Kubernetes Manifest Audit

k8s-manifest-audit

k8s-manifest-audit — static audit of Kubernetes manifests via MCP. Powered by kube-linter. Part of the Unbearable Labs audit shop.

Built by Unbearable Labs. Pay-per-event pricing — only billed when a tool is actually called.

---

What it does

Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a Kubernetes manifest or directory of manifests, get back a structured report:

• Severity — high / medium / low / info
• Check ID — kube-linter check name (e.g. privileged-container, unset-cpu-requirements)
• Category — security / resources / availability / network / rbac / images / config
• Message — what kube-linter found and where
• Remediation hint — what to do about it
• Object location — kind, name, namespace of the offending resource

63 checks total (31 enabled by default). Covers Deployment, Service, Ingress, ConfigMap, Secret, StatefulSet, DaemonSet, Job, CronJob, NetworkPolicy, RBAC, HPA, PDB, and more.

Tools

Tool	Pricing	Purpose
audit_manifest(yaml_content)	$0.02	Audit a single YAML string (may contain multi-doc ---)
audit_directory(files)	$0.02	Audit multiple files — cross-file checks work correctly
list_checks(enabled_only=False)	$0.005	Browse the full 63-check catalog with severity + category
explain_check(check_id)	$0.005	Get description + remediation for one specific check

Quick start

{
  "mcpServers": {
    "k8s-manifest-audit": {
      "url": "https://unbearable-dev--k8s-manifest-audit.apify.actor/mcp",
      "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
    }
  }
}

Check catalog (sample — 63 checks total)

Check ID	Category	Severity (mapped)
privileged-container	security	high
privilege-escalation-container	security	high
run-as-non-root	security	high
env-var-secret	security	high
host-pid / host-ipc / host-network	security	high
wildcard-in-rules	rbac	high
cluster-admin-role-binding	rbac	high
unset-cpu-requirements	resources	medium
unset-memory-requirements	resources	medium
no-liveness-probe / no-readiness-probe	availability	medium
latest-tag	images	medium
minimum-three-replicas	availability	medium
no-rolling-update-strategy	availability	medium
dangling-service / dangling-ingress	config	low
use-namespace	config	low

Use list_checks to get the full, up-to-date catalog.

Pricing

Event	USD
audit_manifest or audit_directory call	$0.02
list_checks or explain_check call	$0.005

Powered by kube-linter (MIT, StackRox/Red Hat).

---

Built by Noel @ Unbearable Labs — more like this in the weekly newsletter.