kubectl_scale · Kubernetes MCP Server MCP: Risk & Policy

WHAT IT DOES

What kubectl_scale does on Kubernetes MCP Server

AI agents invoke kubectl_scale to trigger actions in Kubernetes MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why kubectl_scale needs a policy

While scaling is reversible (unlike Destructive operations), it executes infrastructure changes whose effects depend on arguments (target resource, replica count). This fits Execute: runs commands that trigger external operations with side effects on the cluster. Scaling can cause service disruptions, pod terminations, or capacity issues if misconfigured, presenting high blast radius for an unsupervised agent.

From the tool's definition Tool performs kubectl_scale operations on Kubernetes resources. The description translates to 'Scale/adjust capacity of Kubernetes resources', which modifies cluster state by changing resource replicas and capacity.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

kubectl_scale Rate-limited

kubectl_scale stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "kubectl_scale": {
      "limits": [
        {
          "counter": "kubectl_scale_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Kubernetes MCP Server, so you can run agents against it safely.

FAQ

Questions about kubectl_scale

What does the kubectl_scale tool do? +

扩缩容Kubernetes资源. It is categorised as a Execute tool in the Kubernetes MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on kubectl_scale? +

Register the Kubernetes MCP Server MCP server in PolicyLayer and add a rule for kubectl_scale: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Kubernetes MCP Server. Nothing to install.

What risk level is kubectl_scale? +

kubectl_scale is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit kubectl_scale? +

Yes. Add a rate_limit block to the kubectl_scale rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block kubectl_scale completely? +

Set action: deny in the PolicyLayer policy for kubectl_scale. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides kubectl_scale? +

kubectl_scale is provided by the Kubernetes MCP Server MCP server (secret-deus/kubernetes-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.