{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T18:25:55.599Z","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob","markdownUrl":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob.md","server":{"slug":"aashishmahajan-kube-noob","name":"kube-noob","registryName":"io.github.aashishmahajan/kube-noob","description":"Kubernetes, OpenShift, ROSA HCP, Helm and RHACS audit, debugging and cited docs. No AI inside.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"kube-noob","type":"pypi","identifier":"kube-noob","withdrawn":false,"url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob","version":"0.7.1","transport":"stdio","scoredAt":"2026-11-05T11:15:27.492Z"},"score":{"total":62,"tier":"medium","status":"scored","weekDelta":-3,"history":[{"date":"2026-11-05","total":62},{"date":"2026-11-04","total":77},{"date":"2026-11-03","total":82},{"date":"2026-11-02","total":81},{"date":"2026-11-01","total":81},{"date":"2026-10-31","total":80},{"date":"2026-10-30","total":65},{"date":"2026-10-29","total":65},{"date":"2026-10-28","total":64},{"date":"2026-10-27","total":63}]},"categories":[{"name":"Supply Chain Security","score":50,"verdict":"partial","reasons":["Malware scan not yet available for this package.","No known CVEs affecting this package version or its production dependencies.","Runs hatchling.build at install time, a recognised build step with no custom scripting around it.","1 of 32 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"vendor_no_verdict"}},{"code":"cve.none","args":{}},{"code":"installscript.allowlisted","args":{"tool":"hatchling.build","hooks":"build_backend"}},{"code":"dephealth.assessed","args":{"deps":"32","unhealthy":"1"}}]},{"name":"Provenance & Transparency","score":74,"verdict":"fail","reasons":["Repository check failed: the declared repository URL redirects; it must resolve directly.","Cryptographically verified build provenance (signed, bound to aashishmahajan/kube-noob).","Clear OSI-approved license (Apache-2.0).","Actively maintained (last published 5 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_redirected","args":{}},{"code":"provenance.verified","args":{"repo":"aashishmahajan/kube-noob"}},{"code":"license.osi","args":{"spdx":"Apache-2.0"}},{"code":"maintenance.recent","args":{"age_days":"5"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":62,"verdict":"fail","reasons":["67% of prompts and resources have a non-trivial description (not blank, and not just the item's name).","AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 6785 tokens (~138/item across 49 items; 47 tools + 2 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.descriptions","args":{"pct":"67"}},{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"138","items":"49","tools":"47","tokens":"6785","resources":"2"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":30,"verdict":"partial","reasons":["Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"9"}}]},{"name":"Tool Coverage","score":91,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","68% of tool parameters carry a description.","Structured output schemas are declared (100% of tools); any adoption earns full credit."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"68"}},{"code":"toolquality.output_present","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 47 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 49 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"47"}},{"code":"toolsafety.manipulation_clean","args":{"units":"49","judged":"49"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":["Malware scan not yet available for this package."],"malware":[],"components":[{"slug":"kube-noob","type":"pypi","identifier":"kube-noob","withdrawn":false,"score":62,"current":true,"url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob","markdownUrl":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob.md"}],"facts":[{"label":"Registry","value":"pypi"},{"label":"Package","value":"kube-noob"},{"label":"Version","value":"0.7.1"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"kubenoob_run_protocol","title":"Run the 7-step engineering protocol","description":"Clarify -> Validate -> Research -> Audit -> Calibrate -> Generate -> Red Team for a request with existing manifests or a generator blueprint. Returns the Audit & Validation Brief, the production manifest, and Red Team findings with safeguards. Use this first for any design/review request.","inputs":[{"name":"apply_fixes","type":"boolean","required":false,"description":null},{"name":"blueprint","type":null,"required":false,"description":"Generator blueprint (see generate_manifests)."},{"name":"manifests","type":null,"required":false,"description":"Existing manifests to review."},{"name":"platform","type":null,"required":false,"description":null},{"name":"request","type":"string","required":true,"description":"What the user wants, in their words."},{"name":"version","type":null,"required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":122},{"name":"kubenoob_validate_manifests","title":"Validate manifests","description":"Strict schema validation (Kubernetes 1.35 + OpenShift/OVN-K/StackRox/Gateway API CRDs), apiVersion vs kind, OpenShift-only APIs on vanilla Kubernetes, removed/deprecated APIs, selector wiring.","inputs":[{"name":"manifests","type":"string","required":true,"description":"One or more YAML documents (Kubernetes/OpenShift objects)."},{"name":"platform","type":"string","required":false,"description":"Target platform."},{"name":"version","type":null,"required":false,"description":"Platform version, e.g. '4.22' (OCP) or '1.35'."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":113},{"name":"kubenoob_audit_manifests","title":"Audit manifests","description":"Full deterministic audit: security, network exposure, storage access modes, reliability and red-team scenarios. Findings carry rule ids, line numbers, fixes, citations and matching RHACS policy names.","inputs":[{"name":"exceptions","type":null,"required":false,"description":"An exception list (YAML, apiVersion kube-noob.io/v1, kind ExceptionList): each entry names a rule, a scope, an owner, a reason and an expiry date. Active entries hide the findings they cover; expired…"},{"name":"manifests","type":"string","required":true,"description":"One or more YAML documents (Kubernetes/OpenShift objects)."},{"name":"min_severity","type":"string","required":false,"description":"Hide findings below this severity."},{"name":"platform","type":"string","required":false,"description":"Target platform."},{"name":"stages","type":"array","required":false,"description":null},{"name":"version","type":null,"required":false,"description":"Platform version, e.g. '4.22' (OCP) or '1.35'."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":186},{"name":"kubenoob_red_team","title":"Red-team manifests","description":"Hostile-auditor scenarios: node crash, zone outage, RWX split-brain, exposure, privilege escalation, upgrade blocking, secret leaks, resource starvation, supply chain.","inputs":[{"name":"manifests","type":"string","required":true,"description":"One or more YAML documents (Kubernetes/OpenShift objects)."},{"name":"platform","type":"string","required":false,"description":"Target platform."},{"name":"version","type":null,"required":false,"description":"Platform version, e.g. '4.22' (OCP) or '1.35'."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":99},{"name":"kubenoob_fix_manifests","title":"Apply safe mechanical fixes","description":"Migrates removed APIs, fixes wrong API groups, hardens securityContext, adds Route TLS, unblocks PDBs, reorders EgressFirewall rules, swaps RWO-only classes for RWX claims. Returns the diff log and manual follow-ups. Does not touch any cluster.","inputs":[{"name":"harden","type":"boolean","required":false,"description":"Apply securityContext hardening (restricted profile)."},{"name":"manifests","type":"string","required":true,"description":"One or more YAML documents (Kubernetes/OpenShift objects)."},{"name":"platform","type":"string","required":false,"description":"Target platform."},{"name":"version","type":null,"required":false,"description":"Platform version, e.g. '4.22' (OCP) or '1.35'."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":138},{"name":"kubenoob_clarify_requirements","title":"Clarify requirements","description":"Check a (partial) generator blueprint and return blocking questions and stated assumptions.","inputs":[{"name":"blueprint","type":"object","required":true,"description":"Partial blueprint; missing/invalid fields become questions."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":45},{"name":"kubenoob_generate_manifests","title":"Generate production manifests","description":"Deterministic, audited manifests for kubernetes / openshift / rosa-classic / rosa-hcp from a blueprint (name, namespace, image, replicas, port, probes, storage, exposure, egress).","inputs":[{"name":"blueprint","type":null,"required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":62},{"name":"kubenoob_generate_helm_chart","title":"Generate a Helm chart","description":"Same as generate_manifests but packaged as a Helm chart (Chart.yaml v2, values.yaml, values.schema.json, templates). Returns file contents.","inputs":[{"name":"blueprint","type":null,"required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":49},{"name":"kubenoob_search_knowledge","title":"Search local knowledge","description":"BM25 search over the built-in curated knowledge and the ingested corpus (Kubernetes/OpenShift/ROSA/Helm/StackRox docs, Terraform modules, public RHACS Jira insights). Results include chunk ids to cite as [kn:...] plus source URL and license.","inputs":[{"name":"limit","type":"integer","required":false,"description":null},{"name":"query","type":"string","required":true,"description":null},{"name":"source","type":null,"required":false,"description":"Source id prefix filter, e.g. 'builtin:', 'jira:ROX', 'k8s-docs'."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":111},{"name":"kubenoob_get_knowledge","title":"Read a knowledge chunk or document","description":"Fetch the full text of a chunk id (kn:<doc>#<n>) or every chunk of a document id.","inputs":[{"name":"id","type":"string","required":true,"description":"Chunk id 'kn:<doc>#<n>' or a document id."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":57},{"name":"kubenoob_api_history","title":"API removal history and version map","description":"Removed/deprecated Kubernetes APIs relevant to a target version, and the OpenShift->Kubernetes version map.","inputs":[{"name":"kind","type":null,"required":false,"description":null},{"name":"platform","type":"string","required":false,"description":null},{"name":"version","type":null,"required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":49},{"name":"kubenoob_explain_rule","title":"Explain an audit rule","description":"Rationale, remediation, citations for a rule id.","inputs":[{"name":"rule_id","type":"string","required":true,"description":"e.g. KN-S001"}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":37},{"name":"kubenoob_list_rules","title":"List audit rules","description":"All rule ids with stage, category and default severity.","inputs":[],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":22},{"name":"kubenoob_diagnose","title":"Diagnose symptoms offline","description":"Match pasted events / describe output / logs / CLI errors or an Alertmanager webhook payload against troubleshooting playbooks, ranked by matching patterns and by the signals the text carries (alert names, reasons); returns the signals, ranked root causes, read-only checks with names filled in, fixes, reported issues for the version and policy denials.","inputs":[{"name":"limit","type":"integer","required":false,"description":null},{"name":"platform","type":null,"required":false,"description":null},{"name":"text","type":"string","required":true,"description":"Events, `describe` output, logs, CLI errors, status JSON, Ceph health output (`ceph health detail`, `ceph status`, their JSON or a CephCluster) or an Alertmanager webhook payload (its alerts are read…"},{"name":"version","type":null,"required":false,"description":"The cluster's OpenShift version (4.20 or 4.20.8): leaves out reported issues already fixed there."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":194},{"name":"kubenoob_extract_signals","title":"Extract signals","description":"Read the canonical names in an error: Alertmanager alert names (webhook payload or text), event and ClusterOperator condition reasons, container reasons, admission rules, components and normalised error templates, plus the alerts its words imply. Returns each signal with where it was found, the catalogue entry (components, playbooks, upstream source) and the playbooks it points at. Read-only and offline.","inputs":[{"name":"text","type":"string","required":true,"description":"An Alertmanager payload, events, a ClusterOperator, pod status, logs or an error in words."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":119},{"name":"kubenoob_insight","title":"What is this, and what does it say?","description":"Start here for anything the user pastes. Names what the input is (events, pod status, logs, an Alertmanager payload, a policy denial, a ticket, manifests, a Helm template, a build log, a Containerfile, an SBOM or scanner report, a packet trace, must-gather paths, a question; several at once) and runs every analyser that applies: diagnosis with reported issues and team memory, the denial explainer, the audit, the documentation. Returns every finding with its source, read-only next steps and what was not analysed and why. Read-only, local.","inputs":[{"name":"platform","type":null,"required":false,"description":null},{"name":"text","type":"string","required":true,"description":"Anything pasted: events, describe output, logs, an Alertmanager payload, Ceph health output (ceph health detail or ceph status, text or JSON), a policy denial, a ticket, manifests or a Helm template,…"},{"name":"version","type":null,"required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":213},{"name":"kubenoob_ticket_changes","title":"What changed in Red Hat Jira","description":"Reconcile the local copy of Red Hat's public Jira: tickets fixed (with fix versions), closed as not a bug, won't fix or duplicate, reopened, given a fix version or opened since a date, with links, and the open tickets per project and verdict. Read-only and local; each sync records the changes.","inputs":[{"name":"kinds","type":"array","required":false,"description":null},{"name":"limit","type":"integer","required":false,"description":null},{"name":"project","type":null,"required":false,"description":null},{"name":"since","type":"string","required":false,"description":"How far back: 2d, 36h, 90m or a date such as 2026-10-25."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":129},{"name":"kubenoob_known_issues","title":"Is this a reported issue?","description":"Match an error or symptom against the issues listed in the OpenShift release notes (known issues and issues fixed in each update) and, when this install keeps a local copy of Red Hat's public Jira, against those tickets too. Returns the issue id and link, what became of it (fixed and in which version, still open, closed as not a bug, won't fix or a duplicate), the workaround and Red Hat's remarks from the comments; with `version`, only issues that can affect that version.","inputs":[{"name":"limit","type":"integer","required":false,"description":null},{"name":"platform","type":null,"required":false,"description":null},{"name":"text","type":"string","required":true,"description":"An error message, events, logs or a symptom in words."},{"name":"version","type":null,"required":false,"description":"The cluster's OpenShift version (4.20 or 4.20.8): keeps only issues that can affect it."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":175},{"name":"kubenoob_upgrade_risks","title":"Known risks for an OpenShift update","description":"Before updating OpenShift from one x.y.z version to another: the risks Red Hat declares for that update in the public update graph (conditional updates, as an OpenShift Update Service serves them), from a bundled snapshot, offline. Each risk has its name, message, link, the version that fixes it and a verdict: applies (declared for every cluster), check (one fact decides it, with the read-only command or must-gather file that shows it) or cannot evaluate offline (its PromQL, as written). Whether the update is in your channel is not checked.","inputs":[{"name":"arch","type":null,"required":false,"description":"The release architecture (multi for a multi-architecture payload). Without it, every architecture is checked and a risk declared for some of them only says which."},{"name":"current","type":"string","required":true,"description":"The OpenShift version the cluster runs, x.y.z, e.g. 4.20.3."},{"name":"target","type":"string","required":true,"description":"The version to update to, x.y.z, e.g. 4.21.4."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":219},{"name":"kubenoob_ticket","title":"Look up a Red Hat Jira ticket","description":"One ticket from this install's local copy of Red Hat's public Jira (OCPBUGS, ROX, HOSTEDCP...): its status, what became of it, fix versions and whether `version` already has the fix, the workaround and remarks from the comments, and linked tickets. Local data only; nothing is fetched.","inputs":[{"name":"key","type":"string","required":true,"description":"A Red Hat Jira key, e.g. OCPBUGS-12345 or ROX-30000."},{"name":"version","type":null,"required":false,"description":"The cluster's OpenShift version: says whether the fix is already in it."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":127},{"name":"kubenoob_explain_denial","title":"Why was this denied?","description":"Explain an admission denial policy by policy: Kyverno, OPA Gatekeeper, ValidatingAdmissionPolicy, Pod Security Admission, OpenShift SCC, RHACS, ResourceQuota, LimitRange or RBAC. Returns the policy and rule, the failing field, read-only commands with names filled in, the fix (with a patch for Pod Security and RBAC) and the audit rules that catch it before deploy.","inputs":[{"name":"platform","type":null,"required":false,"description":null},{"name":"text","type":"string","required":true,"description":"The denial as printed: `kubectl apply` or `oc apply` output, a FailedCreate event or a Warning."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":131},{"name":"kubenoob_policy_generate","title":"Turn audit rules into admission policies","description":"Generate ValidatingAdmissionPolicy (with binding) and/or Kyverno ValidatingPolicy YAML from kube-noob's audit rules, in audit (warn and record) or enforce mode, for a platform. One policy per rule decidable from one object; each names its rule, fix and source. Rules that need other objects or that the API server already enforces are listed with the reason. Nothing is applied.","inputs":[{"name":"engines","type":"array","required":false,"description":"vap: ValidatingAdmissionPolicy + binding (built into Kubernetes 1.30+); kyverno: Kyverno ValidatingPolicy (policies.kyverno.io/v1, Kyverno 1.18+)."},{"name":"exceptions","type":null,"required":false,"description":"An exception list (YAML, kube-noob.io/v1 ExceptionList): active entries become exemptions in their rule's policy (with the ReplicaSets and pods their workloads make); expired or refused ones are list…"},{"name":"exclude_namespaces","type":"array","required":false,"description":"Namespaces the policies skip, besides kube-system, kube-public and kube-node-lease."},{"name":"mode","type":"string","required":false,"description":"audit warns and records; enforce refuses"},{"name":"platform","type":"string","required":false,"description":null},{"name":"rules","type":"array","required":false,"description":"Rule ids such as KN-S001 (default: every rule)."},{"name":"version","type":null,"required":false,"description":"OpenShift (4.20) or Kubernetes (1.33)"}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":274},{"name":"kubenoob_policy_migrate_check","title":"Check legacy Kyverno policies for their CEL form","description":"Kyverno 1.20 removes the kyverno.io ClusterPolicy, Policy, CleanupPolicy and legacy PolicyException. Lint them rule by rule against the policies.kyverno.io types: direct, inverted (a deny or a negated pattern: the CEL validation must state what is allowed), manual (JMESPath, API calls, anchors, strategic merge patches) or blocked (no documented CEL equivalent), each with the field path, the target kind, the reason and the Kyverno documentation section (pinned commit). Rules that map directly get a draft CEL policy and a kyverno test fixture skeleton to prove it. Nothing is applied or rewritten.","inputs":[{"name":"drafts","type":"boolean","required":false,"description":"Include a draft CEL policy for each rule whose fields all map directly, and a kyverno test fixture skeleton per policy (good and bad resources run against the legacy rule and the draft)."},{"name":"policies","type":"string","required":true,"description":"One or more legacy Kyverno policies (YAML): kyverno.io ClusterPolicy, Policy, ClusterCleanupPolicy, CleanupPolicy or PolicyException. Other documents are listed and skipped; Secrets are not read."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":234},{"name":"kubenoob_posture_scan","title":"Attack paths in manifests","description":"Rank the paths from an exposure (Route, Ingress, LoadBalancer or NodePort Service) to what a compromised pod could do: node access (privileged, hostPath, host namespaces) or Kubernetes API rights through its ServiceAccount token (read Secrets, exec, create workloads, escalate). Score = exposure x blast radius; every step names the field that proves it, with a fix. Secret objects are dropped unread.","inputs":[{"name":"manifests","type":"string","required":true,"description":"Routes, Ingresses, Services, workloads, ServiceAccounts and RBAC objects (YAML). Secret objects are dropped unread."},{"name":"top","type":"integer","required":false,"description":"How many ranked paths to return."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":142},{"name":"kubenoob_build_diagnose","title":"Diagnose a failed build log","description":"Read a failed GitHub Actions, Jenkins, Tekton or OpenShift build log: the failing step (and why it is that step), the error line and its template, the cause class (dependency fetch, compile, test, image push, registry auth, quota, timeout, out of memory, permissions) with its evidence, reported issues, team memory and the fix for that CI system. Read-only.","inputs":[{"name":"log","type":"string","required":true,"description":"A failed build or pipeline log: GitHub Actions, Jenkins, Tekton (tkn ... logs) or an OpenShift build (oc logs build/<name>). The end of the log matters most: when cutting, keep the end."},{"name":"platform","type":null,"required":false,"description":null},{"name":"version","type":null,"required":false,"description":"The cluster's OpenShift version, for reported issues that may apply."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":172},{"name":"kubenoob_rhacs_compare","title":"Compare RHACS policies with kube-noob's rules","description":"Map every policy in an RHACS (StackRox) export to kube-noob rules by name and criteria: overlap (same setting, with severity and scope differences), related (the same risk seen through image, runtime or API-event data), gap (a deploy-time setting kube-noob has no rule for), outside (image contents, runtime behaviour, API events, label conventions) or unexplained (criteria kube-noob does not know). Lists disagreements and the rules no policy covers. Local only.","inputs":[{"name":"outcomes","type":"array","required":false,"description":"Only return policies with these outcomes (default: all)."},{"name":"policies","type":"string","required":true,"description":"An RHACS policy export as JSON: {\"policies\": [...]} from the RHACS portal (Export policy to JSON) or POST /v1/policies/export, a list of policies, or one policy."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":180},{"name":"kubenoob_vuln_report","title":"Assess scanner output: VEX, exploitation, reachability","description":"Read Trivy or Grype JSON, CycloneDX or SPDX SBOMs, or an RHACS image scan into one finding per package, version and CVE (with the fix version); apply Red Hat VEX (a not-affected or already-fixed finding drops out, citing the statement); mark CISA KEV entries; and, with the manifests, rank by exposure, privileges and RBAC reach with each finding's attack path. SBOM packages are matched against Red Hat VEX. Local only.","inputs":[{"name":"image","type":null,"required":false,"description":"Treat every report as this image (registry/repo:tag or @sha256:...)."},{"name":"kev","type":null,"required":false,"description":"Optional: the CISA KEV catalog JSON (known_exploited_vulnerabilities.json, CC0)."},{"name":"manifests","type":null,"required":false,"description":"Optional: the YAML that runs the images; findings are then ranked by exposure and privileges and shown with their attack path."},{"name":"products","type":"array","required":false,"description":"Red Hat product CPE prefixes the images belong to (default: from the RHEL release in the report, e.g. cpe:/o:redhat:enterprise_linux:9)."},{"name":"reports","type":"array","required":true,"description":"Scanner output as JSON text: Trivy (trivy image -f json [--list-all-pkgs]), Grype (grype -o json), a CycloneDX or SPDX 2 JSON SBOM, or an RHACS image (GET /v1/images/{id}). Reports of the same image…"},{"name":"top","type":"integer","required":false,"description":"How many ranked findings to return."},{"name":"trust_report_vex","type":"boolean","required":false,"description":"Honour a CycloneDX report's own analysis (not_affected, resolved, false_positive). Off by default: the findings it marks are kept, with a note."},{"name":"vex","type":"array","required":false,"description":"Optional Red Hat CSAF VEX documents (JSON) to apply on top of the local redhat-vex corpus."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":394},{"name":"kubenoob_threat_model","title":"STRIDE threat model of an application","description":"From manifests: entry points, trust boundaries, data stores and identities, and per element the STRIDE threats with status (open, mitigated, not assessed), the evidence, the kube-noob rules, generated admission policies and RHACS policies that mitigate each, and MITRE ATT&CK for Containers technique ids. Deterministic; Secrets are dropped unread.","inputs":[{"name":"manifests","type":"string","required":true,"description":"The application's YAML."},{"name":"platform","type":null,"required":false,"description":null},{"name":"reports","type":"array","required":false,"description":"Optional scanner reports of its images, to assess public-facing exploits (threat TM-E01)."},{"name":"version","type":null,"required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":129},{"name":"kubenoob_posture_report","title":"Latest drift and policy report","description":"The newest daily report in this install's data folder: objects added, removed and changed since the previous snapshot (with the fields that changed), findings new and fixed, and open findings by namespace, owner and rule. Local data only.","inputs":[],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":59},{"name":"kubenoob_check_network_policy","title":"Would this traffic be allowed?","description":"Evaluate NetworkPolicies offline: can the source reach the destination on this port? Checks egress from the source and ingress to the destination, names the policy and rule that decide each, says why the other rules did not match, and proposes the smallest NetworkPolicy that would allow it.","inputs":[{"name":"default_namespace","type":"string","required":false,"description":"For objects without one."},{"name":"destination","type":"string","required":true,"description":"Where it goes: namespace/name of a workload (namespace/kind/name when names clash), namespace:key=value,... for a set of pod labels, or an IP address / CIDR outside the cluster."},{"name":"manifests","type":"string","required":true,"description":"The NetworkPolicies and the workloads they apply to (Deployments, Pods ...); add Namespace objects when policies select namespaces by label."},{"name":"platform","type":null,"required":false,"description":null},{"name":"port","type":null,"required":true,"description":"Destination port number (1-65535) or a named container port."},{"name":"protocol","type":"string","required":false,"description":null},{"name":"source","type":"string","required":true,"description":"Where the connection starts: namespace/name of a workload (namespace/kind/name when names clash), namespace:key=value,... for a set of pod labels, or an IP address / CIDR outside the cluster."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":236},{"name":"kubenoob_incidents","title":"Incidents the watch has seen","description":"Open (or resolved) incidents from the local incident ledger: workload, signal, how often it came back, the diagnosis and what changed before it started. Read this first when asked what is wrong.","inputs":[{"name":"limit","type":"integer","required":false,"description":null},{"name":"namespace","type":null,"required":false,"description":null},{"name":"status","type":"string","required":false,"description":"Which incidents to list."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":74},{"name":"kubenoob_incident","title":"One incident in full","description":"An incident with its evidence (redacted), diagnosis, policy denials, reported issues, rollout change, every occurrence, the fixes a person confirmed, and confirmed fixes for the same problem elsewhere.","inputs":[{"name":"id","type":"string","required":true,"description":"Incident id, e.g. inc-3fa94c0e12."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":72},{"name":"kubenoob_incident_confirm","title":"Remember the fix for an incident","description":"AFTER the user confirms it worked: store the cause and fix on the incident (and as a learning note), so the next occurrence comes with it. Summaries only; never leaves the machine.","inputs":[{"name":"cause","type":"string","required":true,"description":"The confirmed root cause, in words."},{"name":"confirmed_by_user","type":"boolean","required":true,"description":"True only after the user explicitly confirmed this cause and fix worked."},{"name":"fix","type":"string","required":true,"description":"What fixed it, in words (no manifests)."},{"name":"id","type":"string","required":true,"description":"Incident id, e.g. inc-3fa94c0e12."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":124},{"name":"kubenoob_learn_tracks","title":"List learning tracks","description":"Tracks, lessons, exercises and the learner's progress.","inputs":[{"name":"learner","type":"string","required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":30},{"name":"kubenoob_learn_lesson","title":"Open a lesson","description":"Lesson content with objectives, key points and citations. A shared HTTP server records no progress, so the learner id only selects whose tally to show when one is kept.","inputs":[{"name":"learner","type":null,"required":false,"description":null},{"name":"lesson_id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":59},{"name":"kubenoob_learn_exercise","title":"Get an exercise","description":"Exercise prompt, starter YAML, hints and points.","inputs":[{"name":"exercise_id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":31},{"name":"kubenoob_learn_submit","title":"Submit an exercise answer","description":"Grade YAML offline with the audit engine; awards credits and returns feedback. A shared HTTP server grades the same way but records nothing, and says so in the result.","inputs":[{"name":"answer","type":"string","required":true,"description":null},{"name":"exercise_id","type":"string","required":true,"description":null},{"name":"learner","type":"string","required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":67},{"name":"kubenoob_learn_quiz","title":"Quiz","description":"Fetch a quiz question (no choice) or answer it (choice index). A shared HTTP server marks the answer the same way but records nothing, and says so in the result.","inputs":[{"name":"choice","type":null,"required":false,"description":"Omit to fetch the question; set to answer it."},{"name":"learner","type":"string","required":false,"description":null},{"name":"question_id","type":"string","required":true,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":80},{"name":"kubenoob_learn_progress","title":"Learner progress","description":"Credits earned and completed items.","inputs":[{"name":"learner","type":"string","required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":25},{"name":"kubenoob_grade_answer","title":"Grade a model answer (enforcer + credit system)","description":"Deterministic reward for a completion against a benchmark task: task correctness (audit engine or QA rules), source-attribution credit for valid [kn:...] citations, format, penalties.","inputs":[{"name":"completion","type":"string","required":true,"description":null},{"name":"task","type":null,"required":false,"description":"Inline task. Its mustMention / mustNotMention / matches entries are matched as literal text, not regular expressions (only built-in benchmark tasks use regular expressions)."},{"name":"task_id","type":null,"required":false,"description":"Benchmark task id; or pass `task` inline."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":107},{"name":"kubenoob_learning_summary","title":"Show what kube-noob has learned locally","description":"The user's environment profile (platform, versions, conventions), confirmed troubleshooting notes (cite as [kn:local-N#0]) and the most frequent playbooks/rules. Read this before tailoring advice.","inputs":[],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":51},{"name":"kubenoob_learning_note_add","title":"Remember a confirmed fix","description":"Save a short symptom -> cause -> fix note to the local learning file AFTER the user confirms it worked. Summaries only: credentials, manifests and raw logs are rejected. Never leaves the machine.","inputs":[{"name":"cause","type":"string","required":true,"description":"The confirmed root cause."},{"name":"confirmed_by_user","type":"boolean","required":true,"description":"True only after the user explicitly confirmed this cause and fix worked."},{"name":"fix","type":"string","required":true,"description":"What fixed it, in words (no manifests)."},{"name":"platform","type":null,"required":false,"description":null},{"name":"symptom","type":"string","required":true,"description":"What was observed, in one or two sentences."},{"name":"tags","type":"array","required":false,"description":null}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":127},{"name":"kubenoob_learning_profile_set","title":"Remember the user's environment","description":"Save platform, versions and team conventions the user stated, so later answers fit their setup.","inputs":[{"name":"conventions","type":null,"required":false,"description":"Team conventions, e.g. 'namespaces are <team>-<env>'."},{"name":"platform","type":null,"required":false,"description":null},{"name":"versions","type":"object","required":false,"description":"Keys kubernetes|openshift|helm|rhacs|rosa, values like '4.22'."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":83},{"name":"kubenoob_config_status","title":"Show configuration","description":"Effective configuration (webEnabled, cluster access, model), version and knowledge stats.","inputs":[],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":27},{"name":"kubenoob_code_report","title":"Assess SAST findings: where the code ships and who runs it","description":"Read the SARIF that Semgrep, Bandit, SpotBugs/FindSecBugs, ESLint or CodeQL wrote (kube-noob has no analysis engine of its own): one finding per file, line and CWE across tools, suppressed and fixed results excluded with the reason, lint kept apart. With Containerfiles, each file is followed into the images that ship it (copied or built; tests and tools are not shipped); with manifests, findings rank by exposure and privileges with the attack path. With scanner reports and dependency files, each language-package vulnerability points at the file and line to change. Local only.","inputs":[{"name":"containerfiles","type":"array","required":false,"description":"Containerfiles, to know which images ship each file."},{"name":"dependency_files","type":"object","required":false,"description":"Dependency files by repository path (requirements.txt, package.json, package-lock.json, pom.xml, go.mod, ...), to find the line that declares a vulnerable package."},{"name":"include_quality","type":"boolean","required":false,"description":"Also list lint and quality results (never ranked)."},{"name":"manifests","type":null,"required":false,"description":"YAML that runs the images: ranks by exposure and privileges."},{"name":"reports","type":"array","required":false,"description":"Trivy or Grype JSON or a CycloneDX report of an image: each language-package vulnerability points at the dependency file and line that declares it."},{"name":"sarif","type":"array","required":false,"description":"SARIF 2.1.0 as JSON text from Semgrep, Bandit, SpotBugs/FindSecBugs, ESLint or CodeQL (any SARIF producer works). The same file, line and CWE from several tools become one finding."},{"name":"source_roots","type":"array","required":false,"description":"Absolute directories the scanners ran in (the CI checkout), so absolute paths map to the repository."},{"name":"top","type":"integer","required":false,"description":"How many ranked findings to return."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":367},{"name":"kubenoob_containerfile_audit","title":"Audit a Containerfile","description":"Static checks of a Containerfile or Dockerfile: base images pinned by digest, a non-root USER, no credentials in ENV, ARG, LABEL, RUN or copied files, no download piped into a shell, package caches cleaned, a health check or probes, a multi-stage build. Each finding names its fix and source. The CLI (kube-noob build audit) also reads the build context and the built image's layers.","inputs":[{"name":"containerfile","type":"string","required":true,"description":"The Containerfile or Dockerfile text."},{"name":"manifests","type":null,"required":false,"description":"Optional: the workload YAML that runs the image; its readiness or liveness probes satisfy the health check."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":141},{"name":"kubenoob_analyze_must_gather","title":"Analyse a must-gather","description":"Open an OpenShift must-gather (or oc adm inspect output) safely and say what is wrong, most severe first: the cluster version and update, cluster operators, nodes, machine config pools, OLM operators, pods, warning events and etcd log hints. Each finding has its evidence file, its signals, read-only commands to confirm it, and the known OpenShift bugs and team memory entries that match it for the version the cluster runs. Nothing is extracted or run and Secrets are never read. Local: reads the path you give on this machine.","inputs":[{"name":"case_draft","type":"boolean","required":false,"description":"Also return caseDraft: a support case draft with placeholders for what only you know."},{"name":"path","type":"string","required":true,"description":"Absolute path of a must-gather directory or .tar, .tar.gz or .tgz archive on the machine the server runs on (under mustGather.allowedDir when it is set). Nothing is extracted or run; Secrets are neve…"},{"name":"top","type":"integer","required":false,"description":"How many findings to return, most severe first."}],"outputs":[],"hasOutputSchema":true,"hasExamples":false,"tokenEstimate":224}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T11:15:27.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[{"hook":"build_backend","tier":"allowlisted"}],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":32,"partial":false,"deprecated":null,"stale":null,"noRepo":1}},"mismatches":[],"changelog":{"trackingSince":"2026-10-27","recent":[{"id":"chg_01a1ab6b-be97-7cb8-b19d-4cc23f23e0b6","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a1ab6b-be97-7cb8-b19d-4cc23f23e0b6"},{"id":"chg_01a1ab6b-be98-7d15-89f1-7de0a8eb925f","kind":"score.total_changed","summary":"Trust score (77 → 62)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a1ab6b-be98-7d15-89f1-7de0a8eb925f"},{"id":"chg_01a1a5ad-9157-72a5-b270-29eb46f7b70c","kind":"check.verdict","summary":"Source repository (pass → fail)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a1a5ad-9157-72a5-b270-29eb46f7b70c"},{"id":"chg_01a1a5ad-9159-7e30-9e56-be544ddd9619","kind":"score.total_changed","summary":"Trust score (82 → 77)","materiality":"functional","direction":"regression","scoreDelta":-5,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a1a5ad-9159-7e30-9e56-be544ddd9619"},{"id":"chg_01a1a0bb-392f-7e99-9e2c-c19803a83c19","kind":"score.total_changed","summary":"Trust score (81 → 82)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a1a0bb-392f-7e99-9e2c-c19803a83c19"},{"id":"chg_01a1963a-f6ff-75d9-aeb9-653b83829df9","kind":"check.reverified","summary":"Security disclosure (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a1963a-f6ff-75d9-aeb9-653b83829df9"},{"id":"chg_01a1963a-f700-70cd-90fd-2b18b65d4b69","kind":"score.total_changed","summary":"Trust score (80 → 81)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-01","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a1963a-f700-70cd-90fd-2b18b65d4b69"},{"id":"chg_01a190bb-0ff4-7f1e-a206-179c4c99359f","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a190bb-0ff4-7f1e-a206-179c4c99359f"},{"id":"chg_01a190bb-0ff7-70a0-a078-5c69e168807c","kind":"check.unverifiable","summary":"Security disclosure (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a190bb-0ff7-70a0-a078-5c69e168807c"},{"id":"chg_01a190bb-0ff7-78e8-a179-1dedf60855db","kind":"package.version_changed","summary":"Package version (0.7.0 → 0.7.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a190bb-0ff7-78e8-a179-1dedf60855db"},{"id":"chg_01a190bb-0ff8-705d-afa4-c2d8d2b4bf2a","kind":"score.total_changed","summary":"Trust score (65 → 80)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a190bb-0ff8-705d-afa4-c2d8d2b4bf2a"},{"id":"chg_01a18ab2-feef-7727-be9a-90cfbb469f46","kind":"check.measure","summary":"Schema quality (6105 → 6722)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a18ab2-feef-7727-be9a-90cfbb469f46"},{"id":"chg_01a18ab2-fef1-7b27-963e-3775fb805ded","kind":"package.version_changed","summary":"Package version (0.6.0 → 0.7.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a18ab2-fef1-7b27-963e-3775fb805ded"},{"id":"chg_01a186cb-dd86-7985-9e75-8451fa407e61","kind":"check.verdict","summary":"Schema quality (pass → fail)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a186cb-dd86-7985-9e75-8451fa407e61"},{"id":"chg_01a186cb-dd87-7a4f-aa6f-853d9418862d","kind":"check.measure","summary":"Tool coverage (57% → 67%)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a186cb-dd87-7a4f-aa6f-853d9418862d"},{"id":"chg_01a186cb-dd89-7a48-b939-aa49cf403eb5","kind":"package.version_changed","summary":"Package version (0.4.0 → 0.6.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a186cb-dd89-7a48-b939-aa49cf403eb5"},{"id":"chg_01a186cb-dd8a-71ab-bbc7-10213ab06d7f","kind":"score.total_changed","summary":"Trust score (64 → 65)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a186cb-dd8a-71ab-bbc7-10213ab06d7f"},{"id":"chg_01a17ff4-ed20-708a-8685-ff8259b8328a","kind":"check.measure","summary":"Schema quality (74 → 85)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a17ff4-ed20-708a-8685-ff8259b8328a"},{"id":"chg_01a17ff4-ed25-7622-95dd-a43617d0fffd","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a17ff4-ed25-7622-95dd-a43617d0fffd"},{"id":"chg_01a17ff4-ed26-723e-8f73-25d338893471","kind":"check.measure","summary":"Schema quality (fair → good)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob#chg-chg_01a17ff4-ed26-723e-8f73-25d338893471"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob/changelog.json"},"links":{"html":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob","markdown":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob.md","changelogJson":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob/changelog.json","changelogRss":"https://verifymcp.io/servers/aashishmahajan-kube-noob/kube-noob.xml","external":[{"label":"PyPI project","href":"https://pypi.org/project/kube-noob/"},{"label":"Socket report","href":"https://socket.dev/pypi/package/kube-noob"}]}}