# io.github.sophotechlabs/kube-lint-mcp (oci · ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9)

Validate Kubernetes manifests, Helm charts, Kustomize overlays, and FluxCD resources

- Trust score: 34/100 (low)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- oci · `ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9`: 34/100 (this document), [markdown](https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/ghcr-io-sophotechlabs-kube-lint-mcp-0-8-9.md), [page](https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/ghcr-io-sophotechlabs-kube-lint-mcp-0-8-9)
- pypi · `kube-lint-mcp`: 5/100, [markdown](https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/kube-lint-mcp.md), [page](https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/kube-lint-mcp)

## Channel facts

- Registry: `oci`
- Package: `ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 0/100
  - Malware scan not yet available for this package.
  - CVE data not yet available for this package.
  - Install-script risk not yet assessed.
  - Dependency-health data not yet available.
- **Provenance & Transparency**: 6/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 37 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 960 tokens (~80/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add sophotechlabs-kube-lint-mcp -- docker run --rm -i ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9
```

### Codex

```bash
codex mcp add sophotechlabs-kube-lint-mcp -- docker run --rm -i ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sophotechlabs-kube-lint-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  sophotechlabs-kube-lint-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9"]
```

### Other

```json
{
  "mcpServers": {
    "sophotechlabs-kube-lint-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/sophotechlabs/kube-lint-mcp:0.8.9"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 34, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-07-31 (score 30, −4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 34, +33)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: pass

### 2026-07-26 (score 1)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (12)

### `select_kube_context` (~79 tokens)

Select the Kubernetes context for all subsequent operations.
MUST be called before using any other tool.
Does NOT mutate global kubeconfig — context is held in memory only.
IMPORTANT: Do NOT call this automatically.
Always list contexts first and ask the user which context to use.

Input parameters:

- `context` (string, required): Name of the kubectl context to use

### `list_kube_contexts` (~60 tokens)

List available kubectl contexts.
Use this to see available contexts, then ALWAYS present the list
to the user and ask them which context they want to use before
calling select_kube_context.
NEVER automatically select a context without user confirmation.

### `flux_dryrun` (~68 tokens)

Validate FluxCD manifests with kubectl dry-run (client + server).
ALWAYS use this before committing Flux YAML files
to prevent GitOps reconciliation failures.
Requires select_kube_context to be called first.

Input parameters:

- `path` (string, required): Path to YAML file or directory containing manifests (required)

### `flux_check` (~31 tokens)

Run 'flux check' to verify Flux installation and components health.
Requires select_kube_context to be called first.

### `flux_status` (~28 tokens)

Get Flux reconciliation status for all resources across namespaces.
Requires select_kube_context to be called first.

### `kustomize_dryrun` (~82 tokens)

Validate Kustomize overlay by building and running kubectl dry-run
(client + server).
ALWAYS use this before committing Kustomize overlay changes
to prevent deployment failures.
Requires select_kube_context to be called first.

Input parameters:

- `path` (string, required): Path to directory containing kustomization.yaml or path to kustomization.yaml file (required)

### `helm_dryrun` (~111 tokens)

Validate Helm chart by rendering and running kubectl dry-run
(client + server).
ALWAYS use this before committing Helm chart changes
to prevent deployment failures.
Requires select_kube_context to be called first.

Input parameters:

- `chart_path` (string, required): Path to Helm chart directory (required)
- `namespace` (string): Namespace for rendering (optional)
- `release_name` (string): Release name for helm template (default: 'release-name')
- `values_file` (string): Path to values file (optional)

### `kubeconform_validate` (~114 tokens)

Validate Kubernetes manifests against JSON schemas offline
using kubeconform. Catches invalid fields, type mismatches,
and missing required fields without a live cluster.
Does NOT require select_kube_context.

Input parameters:

- `kubernetes_version` (string): Kubernetes version for schema lookup (e.g. '1.29.0'). Default: 'master'
- `path` (string, required): Path to YAML file or directory containing manifests (required)
- `strict` (boolean): Reject additional properties not in the schema (default: false)

### `yaml_validate` (~69 tokens)

Validate YAML syntax of Kubernetes manifest files.
Catches syntax errors, duplicate keys, and tab indentation.
Use this as a first-pass check before kubeconform or dry-run.
Does NOT require select_kube_context.

Input parameters:

- `path` (string, required): Path to YAML file or directory containing YAML files (required)

### `argocd_app_list` (~82 tokens)

List all ArgoCD applications with sync and health status.
Uses --core mode (kubeconfig only, no ArgoCD server auth needed).
Requires select_kube_context to be called first.

Input parameters:

- `namespace` (string): Namespace where ArgoCD Application CRs live (optional). Common values: 'argocd', 'argo-cd'

### `argocd_app_get` (~107 tokens)

Get detailed status of a single ArgoCD application including
sync/health status, conditions, and resource statuses.
Uses --core mode (kubeconfig only, no ArgoCD server auth needed).
Requires select_kube_context to be called first.

Input parameters:

- `app_name` (string, required): Name of the ArgoCD Application (required)
- `namespace` (string): Namespace where the Application CR lives (optional). Common values: 'argocd', 'argo-cd'

### `argocd_app_diff` (~129 tokens)

Show diff between live and desired state of an ArgoCD application.
Returns unified diff output showing what would change on sync.
Exit 0 = in sync, exit 1 = has diff, exit 2 = error.
Uses --core mode (kubeconfig only, no ArgoCD server auth needed).
Requires select_kube_context to be called first.

Input parameters:

- `app_name` (string, required): Name of the ArgoCD Application (required)
- `namespace` (string): Namespace where the Application CR lives (optional). Common values: 'argocd', 'argo-cd'

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/ghcr-io-sophotechlabs-kube-lint-mcp-0-8-9#diagnostics

## Score history

- 2026-08-03: 34
- 2026-08-02: 30
- 2026-08-01: 30
- 2026-07-31: 30
- 2026-07-30: 34
- 2026-07-29: 34
- 2026-07-28: 34
- 2026-07-27: 34
- 2026-07-26: 1

## Links

- Changelog RSS feed: https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/ghcr-io-sophotechlabs-kube-lint-mcp-0-8-9/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/ghcr-io-sophotechlabs-kube-lint-mcp-0-8-9/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sophotechlabs-kube-lint-mcp/ghcr-io-sophotechlabs-kube-lint-mcp-0-8-9