Kubernetes Observer — agentic threat model

Not certain from the listing — The agent relies on external LLMs via the MCP host. The primary L1 threat is prompt injection or adversarial reprogramming of the host model to abuse the Kubernetes observation tools and exfiltrate cluster data.

The agent queries live cluster state, logs, metrics, and traces. The primary threat is data exfiltration of sensitive application logs (which may contain PII, credentials, or tokens) and embedding inversion if log data is indexed or vectorized.

Exposes MCP tools for querying Metoro and Kubernetes. Threat includes tool misuse where an attacker manipulates the agent's planning/tool-calling loop to execute unauthorized queries or target specific sensitive pods.

The agent holds observability credentials to a production Kubernetes cluster. Threats include credential theft from the hosting environment, lack of network sandboxing between the MCP server and the cluster, and lateral movement if the credentials have excessive permissions.

Not certain from the listing — There is no mention of built-in guardrails, query rate-limiting, or audit logging for the agent's own actions, creating a blind spot where malicious queries could go undetected.

The agent acts as a high-privilege observer. The main threat is the lack of fine-grained authorization (RBAC) mapping from the LLM user to the Kubernetes cluster, potentially violating compliance frameworks (e.g., SOC2, HIPAA) by exposing raw logs.

Designed as an MCP server to let other agents observe Kubernetes. This introduces multi-agent trust abuse, where a compromised upstream agent can query this agent to map out cluster infrastructure for subsequent attacks.