kmcp

The Kubernetes controller component utilizes standard K8s API interactions and applies security best practices like image tag validation and default security contexts (`runAsNonRoot`, `drop: ALL`). It's designed to deploy user-defined container images and commands (via `MCPServer` CRD), making the ultimate security dependent on the user's deployed workload and Kubernetes RBAC. The CLI component executes various system commands (`helm`, `kubectl`, `docker`, `npx`, `uv`, `go`, `mvn`) locally, requiring the user to have these tools installed and configured securely. A built-in sanitizer helps redact sensitive information in CLI output. No `eval` or arbitrary code execution vulnerabilities were found within the project's own controller or CLI logic.