kubemcp

The server uses `@kubernetes/client-node` for API interaction, loading kubeconfig from standard locations or custom paths, which relies on host-level RBAC for security. It explicitly handles sensitive data by not returning raw secret data and redacting it from audit logs. Destructive operations are protected by dry-run mode and explicit confirmation requirements, with all actions logged for auditing. No 'eval' or obvious obfuscation techniques are used. Communication with the MCP client occurs over stdio, limiting external network exposure from the server itself. Overall, good security practices are implemented within its operational scope.