kubeagentics-catalog

The catalog itself is a static JSON file and inherently safe to process. However, the MCP server definitions within it specify 'command' fields that use 'npx' to execute external npm packages (e.g., '@anthropic/mcp-server-prometheus'). This means the consuming application (KubeAgentics) would download and run arbitrary code from npm. This introduces a supply chain security risk if a listed npm package is compromised or if a malicious entry is added to the catalog, as the executed package would have full access to the host environment. No 'eval' or obfuscation is present in this repository's own files, nor are any secrets hardcoded for the catalog's operation.