Kubernetes Manifest Audit
kube-linter audit for Kubernetes manifests — 63 checks: security, availability, RBAC, network.
Que pouvez-vous faire avec Kubernetes Manifest Audit ?
- Severity — high / medium / low / info
- Check ID — kube-linter check name (e.g.
privileged-container,unset-cpu-requirements) - Category — security / resources / availability / network / rbac / images / config
- Message — what kube-linter found and where
- Remediation hint — what to do about it
- Object location — kind, name, namespace of the offending resource
Installation
Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).
claude mcp add --transport http kubernetes-manifest-audit 'https://unbearable-dev--k8s-manifest-audit.apify.actor/mcp' --header 'Authorization: <Apify API token. Format: '\''Bearer <YOUR_APIFY_TOKEN>'\''. Get yours at https://console.apify.com/account/integrations>'{
"mcpServers": {
"kubernetes-manifest-audit": {
"type": "http",
"url": "https://unbearable-dev--k8s-manifest-audit.apify.actor/mcp",
"headers": {
"Authorization": "<Apify API token. Format: 'Bearer <YOUR_APIFY_TOKEN>'. Get yours at https://console.apify.com/account/integrations>"
}
}
}
}Documentation
Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.
Sommaire
k8s-manifest-audit
k8s-manifest-audit — static audit of Kubernetes manifests via MCP. Powered by kube-linter. Part of the Unbearable Labs audit shop.
Built by Unbearable Labs. Pay-per-event pricing — only billed when a tool is actually called.
What it does
Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a Kubernetes manifest or directory of manifests, get back a structured report:
- Severity — high / medium / low / info
- Check ID — kube-linter check name (e.g.
privileged-container,unset-cpu-requirements) - Category — security / resources / availability / network / rbac / images / config
- Message — what kube-linter found and where
- Remediation hint — what to do about it
- Object location — kind, name, namespace of the offending resource
63 checks total (31 enabled by default). Covers Deployment, Service, Ingress, ConfigMap, Secret, StatefulSet, DaemonSet, Job, CronJob, NetworkPolicy, RBAC, HPA, PDB, and more.
Tools
| Tool | Pricing | Purpose |
|---|---|---|
audit_manifest(yaml_content) | $0.02 | Audit a single YAML string (may contain multi-doc ---) |
audit_directory(files) | $0.02 | Audit multiple files — cross-file checks work correctly |
list_checks(enabled_only=False) | $0.005 | Browse the full 63-check catalog with severity + category |
explain_check(check_id) | $0.005 | Get description + remediation for one specific check |
Quick start
{
"mcpServers": {
"k8s-manifest-audit": {
"url": "https://unbearable-dev--k8s-manifest-audit.apify.actor/mcp",
"headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
}
}
}Check catalog (sample — 63 checks total)
| Check ID | Category | Severity (mapped) |
|---|---|---|
privileged-container | security | high |
privilege-escalation-container | security | high |
run-as-non-root | security | high |
env-var-secret | security | high |
host-pid / host-ipc / host-network | security | high |
wildcard-in-rules | rbac | high |
cluster-admin-role-binding | rbac | high |
unset-cpu-requirements | resources | medium |
unset-memory-requirements | resources | medium |
no-liveness-probe / no-readiness-probe | availability | medium |
latest-tag | images | medium |
minimum-three-replicas | availability | medium |
no-rolling-update-strategy | availability | medium |
dangling-service / dangling-ingress | config | low |
use-namespace | config | low |
Use list_checks to get the full, up-to-date catalog.
Pricing
| Event | USD |
|---|---|
audit_manifest or audit_directory call | $0.02 |
list_checks or explain_check call | $0.005 |
Powered by kube-linter (MIT, StackRox/Red Hat).
Built by Noel @ Unbearable Labs — more like this in the weekly newsletter.
Questions fréquentes
Qu'est-ce que Kubernetes Manifest Audit ?
kube-linter audit for Kubernetes manifests — 63 checks: security, availability, RBAC, network.
Comment installer Kubernetes Manifest Audit ?
Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http kubernetes-manifest-audit 'https://unbearable-dev--k8s-manifest-audit.apify.actor/mcp' --header 'Authorization: <Apify API token. Format: '\''Bearer <YOUR_APIFY_TOKEN>'\''. Get yours at https://console.apify.com/account/integrations>'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.
Faut-il une clé API pour Kubernetes Manifest Audit ?
Oui. Il attend Authorization, à renseigner dans sa configuration.
Kubernetes Manifest Audit est-il open source ?
Son code est public sur GitHub, mais le dépôt ne déclare pas de licence standard.
Qui maintient Kubernetes Manifest Audit ?
Il est publié par UnbearableDev. AI.tn le référence sans le maintenir ni le recommander.
Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.