mcp-k8s-go

The server provides powerful tools like 'apply-k8s-resource' for applying arbitrary YAML manifests and 'k8s-pod-exec' for executing commands in pods, which inherently carry significant security risks if exposed to untrusted users or contexts. Additionally, the 'get-k8s-resource' tool allows executing user-provided Go templates, introducing a potential template injection vulnerability. However, the `--allowed-contexts` and `--readonly` command-line flags offer crucial mechanisms to restrict access and modify capabilities, mitigating these risks when properly configured. The `--mask-secrets` flag is enabled by default to protect sensitive data.