All-in-one Kubernetes SDK: create, manage, and operate clusters across distributions (Kind, K3d, Talos, VCluster) with built-in GitOps, secrets, AI assistant, and MCP server. Only requires Docker or a Cloud Provider.
SaferSkills independently audited ksail (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
KSail bundles common Kubernetes tooling (kubectl, helm, kind, k3d, vcluster, flux, argocd, …) into a single Go binary. Only Docker is required externally.
Full docs: <https://ksail.devantler.tech>. Treat the docs site and ksail <command> --help as the source of truth; do not paraphrase flag semantics — link users to the relevant page instead.
ksail on PATH (see <https://ksail.devantler.tech/installation/>)HCLOUD_TOKEN for Hetzner, OMNI_SERVICE_ACCOUNT_KEY for Omni)Invoke when the user asks to:
ksail.yaml, native distribution config, k8s/ kustomization)ksail workload cipherksail --help)ksail cluster … — lifecycle: init, create, update, diff, delete, start, stop, info, list, connect, switch, backup, restore, oidc (OIDC authentication: get-token)ksail workload … — apply, create, edit, get, describe, explain, delete, logs, exec, expose, gen, validate, install, scale, rollout, scan, wait, images, export, import, watch, push, reconcile, and cipher (SOPS-based secret management: encrypt, decrypt, edit, import, rotate)ksail tenant … — multi-tenancy: create, deleteksail open … — interfaces: web (browser UI), desktop (native app), chat (AI chat TUI powered by GitHub Copilot), mcp (MCP server — already auto-registered by this plugin)Flag-level docs live under <https://ksail.devantler.tech/cli-flags/>. Reference that page for any non-trivial flag question instead of answering from memory.
Scaffold + launch a local cluster:
ksail cluster init --name my-app # writes ksail.yaml, native config, k8s/kustomization.yaml
ksail cluster create # creates + starts the cluster (Docker required)
ksail cluster connect # opens K9s against the clusterDistribution is chosen via --distribution (Vanilla, K3s, Talos, VCluster, KWOK, EKS). Provider defaults to Docker for local distributions; Talos also supports Hetzner and Omni; EKS requires --provider AWS and ksail cluster create is not yet functional for EKS (cluster init only — see <https://ksail.devantler.tech/distributions/eks/>).
This plugin registers the ksail MCP server via .mcp.json (command: ksail, args: [mcp]). All ksail cluster and ksail workload commands (including the nested ksail workload cipher SOPS operations) are exposed as consolidated MCP tools (cluster_read, cluster_write, workload_read, workload_write). Prefer these tools for cluster/workload operations when running inside Copilot CLI.
ksail cluster delete destroys clusters and (with --delete-storage) local volumes. Confirm intent before running non-interactively.ksail cluster update may recreate clusters when immutable fields change; use --dry-run first.ksail workload cipher encrypt/rotate mutate files in-place; ensure they are committed before rotation.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.