kubernetes-mcp-server

The server is implemented in Go, directly interacting with the Kubernetes API, which is generally more secure than shell-based wrappers. It features robust OAuth/OIDC authentication with token exchange capabilities, can enforce read-only operation, and allows disabling destructive tools. A critical security feature is the `AccessControlRoundTripper` which enables fine-grained denial of specific Kubernetes resources at the API proxy level, regardless of the ServiceAccount's broader permissions. Deployment guides recommend using dedicated, least-privileged ServiceAccounts. Sensitive data redaction in logs is also implemented. The main binaries are distributed via npm/PyPI wrappers that `spawn` the native Go executable, which is a common and acceptable pattern for such distributions. No direct 'eval' or obvious malicious patterns were found.