juju-mcp

The `exec_workload_command` tool, when not in read-only mode, allows arbitrary shell commands to be executed on workload containers via `kubectl exec -- /bin/sh -c {command}`. This poses a severe command injection risk, enabling remote code execution within the Juju environment. Additionally, `read_workload_file` constructs a Python script string with user-provided `file_path` and `container_name`, which could potentially be exploited through complex string injection if not adequately escaped by `juju ssh` or Pebble's API. The server also relies heavily on `juju` and `kubectl` binaries, operating with the privileges of the user running the server, making robust input sanitization crucial for all tool parameters. Running in `--read-only` mode mitigates some risks, but the fundamental `exec_workload_command` vulnerability exists if not enabled.