v0.4.1 — MCP Registry listing

janus-mcp is now published to the official MCP Registry as io.github.tonylchang/janus-mcp, with both the PyPI package and the GHCR image as install options. Also adds a janus-mcp-server console-script alias so uvx janus-mcp-server works directly. Includes the Homebrew tap from earlier today: brew install tonylchang/tap/janus-mcp.

Full details: CHANGELOG.md

v0.4.0 — official container image

janus-mcp now ships as a container image: ghcr.io/tonylchang/janus-mcp (linux/amd64 + arm64), for people who want the server without a Python toolchain — and as the deployment foundation for the future in-cluster HTTP sidecar mode.

Supply-chain posture matches the rest of the project: base images digest-pinned, Python dependencies installed hash-verified from uv.lock, non-root user, entrypoint locked to the janus-mcp CLI, published behind the same test gate as PyPI. Pin by digest for reproducible deployments.

claude mcp add kubernetes -- docker run -i --rm \
  -v ~/.kube/config:/home/janus/.kube/config:ro \
  -v ~/.config/janus-mcp:/home/janus/.config/janus-mcp:ro \
  ghcr.io/tonylchang/janus-mcp:latest

Mount layout details (including out-of-band approvals across the container boundary) are in the quick start. No code changes from v0.3.1.

Full details: CHANGELOG.md

v0.3.1 — second security review pass

A patch release from the second adversarial review pass over the whole package, including the new 0.3.0 surface. Upgrading is strongly recommended — several fixes close common real-world redaction leaks:

Redaction: env-dump credential keys (POSTGRES_PASSWORD=, spring.datasource.password:) are now caught (the word-boundary anchor made suffix-keyword keys invisible); quoted multi-word secrets redact in full; AWS/EKS load-balancer hostnames and spec.externalName are masked under mask_external_ips; provider-shaped node names are masked in event messages and logs.

Approval integrity: trigger_cronjob and rollout_undo bind a content hash of the exact template the human approved (re-verified after approval); rollout_restart gains resourceVersion binding; approval burn-on-use is now atomic — one approval can never authorize two executions.

Correctness: janus-mcp --config X serve honors the flag (the config is the security policy); list_namespaces really applies its label selector; ReplicaSet listing paginates so rollback never picks the wrong revision; get_logs respects a lowered log_tail_max; every refusal class is audited.

Upgrade: uv tool upgrade janus-mcp-server (or pipx upgrade janus-mcp-server).

Full details: CHANGELOG.md · Website: https://janus-mcp.ns47.com

v0.3.0 — full-namespace discovery, resource usage, rollouts, and 5 new guarded writes

A capability release closing the gap between janus-mcp and real operator workflows — while keeping all five security invariants intact.

New read tools: list_resources (discover 15 kinds with status summaries), get_resource_usage (kubectl top + requests/limits headroom), get_rollout_status (revision history with a sanitized current-vs-previous template diff — see what changed, never the credentials). Plus Endpoints, ResourceQuota, LimitRange, and PodDisruptionBudget as describable kinds.

New write tools (approval-gated, opt-in via write_tools.enabled, each bound to the state the approver saw): delete_pod (UID-precondition; bare pods refused by default), rollout_undo (card shows the sanitized diff; bound to resourceVersion + approved revision), set_cronjob_suspend, trigger_cronjob, and cordon_node (cluster-scope required; no drain by design).

Verified by 190 unit/security tests — the frame-capture leak test now scripts the entire read+write surface — plus live kind-cluster integration coverage. RBAC manifests updated with per-tool grants.

Upgrade: uv tool upgrade janus-mcp-server (or pipx upgrade janus-mcp-server).

Full details: CHANGELOG.md · Website: https://janus-mcp.ns47.com

v0.2.0 — security hardening

A security-hardening release: a deep review of the redaction pipeline, approval flow, and policy layer found and fixed ten defects — including a CronJob identity-annotation leak, an out-of-band approval bait-and-switch window, fabricated readiness on approval cards, a masked-node-name oracle via field selectors, and IPv6/entropy scrubbing gaps. All fixes ship with regression tests (157 tests + live kind-cluster write-path coverage), and locked dependencies were upgraded past 10 known CVEs.

Upgrading is strongly recommended: uv tool upgrade janus-mcp-server (or pipx upgrade janus-mcp-server).

Full details: CHANGELOG.md
Website: https://janus-mcp.ns47.com