k8s-manifest-audit

k8s-manifest-audit — static audit of Kubernetes manifests via MCP. Powered by kube-linter. Part of the Unbearable Labs audit shop.

Built by Unbearable Labs. Pay-per-event pricing — only billed when a tool is actually called.

What it does

Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a Kubernetes manifest or directory of manifests, get back a structured report:

• Severity — high / medium / low / info

• Check ID — kube-linter check name (e.g. privileged-container, unset-cpu-requirements)

• Category — security / resources / availability / network / rbac / images / config

• Message — what kube-linter found and where

• Remediation hint — what to do about it

• Object location — kind, name, namespace of the offending resource

63 checks total (31 enabled by default). Covers Deployment, Service, Ingress, ConfigMap, Secret, StatefulSet, DaemonSet, Job, CronJob, NetworkPolicy, RBAC, HPA, PDB, and more.

Related MCP server: gke-cred-audit

Tools

Quick start

{
  "mcpServers": {
    "k8s-manifest-audit": {
      "url": "https://unbearable-dev--k8s-manifest-audit.apify.actor/mcp",
      "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
    }
  }
}

Check catalog (sample — 63 checks total)

Use list_checks to get the full, up-to-date catalog.

Pricing

Powered by kube-linter (MIT, StackRox/Red Hat).

Built by Noel @ Unbearable Labs — more like this in the weekly newsletter.