server.setRequestHandler(CallToolRequestSchema, withTelemetry(async (request) => {

const transport = new StdioServerTransport();

const transport = new SSEServerTransport("/messages", res, {

const transport = new StreamableHTTPServerTransport({

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.