k8s-mcp-server

The server uses standard Go client libraries for Kubernetes and Helm, which are generally robust. Authentication methods leverage secure practices (env vars, in-cluster service accounts, kubeconfig files). A critical security feature is the '--read-only' flag, which disables all write operations. The primary security considerations are proper RBAC configuration for the server's Kubernetes identity and ensuring the server's HTTP/stdio endpoints are not exposed to untrusted sources, as the server can perform powerful cluster operations. There are no obvious signs of 'eval' or direct command injection of untrusted strings.