K8S Manifest Audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited K8S Manifest Audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
k8s-manifest-audit — static audit of Kubernetes manifests via MCP. Powered by kube-linter. Part of the Unbearable Labs audit shop.
Built by [Unbearable Labs](https://github.com/UnbearableDev). Pay-per-event pricing — only billed when a tool is actually called.
Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a Kubernetes manifest or directory of manifests, get back a structured report:
privileged-container, unset-cpu-requirements)63 checks total (31 enabled by default). Covers Deployment, Service, Ingress, ConfigMap, Secret, StatefulSet, DaemonSet, Job, CronJob, NetworkPolicy, RBAC, HPA, PDB, and more.
| Tool | Pricing | Purpose |
|---|---|---|
audit_manifest(yaml_content) | $0.02 | Audit a single YAML string (may contain multi-doc ---) |
audit_directory(files) | $0.02 | Audit multiple files — cross-file checks work correctly |
list_checks(enabled_only=False) | $0.005 | Browse the full 63-check catalog with severity + category |
explain_check(check_id) | $0.005 | Get description + remediation for one specific check |
{
"mcpServers": {
"k8s-manifest-audit": {
"url": "https://unbearable-dev--k8s-manifest-audit.apify.actor/mcp",
"headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
}
}
}| Check ID | Category | Severity (mapped) |
|---|---|---|
privileged-container | security | high |
privilege-escalation-container | security | high |
run-as-non-root | security | high |
env-var-secret | security | high |
host-pid / host-ipc / host-network | security | high |
wildcard-in-rules | rbac | high |
cluster-admin-role-binding | rbac | high |
unset-cpu-requirements | resources | medium |
unset-memory-requirements | resources | medium |
no-liveness-probe / no-readiness-probe | availability | medium |
latest-tag | images | medium |
minimum-three-replicas | availability | medium |
no-rolling-update-strategy | availability | medium |
dangling-service / dangling-ingress | config | low |
use-namespace | config | low |
Use list_checks to get the full, up-to-date catalog.
| Event | USD |
|---|---|
audit_manifest or audit_directory call | $0.02 |
list_checks or explain_check call | $0.005 |
Powered by kube-linter (MIT, StackRox/Red Hat).
Built by Noel @ Unbearable Labs — more like this in the weekly newsletter.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.