openshift-mcp-server

The server executes `oc` commands using `asyncio.create_subprocess_exec`, which is generally safe as arguments are passed as a list, mitigating shell injection risks. However, the `_query_via_route` function uses `curl -k` (insecure) to query Prometheus, disabling TLS certificate validation. This is a security vulnerability that could allow man-in-the-middle attacks if the network path to Prometheus is not fully trusted. Additionally, the `run_oc_debug_node` function allows running arbitrary shell scripts (`bash -c '...'`) on a node, a powerful primitive. While currently only used with hardcoded scripts within `inspect_node_storage_forensics` (making it safe in this context), this function could be a high-risk vector if ever exposed to unsanitized user input.