cnpg-mcp

The server employs robust security practices, including comprehensive OIDC/OAuth2 authentication (JWT bearer token validation, JWKS discovery), and careful handling of secrets via Kubernetes Secret mounts. Input validation is enforced using Pydantic models and explicit RFC 1123 checks for resource names. RBAC roles are clearly defined, leveraging CloudNativePG's existing ClusterRoles (e.g., 'edit', 'view') and providing a mechanism for custom roles. Destructive operations (cluster/database deletion) require explicit confirmation. The DCR proxy logic to manage client secrets (capturing, persisting, then stripping from public responses) is designed with security in mind, although inherently complex. No 'eval' or direct shell execution of user input was found. The use of FastAPI and FastMCP provides a secure and well-structured framework.