⚠️ This snapshot is over 30 days old — treat the grade as stale until the next refresh. Re-scan locally to verify.
Trust Card · Static snapshot
Flux159__mcp-server-kubernetes U
Ungraded — insufficient static coverage · 2 findings (0 critical) · scope excessive · Not ranked: insufficient static coverage.
Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream Flux159/mcp-server-kubernetes @ b2e82de (2026-10-14)
Score breakdown
No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.
Insufficient static coverage: Unsupported source present; Symlinks or special files were not examined. Findings remain actionable; absence of findings is not evidence of safety.
Coverage: limited
Static-heuristic scope: 125 analyzed / 145 discovered files; 5 unsupported source files; 22 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.
- Unsupported source present
- Symlinks or special files were not examined
- Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
- Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
- Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
- Ignored directories, declarations, and non-implementation assets are outside rule scope.
File coverage, applied rules and scan limits
{
"mode": "static-heuristic",
"status": "limited",
"reasons": [
"Unsupported source present",
"Symlinks or special files were not examined"
],
"limitations": [
"Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
"Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
"Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
"Ignored directories, declarations, and non-implementation assets are outside rule scope."
],
"discoveredFiles": 145,
"analyzedFiles": [
{
"path": ".github/workflows/cd.yml",
"scope": "data",
"bytes": 5295,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/ci.yml",
"scope": "data",
"bytes": 2534,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/star-history.yml",
"scope": "data",
"bytes": 1095,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".vscode/extensions.json",
"scope": "data",
"bytes": 52,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".vscode/settings.json",
"scope": "data",
"bytes": 34,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "gemini-extension.json",
"scope": "data",
"bytes": 189,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/Chart.yaml",
"scope": "data",
"bytes": 430,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/aws-irsa-example.yaml",
"scope": "data",
"bytes": 3112,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/aws-multi-cluster.yaml",
"scope": "data",
"bytes": 3885,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/custom-kubeconfig.yaml",
"scope": "data",
"bytes": 10263,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/gcp-workload-identity.yaml",
"scope": "data",
"bytes": 3341,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/generic-kubeconfig.yaml",
"scope": "data",
"bytes": 5712,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/production-complete.yaml",
"scope": "data",
"bytes": 7280,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/secure-networkpolicy.yaml",
"scope": "data",
"bytes": 5344,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/examples/url-kubeconfig.yaml",
"scope": "data",
"bytes": 6675,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/configmap.yaml",
"scope": "data",
"bytes": 6748,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/deployment.yaml",
"scope": "data",
"bytes": 11300,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/hpa.yaml",
"scope": "data",
"bytes": 1737,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/ingress.yaml",
"scope": "data",
"bytes": 2463,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/networkpolicy-tests.yaml",
"scope": "data",
"bytes": 7746,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/networkpolicy.yaml",
"scope": "data",
"bytes": 6875,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/poddisruptionbudget.yaml",
"scope": "data",
"bytes": 990,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/rbac.yaml",
"scope": "data",
"bytes": 1616,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/secret-auth.yaml",
"scope": "data",
"bytes": 490,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/service.yaml",
"scope": "data",
"bytes": 921,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/serviceaccount.yaml",
"scope": "data",
"bytes": 669,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/tests/test-connectivity.yaml",
"scope": "data",
"bytes": 1970,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/tests/test-kubeconfig.yaml",
"scope": "data",
"bytes": 5165,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/tests/test-mcp-tools.yaml",
"scope": "data",
"bytes": 2911,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/templates/tests/test-scripts-configmap.yaml",
"scope": "data",
"bytes": 4100,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/values.schema.json",
"scope": "data",
"bytes": 10748,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "helm-chart/values.yaml",
"scope": "data",
"bytes": 20002,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "manifest.json",
"scope": "data",
"bytes": 4824,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "package.json",
"scope": "data",
"bytes": 1716,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "scripts/update-version.js",
"scope": "code",
"bytes": 2492,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "server.json",
"scope": "data",
"bytes": 6683,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "src/config/cleanup-config.ts",
"scope": "code",
"bytes": 221,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/config/container-templates.ts",
"scope": "code",
"bytes": 3618,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/config/deployment-config.ts",
"scope": "code",
"bytes": 2223,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/config/max-buffer.ts",
"scope": "code",
"bytes": 114,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/config/namespace-config.ts",
"scope": "code",
"bytes": 177,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/config/server-config.ts",
"scope": "code",
"bytes": 141,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/config/telemetry-config.ts",
"scope": "code",
"bytes": 5960,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/index.ts",
"scope": "code",
"bytes": 17253,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/middleware/telemetry-middleware.ts",
"scope": "code",
"bytes": 7416,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/models/common-parameters.ts",
"scope": "code",
"bytes": 471,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/models/helm-models.ts",
"scope": "code",
"bytes": 857,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/models/kubectl-models.ts",
"scope": "code",
"bytes": 531,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/models/resource-models.ts",
"scope": "code",
"bytes": 959,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/models/response-schemas.ts",
"scope": "code",
"bytes": 3666,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/models/tool-models.ts",
"scope": "code",
"bytes": 349,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/prompts/index.ts",
"scope": "code",
"bytes": 5520,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/resources/handlers.ts",
"scope": "code",
"bytes": 3618,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/security/kubectl-flags.ts",
"scope": "code",
"bytes": 17787,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/security/transport.ts",
"scope": "code",
"bytes": 986,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/exec_in_pod.ts",
"scope": "code",
"bytes": 5767,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/helm-operations.ts",
"scope": "code",
"bytes": 15254,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-apply.ts",
"scope": "code",
"bytes": 4906,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-context.ts",
"scope": "code",
"bytes": 11604,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-create.ts",
"scope": "code",
"bytes": 17433,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-delete.ts",
"scope": "code",
"bytes": 8002,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-describe.ts",
"scope": "code",
"bytes": 4029,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-generic.ts",
"scope": "code",
"bytes": 5744,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-get.ts",
"scope": "code",
"bytes": 18121,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-logs.ts",
"scope": "code",
"bytes": 13634,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-operations.ts",
"scope": "code",
"bytes": 4324,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-patch.ts",
"scope": "code",
"bytes": 5918,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-reconnect.ts",
"scope": "code",
"bytes": 1159,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-rollout.ts",
"scope": "code",
"bytes": 4791,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/kubectl-scale.ts",
"scope": "code",
"bytes": 3286,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/node-management.ts",
"scope": "code",
"bytes": 10423,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/ping.ts",
"scope": "code",
"bytes": 351,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/tools/port_forward.ts",
"scope": "code",
"bytes": 5154,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/types.ts",
"scope": "code",
"bytes": 305,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/allowed-hosts.ts",
"scope": "code",
"bytes": 2693,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/auth.ts",
"scope": "code",
"bytes": 2320,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/kubernetes-manager.ts",
"scope": "code",
"bytes": 13826,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/sse.ts",
"scope": "code",
"bytes": 4556,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/utils/streamable-http.ts",
"scope": "code",
"bytes": 5924,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/allowed-hosts.unit.test.ts",
"scope": "code",
"bytes": 2522,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/allowed_tools_validation.unit.test.ts",
"scope": "code",
"bytes": 1238,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/auth.test.ts",
"scope": "code",
"bytes": 3547,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/configmap.test.ts",
"scope": "code",
"bytes": 11018,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/context-helper.ts",
"scope": "code",
"bytes": 321,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/contexts.test.ts",
"scope": "code",
"bytes": 10778,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/cronjob.test.ts",
"scope": "code",
"bytes": 10755,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/current_context.test.ts",
"scope": "code",
"bytes": 3865,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/dns-rebinding.test.ts",
"scope": "code",
"bytes": 9731,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/exec_in_pod.test.ts",
"scope": "code",
"bytes": 10052,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/helm-argument-injection.unit.test.ts",
"scope": "code",
"bytes": 3287,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/helm-operations.test.ts",
"scope": "code",
"bytes": 6559,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/helm.test.ts",
"scope": "code",
"bytes": 16329,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-context.unit.test.ts",
"scope": "code",
"bytes": 11534,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-create-from-file.unit.test.ts",
"scope": "code",
"bytes": 3521,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-flags-security.unit.test.ts",
"scope": "code",
"bytes": 20094,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-generic-file-read.unit.test.ts",
"scope": "code",
"bytes": 4578,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-generic.test.ts",
"scope": "code",
"bytes": 10204,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-get-secrets.test.ts",
"scope": "code",
"bytes": 15282,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-get.unit.test.ts",
"scope": "code",
"bytes": 2830,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-logs.unit.test.ts",
"scope": "code",
"bytes": 5747,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-patch.test.ts",
"scope": "code",
"bytes": 8232,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-reconnect.unit.test.ts",
"scope": "code",
"bytes": 1448,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-rollout.test.ts",
"scope": "code",
"bytes": 12747,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl-unified.test.ts",
"scope": "code",
"bytes": 33788,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubectl.test.ts",
"scope": "code",
"bytes": 12932,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/kubernetes-manager.test.ts",
"scope": "code",
"bytes": 25006,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/namespace.test.ts",
"scope": "code",
"bytes": 6251,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/node-management.test.ts",
"scope": "code",
"bytes": 7248,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/non_destructive_tools.test.ts",
"scope": "code",
"bytes": 3519,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/port-helper.ts",
"scope": "code",
"bytes": 731,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/port_forward.test.ts",
"scope": "code",
"bytes": 6111,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/positional-flag-injection.unit.test.ts",
"scope": "code",
"bytes": 5513,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/prompts.test.ts",
"scope": "code",
"bytes": 2016,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/remote-transport-path-reads.unit.test.ts",
"scope": "code",
"bytes": 3641,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/server-config.test.ts",
"scope": "code",
"bytes": 440,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/service.test.ts",
"scope": "code",
"bytes": 30311,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/set_current_context.test.ts",
"scope": "code",
"bytes": 5621,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/sse.test.ts",
"scope": "code",
"bytes": 7811,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/streaming_http.test.ts",
"scope": "code",
"bytes": 3373,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/telemetry-config.test.ts",
"scope": "code",
"bytes": 12826,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/telemetry-integration.test.ts",
"scope": "code",
"bytes": 8136,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/tool_restriction_enforcement.test.ts",
"scope": "code",
"bytes": 3910,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/unit.test.ts",
"scope": "code",
"bytes": 28055,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tsconfig.json",
"scope": "data",
"bytes": 372,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "vitest.config.ts",
"scope": "code",
"bytes": 1001,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
}
],
"unsupportedSourceFiles": [
".mcpbignore",
"CITATION.cff",
"Dockerfile",
"bun.lockb",
"helm-chart/templates/_helpers.tpl"
],
"excludedFiles": [
{
"path": ".git",
"reason": "ignored-directory"
},
{
"path": "AGENTS.md",
"reason": "non-regular-file"
},
{
"path": ".gitignore",
"reason": "outside-rule-scope"
},
{
"path": ".mcpbignore",
"reason": "unsupported-implementation"
},
{
"path": "ADVANCED_README.md",
"reason": "outside-rule-scope"
},
{
"path": "CITATION.cff",
"reason": "unsupported-implementation"
},
{
"path": "CLAUDE.md",
"reason": "outside-rule-scope"
},
{
"path": "CONTRIBUTING.md",
"reason": "outside-rule-scope"
},
{
"path": "Dockerfile",
"reason": "unsupported-implementation"
},
{
"path": "LICENSE",
"reason": "outside-rule-scope"
},
{
"path": "README.md",
"reason": "outside-rule-scope"
},
{
"path": "SECURITY.md",
"reason": "outside-rule-scope"
},
{
"path": "bun.lockb",
"reason": "unsupported-implementation"
},
{
"path": "docs/OBSERVABILITY.md",
"reason": "outside-rule-scope"
},
{
"path": "docs/helm-install.md",
"reason": "outside-rule-scope"
},
{
"path": "docs/helm-template-apply.md",
"reason": "outside-rule-scope"
},
{
"path": "docs/node-management.md",
"reason": "outside-rule-scope"
},
{
"path": "docs/pod-cleanup.md",
"reason": "outside-rule-scope"
},
{
"path": "helm-chart/README.md",
"reason": "outside-rule-scope"
},
{
"path": "helm-chart/templates/NOTES.txt",
"reason": "outside-rule-scope"
},
{
"path": "helm-chart/templates/_helpers.tpl",
"reason": "unsupported-implementation"
},
{
"path": "icon.png",
"reason": "outside-rule-scope"
}
],
"readErrors": [],
"truncation": [],
"limits": {
"maxFiles": 4000,
"maxDepth": 12,
"maxFileBytes": 1048576
}
}Fix first (2 critical/high)
| Severity | Rule | Finding | Remediation |
|---|---|---|---|
| HIGH | AT-SEC-005 (ASI02) | Unrestricted Recursive File Deletion / Modificationsrc/utils/kubernetes-manager.ts:435Evidence: fs.unlinkSync(tempKubeconfigPath); | Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions. |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresstests/streaming_http.test.ts:83Evidence: const postResponse = await fetch(url, { | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
Permissions
Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: none
Provenance
License: MIT · Lockfile: no · Security policy: yes · Signals: unverified origin
Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/Flux159/mcp-server-kubernetes. Scores move with every upstream commit; pages refresh weekly. How scoring works.