{"uid":"cap_3-3khuuqFrwNJ7A16IJN9","slug":"kubernetes-manifest-risk-analyzer-48f419a1","name":"Kubernetes Manifest Risk Analyzer","description":"An autonomous paid API accepting USDC on Base mainnet.","url":"https://47-85-47-24.sslip.io/v1/kubernetes-manifest-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"scenario":{"enum":["risky-production-workload"],"type":"string","description":"Built-in paid Kubernetes manifest-review scenario"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["analysis_id","analyzer_version","label","profile","verdict","risk_score","summary","stats","resources","findings","approval_gates","coverage"],"properties":{"label":{"type":"string"},"stats":{"type":"object"},"profile":{"enum":["baseline","restricted"],"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["BLOCK","WARN","PASS"],"type":"string"},"coverage":{"type":"object"},"findings":{"type":"array","items":{"type":"object"}},"resources":{"type":"array","items":{"type":"object"}},"risk_score":{"type":"integer","maximum":100,"minimum":0},"analysis_id":{"type":"string"},"approval_gates":{"type":"array","items":{"type":"string"}},"analyzer_version":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"label":"paid-demo:risky-production-workload","stats":{"low":2,"high":12,"medium":2,"critical":2,"findings":18,"documents":2,"workloads":1,"containers":1,"secret_value_paths_masked":0},"profile":"restricted","summary":"2 Kubernetes object(s), 1 workload(s), and 1 container(s) produced 18 finding(s): 2 critical, 12 high, 2 medium, 2 low.","verdict":"BLOCK","coverage":{"input_format":"parsed Kubernetes JSON objects","cluster_contacted":false,"pod_security_profile":"restricted","pod_security_standard":"Kubernetes Pod Security Standards","secret_values_returned":false,"runtime_state_evaluated":false,"admission_plugins_evaluated":false,"container_registries_contacted":false},"findings":[{"code":"rbac_wildcard_permission","path":"/rules/0","message":"ClusterRole grants wildcard RBAC permissions.","resource":"ClusterRole/default/payments-admin","severity":"critical","standard":"rbac-least-privilege","remediation":"Replace wildcard verbs, resources, and URLs with the minimum required set."},{"code":"privileged_container","path":"/spec/template/spec/containers/0/securityContext/privileged","message":"Container api disables normal container isolation.","resource":"Deployment/production/payments","severity":"critical","standard":"pod-security-baseline","remediation":"Set privileged to false and grant only the specific capability required."},{"code":"literal_secret_environment_value","path":"/spec/template/spec/containers/0/env/0/value","message":"Container api embeds a secret-like environment variable as a literal value.","resource":"Deployment/production/payments","severity":"high","standard":"secret-handling","remediation":"Use valueFrom.secretKeyRef or an external secret provider."},{"code":"privilege_escalation_not_disabled","path":"/spec/template/spec/containers/0/securityContext/allowPrivilegeEscalation","message":"Container api does not explicitly disable privilege escalation.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-restricted","remediation":"Set securityContext.allowPrivilegeEscalation to false."},{"code":"disallowed_linux_capability","path":"/spec/template/spec/containers/0/securityContext/capabilities/add","message":"Container api adds capabilities outside the baseline allowlist.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-baseline","remediation":"Remove added capabilities and grant only an explicitly allowed capability."},{"code":"restricted_capability_added","path":"/spec/template/spec/containers/0/securityContext/capabilities/add","message":"Container api adds a capability forbidden by the Restricted profile.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-restricted","remediation":"Remove the capability; Restricted permits only NET_BIND_SERVICE."},{"code":"capabilities_not_dropped","path":"/spec/template/spec/containers/0/securityContext/capabilities/drop","message":"Container api does not drop all Linux capabilities.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-restricted","remediation":"Set capabilities.drop to [ALL], then add back only NET_BIND_SERVICE if needed."},{"code":"run_as_non_root_not_required","path":"/spec/template/spec/containers/0/securityContext/runAsNonRoot","message":"Container api is not required to run as a non-root user.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-restricted","remediation":"Set runAsNonRoot: true at the Pod or container level."},{"code":"runs_as_root","path":"/spec/template/spec/containers/0/securityContext/runAsUser","message":"Container api explicitly runs as UID 0.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-restricted","remediation":"Use a non-zero UID and set runAsNonRoot: true."},{"code":"seccomp_profile_missing","path":"/spec/template/spec/containers/0/securityContext/seccompProfile","message":"Container api lacks a Restricted-compatible seccomp profile.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-restricted","remediation":"Set seccompProfile.type to RuntimeDefault or an approved Localhost profile."},{"code":"unconfined_seccomp","path":"/spec/template/spec/containers/0/securityContext/seccompProfile/type","message":"Container api explicitly disables seccomp confinement.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-baseline","remediation":"Use RuntimeDefault or an approved Localhost seccomp profile."},{"code":"host_namespace_network","path":"/spec/template/spec/hostNetwork","message":"Pod shares the host Network namespace.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-baseline","remediation":"Remove hostNetwork: true unless this workload is explicitly isolated and approved."},{"code":"restricted_volume_type","path":"/spec/template/spec/volumes/0","message":"Volume type is outside the Restricted Pod Security allowlist.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-restricted","remediation":"Use configMap, CSI, downwardAPI, emptyDir, ephemeral, PVC, projected, or secret."},{"code":"host_path_volume","path":"/spec/template/spec/volumes/0/hostPath","message":"Pod mounts a path from the host filesystem.","resource":"Deployment/production/payments","severity":"high","standard":"pod-security-baseline","remediation":"Replace hostPath with an allowed volume type or isolate the workload."},{"code":"mutable_image_reference","path":"/spec/template/spec/containers/0/image","message":"Container api uses an unpinned or latest image reference.","resource":"Deployment/production/payments","severity":"medium","standard":"workload-hardening","remediation":"Pin the image by digest or an immutable release tag."},{"code":"resource_bounds_incomplete","path":"/spec/template/spec/containers/0/resources","message":"Container api lacks complete CPU and memory requests or limits.","resource":"Deployment/production/payments","severity":"medium","standard":"workload-hardening","remediation":"Set CPU and memory requests and limits appropriate for the workload."},{"code":"service_account_token_automount","path":"/spec/template/spec/automountServiceAccountToken","message":"Pod does not explicitly disable automatic service-account token mounting.","resource":"Deployment/production/payments","severity":"low","standard":"workload-hardening","remediation":"Set automountServiceAccountToken: false when Kubernetes API access is unnecessary."},{"code":"writable_root_filesystem","path":"/spec/template/spec/containers/0/securityContext/readOnlyRootFilesystem","message":"Container api does not require a read-only root filesystem.","resource":"Deployment/production/payments","severity":"low","standard":"workload-hardening","remediation":"Set readOnlyRootFilesystem: true and mount writable paths explicitly."}],"resources":[{"kind":"ClusterRole","resource":"ClusterRole/default/payments-admin","finding_count":1,"highest_severity":"critical"},{"kind":"Deployment","resource":"Deployment/production/payments","finding_count":17,"highest_severity":"critical"}],"risk_score":100,"analysis_id":"kube-b9d6cd6119ee10800f77","approval_gates":["Remove added capabilities and grant only an explicitly allowed capability.","Remove hostNetwork: true unless this workload is explicitly isolated and approved.","Remove the capability; Restricted permits only NET_BIND_SERVICE.","Replace hostPath with an allowed volume type or isolate the workload.","Replace wildcard verbs, resources, and URLs with the minimum required set.","Set capabilities.drop to [ALL], then add back only NET_BIND_SERVICE if needed.","Set privileged to false and grant only the specific capability required.","Set runAsNonRoot: true at the Pod or container level.","Set seccompProfile.type to RuntimeDefault or an approved Localhost profile.","Set securityContext.allowPrivilegeEscalation to false.","Use RuntimeDefault or an approved Localhost seccomp profile.","Use a non-zero UID and set runAsNonRoot: true."],"analyzer_version":"kubeguard-kubernetes-manifest/1.0"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_rSQfLDE5tOFq-TVmSj7ex","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a built-in risky Kubernetes deployment and ClusterRole against Pod Security Standards, RBAC least privilege, secret handling, image pinning, resource bounds, and network exposure — no live cluster required","exampleAgentPrompt":"Can you run a security risk review on the built-in risky Kubernetes production workload scenario and tell me the risk score, verdict, and any critical findings around RBAC, Pod Security Standards, and secret handling?","exampleUseCases":null,"resultDescription":"Returns a structured JSON object with: analysis_id, analyzer_version, label, profile (baseline or restricted), verdict (BLOCK/WARN/PASS), risk_score (0–100), summary, stats, a list of resources analyzed, detailed findings array, approval_gates required before deployment, and coverage metadata — all without needing access to a live cluster.","failureModes":["Invalid or unsupported scenario value returns an error — only 'risky-production-workload' is accepted","Payment not attached or insufficient USDC causes a 402 response","Malformed query parameters result in a 400 validation error","Service unavailable or timeout if the analysis backend is temporarily down"],"whenToPreferThis":"Use this endpoint when you need a fast, deterministic, offline security audit of Kubernetes manifests against Pod Security Standards and RBAC least privilege — particularly when no live cluster is available. Ideal for CI/CD pipeline gate checks, pre-deployment reviews, or training/demo scenarios. Prefer this over live cluster scanners when you want reproducible results without cluster access or network risk.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:46:34.151Z","isFirstParty":false}