Flux159/mcp-server-kubernetes

AI review

This MCP server provides full Kubernetes cluster management, including destructive operations like pod exec, apply, delete, and Helm chart management. It reads sensitive credentials (kubeconfig, tokens, CA data) from environment variables and passes them to subprocesses, which could lead to credential exfiltration if the agent is prompt-injected. The CI pipeline downloads and executes a remote script (get-helm-3) without integrity verification, introducing supply chain risk.

• high Remote code execution in CI pipeline — In .github/workflows/ci.yml:31, the workflow runs `curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash`, which downloads and executes a shell script from a remote URL without checksum or signature verification. This could be exploited if the upstream repository is compromised, injecting malicious code into the CI environment.
• high Credential exposure via environment variables to subprocesses — Multiple tool files (e.g., exec_in_pod.ts, helm-operations.ts, kubectl-apply.ts) pass `{ ...process.env, KUBECONFIG: process.env.KUBECONFIG }` to child processes. This forwards all environment variables, including sensitive credentials like K8S_TOKEN, KUBECONFIG_YAML, and K8S_CA_DATA, to spawned kubectl and helm processes. If an attacker can control the command arguments (e.g., via prompt injection leading to arbitrary kubectl exec), they could exfiltrate these credentials.
• high Deceptive tool descriptions allow arbitrary command execution — The `exec_in_pod` tool allows running arbitrary commands inside a pod, and `kubectl_generic` allows arbitrary kubectl commands. While these are documented, their descriptions may not clearly convey the full risk of remote code execution and credential access. Combined with the environment variable forwarding, this creates a high-risk attack surface for prompt injection.
• medium Unsafe kubectl flags allowed via environment variable — In src/security/kubectl-flags.ts:79, the server checks `process.env.ALLOW_KUBECTL_UNSAFE_FLAGS === 'true'` to permit potentially dangerous kubectl flags. If enabled, this could allow an attacker to bypass security controls (e.g., `--insecure-skip-tls-verify`) or execute arbitrary code via kubectl plugins.
• low Telemetry configuration reads sensitive environment variables — In src/config/telemetry-config.ts:31, the server reads `process.env.OTEL_TRACES_SAMPLER` and likely other OpenTelemetry environment variables. While not directly exfiltrating data, telemetry could inadvertently capture sensitive information if traces include command arguments or environment details.

Model: deepseek-chat

Static findings