# MCP DevOps Toolbox

A small MCP-style JSON-lines server for safe, local DevOps inspection. It has no cloud or external
API dependency. Maintained by [Prashant Rajguru](https://github.com/prashantyr)
([email](mailto:rajguru.prashant@gmail.com)).

```mermaid
flowchart LR
  C[MCP-style client] -->|strict JSON line| S[Tool router]
  S --> P[Path allowlist]
  P --> G[Read-only Git]
  P --> K[Kubernetes YAML validator]
  P --> T[Terraform plan summary]
  P --> L[Sanitized log analysis]
```

## Quickstart

Requires Node 22.12+ and Git.

```bash
npm ci
npm run check
TOOLBOX_ROOT="$PWD" npm start
```

Request and sample response:

```text
{"id":1,"tool":"validate_kubernetes","arguments":{"manifest":"examples/pod.yaml"}}
{"id":1,"result":[{"document":1,"valid":true,"errors":[]}]}
```

Tools accept strict schemas and only canonical paths beneath `TOOLBOX_ROOT`. Git commands are fixed,
argument-separated and read-only. Terraform input is an already-generated `terraform show -json`
file. Log output is bounded and common credentials are redacted.

## Security

Run as an unprivileged user against a narrow dedicated root. Symlink resolution prevents directory
escape. This process does not invoke shells or Kubernetes/Terraform CLIs. Redaction is defensive,
not a data-loss-prevention boundary; do not feed it secrets or expose stdin/stdout to untrusted
networks.

## Status and limitations

Portfolio/reference status, not a complete MCP protocol SDK implementation. Kubernetes validation
checks document shape, not OpenAPI schemas or admission policy. Log classification is heuristic.
Terraform summaries trust valid JSON and do not evaluate policy or provider behavior.

## License

MIT © 2026 Prashant Rajguru.