Kubefwd

Name: Kubefwd
Author: txn2

CAUTIONgrade C · trust 77/100

Bulk port forwarding Kubernetes services for local development.

api restdeveloper toolsdevopsdevops toolsdevtoolsk8skubefwdkubernetes

Overview

From the repository's own README, as read at the audited commit.

# kubefwd (Kube Forward)![kubefwd - kubernetes bulk port forwarding](kubefwd-mast2.jpg)[![CNCF Landscape](https://img.shields.io/badge/CNCF%20Landscape-5699C6?logo=cncf&logoColor=fff)](https://landscape.cncf.io/?item=app-definition-and-development--application-definition-image-build--kubefwd)[![GitHub license](https://img.shields.io/github/license/txn2/kubefwd.svg)](https://github.com/txn2/kubefwd/blob/master/LICENSE)[![codecov](https://codecov.io/gh/txn2/kubefwd/branch/master/graph/badge.svg)](https://codecov.io/gh/txn2/kubefwd)[![Go Report Card](https://goreportcard.com/badge/github.com/txn2/kubefwd)](https://goreportcard.com/report/github.com/txn2/kubefwd)[![GitHub release](https://img.shields.io/github/release/txn2/kubefwd.svg)](https://github.com/txn2/kubefwd/releases)[![GitHub Downloads](https://img.shields.io/github/downloads/txn2/kubefwd/total)](https://github.com/txn2/kubefwd/releases)[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/txn2/kubefwd/badge)](https://scorecard.dev/viewer/?uri=github.com/txn2/kubefwd)[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/11659/badge)](https://www.bestpractices.dev/projects/11659)[![SLSA 3](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev)**[Documentation](https://kubefwd.com)** | **[Getting Started](https://kubefwd.com/getting-started/)** | **[User Guide](https://kubefwd.com/user-guide/)** | **[API Reference](https://kubefwd.com/api-reference/)** | **[MCP (AI Integration)](https://kubefwd.com/mcp-integration/)**## Develop Locally, Connect to Kubernetes**kubefwd** enables developers to work on their local machine while seamlessly accessing services running in a Kubernetes cluster. If you're building a new API that needs to connect to a database at `db:5432`, an auth service at `auth:443`, and a cache at `redis:6379`, all running in your development cluster, kubefwd makes them available locally by their service names, exactly as they would appear in-cluster. No environment

Details

Source: txn2/kubefwd
Transports: stdio
Tools: Registered at runtime; the list could not be read from source.
License: Apache-2.0
Stars: 4,171 · pushed 0d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (10 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: found

Findings (23)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

pkg/fwdapi/handlers/openapi.yaml:63

- url: http://127.2.27.1/api

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

pkg/fwdapi/middleware/middleware.go:58

"http://127.0.0.1":        true,

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

pkg/fwdapi/middleware/middleware.go:59

"http://127.0.0.1:8080":   true,

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

pkg/fwdapi/middleware/middleware.go:60

"http://127.2.27.1":       true, // kubefwd API IP

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

pkg/fwdapi/middleware/middleware.go:61

"http://127.2.27.1:8080":  true,

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

docs/mcp-integration.md:156

> DATABASE_URL = 'postgresql://dev:dev123@postgres:5432/notifications'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

test/integration/multiport_reconnect_test.go:43

const apiKey = "kubefwd-integration-test-key"

LOWInventory / provenance · inv.hidden_file · CWE-1104

.golangci.yml

.golangci.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.goreleaser.yml

.goreleaser.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

test/integration/helpers.go:42

kubefwdPath = "../../kubefwd"

LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

docs/architecture.md:238

kubefwd requires elevated privileges for:

LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

docs/getting-started.md:53

kubefwd requires elevated privileges on Windows to modify the hosts file. Right-click your terminal and select "Run as Administrator".

LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

docs/llms-full.txt:356

The Model Context Protocol (MCP) lets AI assistants connect to external tools. kubefwd's MCP integration gives AI assistants full access to Kubernetes port forwarding.

LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

docs/mcp-integration.md:7

kubefwd's MCP integration gives your AI assistant full access to Kubernetes port forwarding capabilities. Your AI can discover services, establish connections, monitor traffic, stream logs, and troubl

LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

docs/mcp-integration.md:91

1. **kubefwd** (elevated privileges)

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

DESIGN.md:75

- All CNCF Landscape mentions on the homepage and in `docs/attributions.md` link to the kubefwd entry on `landscape.cncf.io`. The Landscape listing is a load-bearing credential and earns a real link w

Why it matters. asks the agent to read credentials

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

docs/api-reference.md:60

Every endpoint **except `/api/health`** requires a Bearer token. Send it in the

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104

server.json

Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source

Fix. the page says so rather than showing an empty table