lumino-mcp-server

The project explicitly enforces a 'read-only' mandate for all MCP tools, significantly reducing the attack surface by preventing modification of cluster state. It leverages standard Kubernetes authentication (in-cluster or kubeconfig) and emphasizes proper RBAC configuration. While `subprocess` is imported (usage not fully visible in truncated code), and external network requests (e.g., to Prometheus) are made, these are common for observability tools. No explicit 'eval' or other direct code injection vulnerabilities were found in the analyzed helper modules, and the dependency management includes `python-dotenv` for secure environment variable handling.