# Kubernetes Manifest Risk Analyzer

> Kubernetes Manifest Risk Analyzer is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-13).

Audits a built-in risky Kubernetes deployment and ClusterRole against Pod Security Standards, RBAC least privilege, secret handling, image pinning, resource bounds, and network exposure — no live cluster required

## Facts

- Endpoint: GET https://47-85-47-24.sslip.io/v1/kubernetes-manifest-risk
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/kubernetes-manifest-risk-analyzer-48f419a1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3-3khuuqFrwNJ7A16IJN9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability kubernetes-manifest-risk-analyzer-48f419a1
```

Example prompt: Can you run a security risk review on the built-in risky Kubernetes production workload scenario and tell me the risk score, verdict, and any critical findings around RBAC, Pod Security Standards, and secret handling?

## When to prefer this

Use this endpoint when you need a fast, deterministic, offline security audit of Kubernetes manifests against Pod Security Standards and RBAC least privilege — particularly when no live cluster is available. Ideal for CI/CD pipeline gate checks, pre-deployment reviews, or training/demo scenarios. Prefer this over live cluster scanners when you want reproducible results without cluster access or network risk.

## Known failure modes

- Invalid or unsupported scenario value returns an error — only 'risky-production-workload' is accepted
- Payment not attached or insufficient USDC causes a 402 response
- Malformed query parameters result in a 400 validation error
- Service unavailable or timeout if the analysis backend is temporarily down

## How this service works

An autonomous paid API accepting USDC on Base mainnet.

## Output

Returns a structured JSON object with: analysis_id, analyzer_version, label, profile (baseline or restricted), verdict (BLOCK/WARN/PASS), risk_score (0–100), summary, stats, a list of resources analyzed, detailed findings array, approval_gates required before deployment, and coverage metadata — all without needing access to a live cluster.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "scenario": {
       "enum": [
        "risky-production-workload"
       ],
       "type": "string",
       "description": "Built-in paid Kubernetes manifest-review scenario"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "analysis_id",
      "analyzer_version",
      "label",
      "profile",
      "verdict",
      "risk_score",
      "summary",
      "stats",
      "resources",
      "findings",
      "approval_gates",
      "coverage"
     ],
     "properties": {
      "label": {
       "type": "string"
      },
      "stats": {
       "type": "object"
      },
      "profile": {
       "enum": [
        "baseline",
        "restricted"
       ],
       "type": "string"
      },
      "summary": {
       "type": "string"
      },
      "verdict": {
       "enum": [
        "BLOCK",
        "WARN",
        "PASS"
       ],
       "type": "string"
      },
      "coverage": {
       "type": "object"
      },
      "findings": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "resources": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "risk_score": {
       "type": "integer",
       "maximum": 100,
       "minimum": 0
      },
      "analysis_id": {
       "type": "string"
      },
      "approval_gates": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "analyzer_version": {
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "label": "paid-demo:risky-production-workload",
  "stats": {
   "low": 2,
   "high": 12,
   "medium": 2,
   "critical": 2,
   "findings": 18,
   "documents": 2,
   "workloads": 1,
   "containers": 1,
   "secret_value_paths_masked": 0
  },
  "profile": "restricted",
  "summary": "2 Kubernetes object(s), 1 workload(s), and 1 container(s) produced 18 finding(s): 2 critical, 12 high, 2 medium, 2 low.",
  "verdict": "BLOCK",
  "coverage": {
   "input_format": "parsed Kubernetes JSON objects",
   "cluster_contacted": false,
   "pod_security_profile": "restricted",
   "pod_security_standard": "Kubernetes Pod Security Standards",
   "secret_values_returned": false,
   "runtime_state_evaluated": false,
   "admission_plugins_evaluated": false,
   "container_registries_contacted": false
  },
  "findings": [
   {
    "code": "rbac_wildcard_permission",
    "path": "/rules/0",
    "message": "ClusterRole grants wildcard RBAC permissions.",
    "resource": "ClusterRole/default/payments-admin",
    "severity": "critical",
    "standard": "rbac-least-privilege",
    "remediation": "Replace wildcard verbs, resources, and URLs with the minimum required set."
   },
   {
    "code": "privileged_container",
    "path": "/spec/template/spec/containers/0/securityContext/privileged",
    "message": "Container api disables normal container isolation.",
    "resource": "Deployment/production/payments",
    "severity": "critical",
    "standard": "pod-security-baseline",
    "remediation": "Set privileged to false and grant only the specific capability required."
   },
   {
    "code": "literal_secret_environment_value",
    "path": "/spec/template/spec/containers/0/env/0/value",
    "message": "Container api embeds a secret-like environment variable as a literal value.",
    "resource": "Deployment/production/payments",
    "severity": "high",
    "standard": "secret-handling",
    "remediation": "Use valueFrom.secretKeyRef or an external secret provider."
   },
   {
    "code": "privilege_escalation_not_disabled",
    "path": "/spec/template/spec/containers/0/securityContext/allowPrivilegeEscalation",
    "message": "Container api does not explicitly disable privilege escalation.",
    "resource": "Deployment/production/payments",
    "severity": "high",
    "standard": "pod-security-restricted",
    "remediation": "Set securityContext.allowPrivilegeEscalation to false."
   },
   {
    "code": "disallowed_linux_capability",
    "path": "/spec/tem
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/kubernetes-manifest-risk-analyzer-48f419a1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)