mcp-container-tools

The server directly executes shell commands (e.g., `docker exec sh -c <command>`, `kubectl exec sh -c <command>`) using `subprocess.create_subprocess_exec` with user-provided arguments. This poses a critical command injection vulnerability if the MCP server receives input from an untrusted source, allowing arbitrary code execution on the host or within target containers/pods. Additionally, file operations (`read_file`, `list_directory`) can access arbitrary paths, and Kusto queries are constructed with f-strings, potentially leading to path traversal or query injection. While environment variables are filtered for sensitive patterns, this is a mitigating control, not a complete solution. Running this server requires a high degree of trust in the client interacting with it.