loading…
Train LLMs to generate and use tools for Kubernetes security auditing, RBAC analysis, misconfiguration detection, workload vulnerabilities, network-policy checks, secrets exposure, and cluster threat investigation.
/api/mcp/srv-k8s-securityMCP enable + token are only for calling from an external client — the playground below needs neither.
Analyze RBAC configurations for privilege escalation risks, excessive permissions, and compliance violations
{
"type": "object",
"required": [],
"properties": {
"namespace": {
"type": "string"
},
"risk_level": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"subject_type": {
"enum": [
"user",
"serviceaccount",
"group",
"all"
],
"type": "string"
},
"include_cluster_roles": {
"type": "boolean",
"default": true
},
"check_privilege_escalation": {
"type": "boolean",
"default": true
}
}
}Analyzes Kubernetes RBAC configurations to identify overprivileged accounts, unused permissions, and potential privilege escalation paths
{
"type": "object",
"required": [],
"properties": {
"namespace": {
"type": "string"
},
"risk_level": {
"enum": [
"high",
"medium",
"low"
],
"type": "string"
},
"unused_days": {
"type": "integer",
"default": 30
},
"subject_name": {
"type": "string"
},
"subject_type": {
"enum": [
"user",
"serviceaccount",
"group"
],
"type": "string"
},
"include_cluster_roles": {
"type": "boolean",
"default": true
}
}
}Create and track security incident from detected threats or policy violations
{
"type": "object",
"required": [
"title",
"severity",
"incident_type",
"affected_resources"
],
"properties": {
"title": {
"type": "string"
},
"assignee": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"description": {
"type": "string"
},
"incident_type": {
"enum": [
"malware",
"data-breach",
"policy-violation",
"privilege-escalation",
"lateral-movement"
],
"type": "string"
},
"affected_resources": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Queries runtime security events and behavioral anomalies across Kubernetes workloads using detection rules and ML models
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"query": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"namespace": {
"type": "string"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"threat_types": {
"type": "array",
"items": {
"enum": [
"privilege-escalation",
"lateral-movement",
"data-exfiltration",
"crypto-mining",
"suspicious-network",
"file-integrity"
],
"type": "string"
}
}
}
}Generate compliance reports for security frameworks like CIS Kubernetes Benchmark, NSA/CISA guidelines, or SOC2
{
"type": "object",
"required": [
"framework"
],
"properties": {
"framework": {
"enum": [
"cis-kubernetes",
"nsa-cisa",
"soc2",
"pci-dss",
"custom"
],
"type": "string"
},
"namespaces": {
"type": "array",
"items": {
"type": "string"
}
},
"report_format": {
"enum": [
"pdf",
"json",
"csv",
"html"
],
"type": "string"
},
"severity_filter": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"include_remediation": {
"type": "boolean",
"default": true
}
}
}Generate compliance assessment report for specific security frameworks and standards
{
"type": "object",
"required": [
"cluster_id",
"framework"
],
"properties": {
"framework": {
"enum": [
"cis-k8s",
"nist-800-190",
"pci-dss",
"soc2",
"iso27001"
],
"type": "string"
},
"cluster_id": {
"type": "string"
},
"report_format": {
"enum": [
"json",
"pdf",
"csv"
],
"type": "string",
"default": "json"
},
"include_evidence": {
"type": "boolean",
"default": true
},
"namespace_filter": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Retrieve detailed security event by event ID including audit logs, policy violations, and threat indicators
{
"type": "object",
"required": [
"event_id"
],
"properties": {
"format": {
"enum": [
"json",
"yaml"
],
"type": "string"
},
"event_id": {
"type": "string"
},
"include_context": {
"type": "boolean",
"default": true
}
}
}Retrieves comprehensive security posture assessment for a specific cluster, namespace, or workload including compliance scores and risk metrics
{
"type": "object",
"required": [
"cluster_id"
],
"properties": {
"namespace": {
"type": "string"
},
"cluster_id": {
"type": "string"
},
"workload_name": {
"type": "string"
},
"compliance_framework": {
"type": "array",
"items": {
"enum": [
"cis",
"nist",
"pci-dss",
"soc2"
],
"type": "string"
}
},
"include_recommendations": {
"type": "boolean",
"default": true
}
}
}Execute threat hunting queries across cluster audit logs, runtime events, and network traffic
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"maximum": 10000,
"minimum": 1
},
"query": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"audit-logs",
"runtime-events",
"network-traffic",
"admission-logs"
],
"type": "string"
}
}
}
}Creates and manages security incident investigation workspace with timeline reconstruction, affected resources, and evidence collection for Kubernetes security events
{
"type": "object",
"required": [
"incident_id",
"investigation_type"
],
"properties": {
"assignee": {
"type": "string"
},
"priority": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"event_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"incident_id": {
"type": "string"
},
"time_window": {
"type": "string"
},
"investigation_type": {
"enum": [
"breach",
"compliance",
"anomaly",
"vulnerability"
],
"type": "string"
},
"affected_namespaces": {
"type": "array",
"items": {
"type": "string"
}
}
}
}List active policy violations from admission controllers, OPA Gatekeeper, and security policies
{
"type": "object",
"required": [],
"properties": {
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"namespace": {
"type": "string"
},
"policy_engine": {
"enum": [
"gatekeeper",
"psp",
"admission-controller",
"all"
],
"type": "string",
"default": "all"
},
"violation_status": {
"enum": [
"active",
"resolved",
"ignored",
"all"
],
"type": "string",
"default": "active"
}
}
}List RBAC configurations with excessive permissions and privilege escalation risks
{
"type": "object",
"required": [],
"properties": {
"namespace": {
"type": "string"
},
"risk_level": {
"enum": [
"critical",
"high",
"medium",
"low",
"all"
],
"type": "string",
"default": "high"
},
"principal_type": {
"enum": [
"user",
"serviceaccount",
"group",
"all"
],
"type": "string",
"default": "all"
},
"include_cluster_roles": {
"type": "boolean",
"default": true
}
}
}Lists Kubernetes security policies including NetworkPolicies, PodSecurityPolicies, and admission controller policies with their enforcement status
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"namespace": {
"type": "string"
},
"policy_type": {
"enum": [
"network",
"pod-security",
"admission",
"rbac"
],
"type": "string"
},
"enforcement_status": {
"enum": [
"enforced",
"permissive",
"disabled"
],
"type": "string"
}
}
}Monitor admission controller decisions, policy violations, and blocked deployments in real-time
{
"type": "object",
"required": [],
"properties": {
"action": {
"enum": [
"allow",
"deny",
"mutate"
],
"type": "string"
},
"namespace": {
"type": "string"
},
"controller_type": {
"enum": [
"validating",
"mutating",
"both"
],
"type": "string"
},
"include_mutations": {
"type": "boolean",
"default": false
},
"time_window_minutes": {
"type": "integer",
"maximum": 1440,
"minimum": 5
}
}
}Tracks configuration drift from established security baselines and compliance requirements across Kubernetes clusters and workloads
{
"type": "object",
"required": [
"baseline_id"
],
"properties": {
"time_range": {
"enum": [
"24h",
"7d",
"30d"
],
"type": "string"
},
"baseline_id": {
"type": "string"
},
"cluster_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"drift_threshold": {
"type": "number",
"default": 0.1
},
"include_remediation": {
"type": "boolean",
"default": true
},
"compliance_frameworks": {
"type": "array",
"items": {
"enum": [
"cis",
"nist",
"pci-dss",
"soc2",
"hipaa"
],
"type": "string"
}
}
}
}Isolates a compromised Kubernetes workload by applying network segmentation policies and updating security context
{
"type": "object",
"required": [
"namespace",
"workload_type",
"workload_name",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"namespace": {
"type": "string"
},
"workload_name": {
"type": "string"
},
"workload_type": {
"enum": [
"deployment",
"daemonset",
"statefulset",
"pod"
],
"type": "string"
},
"duration_hours": {
"type": "integer"
},
"isolation_level": {
"enum": [
"network-only",
"full-isolation",
"read-only-fs"
],
"type": "string"
}
}
}Applies automated remediation for a specific security finding such as updating image tags, patching configurations, or applying security policies
{
"type": "object",
"required": [
"finding_id",
"remediation_type"
],
"properties": {
"dry_run": {
"type": "boolean",
"default": true
},
"finding_id": {
"type": "string"
},
"auto_approve": {
"type": "boolean",
"default": false
},
"remediation_type": {
"enum": [
"update-image",
"apply-policy",
"patch-config",
"rotate-secret"
],
"type": "string"
},
"notification_channels": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Apply automated remediation for known vulnerabilities in container images and configurations
{
"type": "object",
"required": [
"vulnerability_id",
"workload_id",
"remediation_action"
],
"properties": {
"workload_id": {
"type": "string"
},
"approve_restart": {
"type": "boolean",
"default": false
},
"vulnerability_id": {
"type": "string"
},
"maintenance_window": {
"type": "string",
"format": "date-time"
},
"remediation_action": {
"enum": [
"patch-image",
"update-config",
"apply-runtime-protection",
"manual-review"
],
"type": "string"
}
}
}Scans Kubernetes workloads and images for known CVEs and security vulnerabilities, returning findings with CVSS scores and remediation guidance
{
"type": "object",
"required": [
"namespace"
],
"properties": {
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"info"
],
"type": "string"
}
},
"namespace": {
"type": "string"
},
"image_filter": {
"type": "string"
},
"include_fixed": {
"type": "boolean",
"default": false
},
"workload_name": {
"type": "string"
},
"workload_type": {
"enum": [
"deployment",
"daemonset",
"statefulset",
"pod",
"job",
"cronjob"
],
"type": "string"
}
}
}Scan Kubernetes workloads for security vulnerabilities and misconfigurations across namespaces
{
"type": "object",
"required": [
"scan_type"
],
"properties": {
"scan_type": {
"enum": [
"vulnerability",
"misconfiguration",
"compliance",
"all"
],
"type": "string"
},
"namespaces": {
"type": "array",
"items": {
"type": "string"
}
},
"workload_types": {
"type": "array",
"items": {
"enum": [
"deployment",
"daemonset",
"statefulset",
"pod",
"job",
"cronjob"
],
"type": "string"
}
},
"severity_threshold": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
}
}Update cluster security baseline configuration including policy enforcement levels and detection rules
{
"type": "object",
"required": [
"baseline_id",
"enforcement_mode"
],
"properties": {
"baseline_id": {
"type": "string"
},
"policy_updates": {
"type": "object",
"properties": {
"network_policies": {
"type": "boolean"
},
"admission_controllers": {
"type": "boolean"
},
"pod_security_standards": {
"type": "boolean"
}
}
},
"detection_rules": {
"type": "array",
"items": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
},
"rule_id": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
}
}
},
"enforcement_mode": {
"enum": [
"enforce",
"warn",
"dry-run"
],
"type": "string"
},
"apply_immediately": {
"type": "boolean",
"default": false
}
}
}