// SCAN REPORT

Kube Lint

12 tools. 5 can modify or destroy data without limits.

5 write tools that can modify data. Rate limits recommended.

Last updated: 3 Jul 2026

5 can modify or destroy data

7 read-only

12 tools total

Community server · catalogue entry verified 03/07/2026

How to control Kube Lint ↓

TOOL MAP

What Kube Lint exposes to your agents

Read (7) Write / Execute (5) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Kube Lint tools

Execute · Medium flux_dryrun The tool executes kubectl commands (albeit with dry-run flags) which is an external operation that runs code/commands. Execute · Medium helm_dryrun This tool executes external commands (helm and kubectl) to validate Kubernetes manifests. Execute · Medium kustomize_dryrun This tool executes kubectl commands (even in dry-run mode) against potentially arbitrary Kustomize overlays. Execute · Medium flux_check The tool name 'flux_check' in the context of a FluxCD linting server suggests it runs a check/validation operation (likely 'flux check' CLI command) against a Kubernetes cluster.

5 of Kube Lint's 12 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Kube Lint

PolicyLayer is an MCP gateway — it sits between your AI agents and Kube Lint, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "select_kube_context": {
    "limits": [
      {
        "counter": "select_kube_context_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "argocd_app_diff": {
    "limits": [
      {
        "counter": "argocd_app_diff_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Kube Lint — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON KUBE LINT →

Instant setup, no code required.

FULL CATALOGUE

All 12 Kube Lint tools

EXECUTE 4 tools

Execute flux_check Run Execute flux_dryrun Validate FluxCD manifests with kubectl dry-run (client + server).\n Execute helm_dryrun Validate Helm chart by rendering and running kubectl dry-run\n Execute kustomize_dryrun Validate Kustomize overlay by building and running kubectl dry-run\n

WRITE 1 tools

Write select_kube_context Select the Kubernetes context for all subsequent operations.\n

READ 7 tools

Read argocd_app_diff Show diff between live and desired state of an ArgoCD application.\n Read argocd_app_get Get detailed status of a single ArgoCD application including\n Read argocd_app_list List all ArgoCD applications with sync and health status.\n Read flux_status Get Flux reconciliation status for all resources across namespaces.\n Read kubeconform_validate Validate Kubernetes manifests against JSON schemas offline\n Read list_kube_contexts List available kubectl contexts.\n Read yaml_validate Validate YAML syntax of Kubernetes manifest files.\n

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Kube Lint

How do I prevent bulk modifications through Kube Lint? +

The Kube Lint server has 1 write tools including select_kube_context. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Kube Lint.

How many tools does the Kube Lint MCP server expose? +

12 tools across 3 categories: Execute, Read, Write. 7 are read-only. 5 can modify, create, or delete data.

How do I enforce a policy on Kube Lint? +

Register the Kube Lint MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Kube Lint tool call.

Deterministic rules across all 12 Kube Lint tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON KUBE LINT →

Instant setup, no code required.

12 Kube Lint tools catalogued and risk-classified — across an index of 43,000+ MCP servers.