MCP server · Org-owned · Audited from source
Kubefwd MCP server
by txn2/kubefwdApache-2.0 licenceAudited 21 Sep 2026 · source 63d116ebf53e
stdio★ 4,170
Is it safe? With care — CAUTION, grade C (77/100). The tool list is built at runtime, so we cannot read it from the source. The audit recorded 23 findings (0 critical, 0 high, 7 medium, 11 low). Maintainer's description: Bulk port forwarding Kubernetes services for local development.
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “Kubefwd MCP server (txn2/kubefwd)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/txn2/kubefwd
Trust audit
Audit 0.4.1 · full source read 21 Sep 2026
Trust score77/100!CAUTION C
0 critical0 high7 medium11 low5 info
23 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared2 observations
- NetworkDeclared10 observations
- ShellNone observedNothing seen in the source
- DependenciesPinnedNothing floats
- SecretsFoundSee the findings
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS 7 findings |
L1 Static source | Secrets, path traversal, supply chain | WARN 8 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS 7 findings |
L3 Inventory | Declared tools match the source | PASS 1 finding |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
txn2OrganizationAccount type recorded when we read the repository. - PackageNo packageRuns from a repository checkout or a hosted URL.
- LicenceApache-2.0From the repository, as read at the audited commit.
- Last push5 days agoActivity of the repository when we read it.
- Source commit read63d116ebf53eThe audit covers exactly this commit, read on 21 Sep 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventoryBuilt at runtimeThe source declares no tools; the server lists them when a client connects, so we cannot read them.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (23)
Sorted by severity
MEDIUMNetwork egressnet.raw_ip · pkg/fwdapi/handlers/openapi.yaml:63
F-04 Network egressCWE-200 · CWE-319Layer L1
- url: http://127.2.27.1/api
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · pkg/fwdapi/middleware/middleware.go:58
F-04 Network egressCWE-200 · CWE-319Layer L1
"http://127.0.0.1": true,
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · pkg/fwdapi/middleware/middleware.go:59
F-04 Network egressCWE-200 · CWE-319Layer L1
"http://127.0.0.1:8080": true,
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · pkg/fwdapi/middleware/middleware.go:60
F-04 Network egressCWE-200 · CWE-319Layer L1
"http://127.2.27.1": true, // kubefwd API IP
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · pkg/fwdapi/middleware/middleware.go:61
F-04 Network egressCWE-200 · CWE-319Layer L1
"http://127.2.27.1:8080": true,
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · docs/mcp-integration.md:156
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · test/integration/multiport_reconnect_test.go:43
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · test/integration/helpers.go:42
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
kubefwdPath = "../../kubefwd"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.authority_framing · docs/architecture.md:238
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
kubefwd requires elevated privileges for:
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.authority_framing · docs/getting-started.md:53
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
kubefwd requires elevated privileges on Windows to modify the hosts file. Right-click your terminal and select "Run as Administrator".
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.authority_framing · docs/llms-full.txt:356
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
The Model Context Protocol (MCP) lets AI assistants connect to external tools. kubefwd's MCP integration gives AI assistants full access to Kubernetes port forwarding.
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.authority_framing · docs/mcp-integration.md:7
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
kubefwd's MCP integration gives your AI assistant full access to Kubernetes port forwarding capabilities. Your AI can discover services, establish connections, monitor traffic, stream logs, and troubl
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.authority_framing · docs/mcp-integration.md:91
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. **kubefwd** (elevated privileges)
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.credential_read · DESIGN.md:75
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- All CNCF Landscape mentions on the homepage and in `docs/attributions.md` link to the kubefwd entry on `landscape.cncf.io`. The Landscape listing is a load-bearing credential and earns a real link w
- Why
- asks the agent to read credentials
- Fix
- —
LOWPrompt injectionprompt.transfer_instruction · docs/api-reference.md:60
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Every endpoint **except `/api/health`** requires a Bearer token. Send it in the
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWInventory / provenancemcp.no_tools_extracted · server.json
F-13 Inventory / provenanceCWE-1104Layer L3
- Why
- the tool list is enumerated at runtime by tools/list, not declared in source
- Fix
- the page says so rather than showing an empty table
INFOInventory / provenanceinv.oversize · docs/images/100_TUI_idle-mode.png
F-13 Inventory / provenanceCWE-1104Layer L0
docs/images/100_TUI_idle-mode.png
- Why
- 1023539 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · docs/images/110_TUI_help.png
F-13 Inventory / provenanceCWE-1104Layer L0
docs/images/110_TUI_help.png
- Why
- 1081690 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · docs/images/140_TUI_forwards.png
F-13 Inventory / provenanceCWE-1104Layer L0
docs/images/140_TUI_forwards.png
- Why
- 1121058 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · docs/images/150_TUI_forward_details_hostnames.png
F-13 Inventory / provenanceCWE-1104Layer L0
docs/images/150_TUI_forward_details_hostnames.png
- Why
- 1066344 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · docs/images/150_TUI_forward_details_pod_logs.png
F-13 Inventory / provenanceCWE-1104Layer L0
docs/images/150_TUI_forward_details_pod_logs.png
- Why
- 1066380 bytes not read
- Fix
- —
Tools it exposes
None declared in source
The tool list is built at runtime, so we cannot read it from the source.
Install
audited commit 63d116e
Read the findings first. The most severe is Network egress (medium) at pkg/fwdapi/handlers/openapi.yaml.
No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.
Audit history
- !CAUTION C 77 / 100
Source changed, verdict held ·
63d116ebf53e
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/txn2/kubefwd/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about Kubefwd MCP server
What is the Kubefwd MCP server?
Bulk port forwarding Kubernetes services for local development.
Is Kubefwd safe to connect to an agent?
With care. The audit graded it C (77/100) and found 23 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Kubefwd need?
No credential environment variables were found in its source, so it appears to need none.
How does Kubefwd run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (63d116ebf53e), read on 2026-09-21. The repository is watched and re-audited when it changes.
Sources
- txn2/kubefwd on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
- ModelsAtlas trust audit — CAUTION verdict for commit 63d116ebf53eObserved · 21 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the Kubefwd MCP server?
- Is Kubefwd safe to connect to an agent?
- What credentials does Kubefwd need?