sum-mcp-server

The HTTP transport sets `Access-Control-Allow-Origin: *`, which enables broad CORS access. While potentially acceptable for internal or CLI-driven use, exposing this directly to the internet without additional security layers (e.g., API Gateway, more specific CORS policies, authentication/authorization) could be a significant risk, as it manages Kubernetes clusters. The generic resource operations pass user-provided API versions, resources, namespaces, and names directly to the Kubernetes API, meaning the server's effective permissions are those of the configured kubeconfig(s). Compromising this server would grant broad access to the configured Kubernetes clusters.