feat: add field-level redaction for denied_resources

Add redacted_fields and redaction_mode to denied_resources config entries.
When redacted_fields is set, the resource is allowed through the access
control layer but specified fields have their values replaced with a
redaction marker before being returned to the agent.

Two modes are supported:
- opaque: replaces values with [REDACTED]
- hashed: replaces values with [REDACTED:gen_<id>:<hash>] using
  HMAC-SHA256 with a per-startup random salt for cross-resource
  value correlation without exposing actual content.

Fields use dot-separated paths with * wildcard support that adapts
to the runtime type (map keys or array items).

Config validation ensures redacted_fields requires kind to be set,
preventing accidental security bypasses on entire API groups.

Signed-off-by: Yury Sokov <me@yurzs.dev>

Author: Yurzs

README.md

@@ -222,11 +222,19 @@ log_level = 2
 read_only = true
 toolsets = ["core", "config", "helm", "kubevirt"]
 
-# Deny access to sensitive resources
+# Deny access to sensitive resources (fully blocked)
+[[denied_resources]]
+group = "rbac.authorization.k8s.io"
+version = "v1"
+kind = "ClusterRole"
+
+# Allow Secrets but redact their values (keys and metadata remain visible)
 [[denied_resources]]
 group = ""
 version = "v1"
 kind = "Secret"
+redacted_fields = ["data.*", "stringData.*"]
+redaction_mode = "hashed"
 
 [telemetry]
 endpoint = "http://localhost:4317"

docs/configuration.md

@@ -369,13 +369,23 @@ description = "Get a Kubernetes resource by name. Always specify the namespace e
 
 ### Denied Resources
 
-Prevent access to specific Kubernetes resource types.
+Prevent access to specific Kubernetes resource types, or allow access with field-level redaction.
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `denied_resources` | array | `[]` | List of GroupVersionKind objects that should not be accessible. |
+| `denied_resources` | array | `[]` | List of GroupVersionKind objects that should not be accessible (or should be accessible with redacted fields). |
 
-**Example:**
+Each entry in `denied_resources` supports the following fields:
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `group` | string | required | API group (e.g. `""` for core, `"apps"` for apps/v1) |
+| `version` | string | required | API version (e.g. `"v1"`) |
+| `kind` | string | optional | Resource kind (e.g. `"Secret"`). If omitted, denies the entire group/version. |
+| `redacted_fields` | array | `[]` | Dot-separated field paths to redact instead of denying the resource entirely. Requires `kind` to be set. |
+| `redaction_mode` | string | `"opaque"` | How to redact values: `"opaque"` or `"hashed"`. |
+
+**Example — fully deny resources:**
 ```toml
 # Deny access to Secrets and ConfigMaps
 [[denied_resources]]
@@ -410,6 +420,56 @@ version = "v1"
 kind = "ClusterRoleBinding"
 ```
 
+#### Field-Level Redaction
+
+Instead of fully denying a resource, you can allow access but redact sensitive fields. This is useful for resources like Secrets where the agent needs to see metadata (name, namespace, keys, type, ownership) but should not see actual values.
+
+When `redacted_fields` is set, the resource is allowed through the access control layer and the specified fields have their values replaced with a redaction marker before being returned.
+
+**Example — redact Secret values while keeping metadata and key names visible:**
+```toml
+[[denied_resources]]
+group = ""
+version = "v1"
+kind = "Secret"
+redacted_fields = ["data.*", "stringData.*"]
+redaction_mode = "hashed"
+```
+
+**Path syntax:**
+
+Fields are specified as dot-separated paths with `*` wildcard support. The wildcard adapts to the type it encounters — it iterates keys in a map and items in an array.
+
+| Path | Behavior |
+|------|----------|
+| `data.*` | Redact all values in a map (keys remain visible) |
+| `spec.credentials` | Redact a single field |
+| `spec.template.spec.containers.*.env.*.value` | Traverse arrays and maps to reach nested fields |
+
+**Redaction modes:**
+
+- `opaque` (default): replaces values with `[REDACTED]`
+- `hashed`: replaces values with `[REDACTED:gen_<id>:<hash>]`
+
+Hashed mode uses HMAC-SHA256 with a random salt generated once at server startup. This allows the agent to detect when two different resources reference the same value (e.g. two services using the same connection string) without exposing the actual content. The salt is never persisted and changes on restart. A generation ID is included so consumers can detect when the salt changed and know that hashes from different generations are not comparable.
+
+**More examples:**
+```toml
+# ConfigMap with sensitive data
+[[denied_resources]]
+group = ""
+version = "v1"
+kind = "ConfigMap"
+redacted_fields = ["data.*"]
+
+# CRD with embedded credentials
+[[denied_resources]]
+group = "db.example.com"
+version = "v1"
+kind = "DatabaseConnection"
+redacted_fields = ["spec.credentials.*", "spec.connectionString"]
+```
+
 ### Server Instructions
 
 Provide hints to MCP clients (like Claude Code) about when to use this server's tools. Useful for clients that support **MCP Tool Search**.

pkg/api/config.go

@@ -53,16 +53,24 @@ type ExtendedConfigProvider interface {
 }
 
 type GroupVersionKind struct {
-	Group   string `json:"group" toml:"group"`
-	Version string `json:"version" toml:"version"`
-	Kind    string `json:"kind,omitempty" toml:"kind,omitempty"`
+	Group          string   `json:"group" toml:"group"`
+	Version        string   `json:"version" toml:"version"`
+	Kind           string   `json:"kind,omitempty" toml:"kind,omitempty"`
+	RedactedFields []string `json:"redacted_fields,omitempty" toml:"redacted_fields,omitempty"`
+	RedactionMode  string   `json:"redaction_mode,omitempty" toml:"redaction_mode,omitempty"`
 }
 
 type DeniedResourcesProvider interface {
 	// GetDeniedResources returns a list of GroupVersionKinds that are denied.
 	GetDeniedResources() []GroupVersionKind
 }
 
+// RedactedResourcesProvider provides access to resources that should have specific fields redacted.
+type RedactedResourcesProvider interface {
+	// GetRedactedResources returns a list of GroupVersionKinds with redacted field configurations.
+	GetRedactedResources() []GroupVersionKind
+}
+
 type StsConfigProvider interface {
 	GetStsClientId() string
 	GetStsClientSecret() string
@@ -96,6 +104,7 @@ type BaseConfig interface {
 	ClusterProvider
 	ConfirmationRulesProvider
 	DeniedResourcesProvider
+	RedactedResourcesProvider
 	ExtendedConfigProvider
 	StsConfigProvider
 	ValidationEnabledProvider

pkg/config/config.go

@@ -382,6 +382,16 @@ func (c *StaticConfig) GetDeniedResources() []api.GroupVersionKind {
 	return c.DeniedResources
 }
 
+func (c *StaticConfig) GetRedactedResources() []api.GroupVersionKind {
+	var redacted []api.GroupVersionKind
+	for _, dr := range c.DeniedResources {
+		if len(dr.RedactedFields) > 0 {
+			redacted = append(redacted, dr)
+		}
+	}
+	return redacted
+}
+
 func (c *StaticConfig) GetKubeConfigPath() string {
 	return c.KubeConfig
 }
@@ -550,6 +560,28 @@ func (c *StaticConfig) Validate() error {
 	if err := c.HTTP.Validate(); err != nil {
 		return err
 	}
+	if err := c.validateRedactedResources(); err != nil {
+		return err
+	}
+	return nil
+}
+
+// validateRedactedResources validates redaction-related fields in denied_resources:
+//   - redacted_fields requires kind to be set (cannot redact fields on an entire group/version)
+//   - redaction_mode must be "opaque", "hashed", or empty (defaults to opaque)
+func (c *StaticConfig) validateRedactedResources() error {
+	for i, dr := range c.DeniedResources {
+		if len(dr.RedactedFields) == 0 {
+			continue
+		}
+		if dr.Kind == "" {
+			return fmt.Errorf("denied_resources[%d]: redacted_fields requires kind to be set", i)
+		}
+		mode := dr.RedactionMode
+		if mode != "" && mode != "opaque" && mode != "hashed" {
+			return fmt.Errorf("denied_resources[%d]: invalid redaction_mode %q, must be %q or %q", i, mode, "opaque", "hashed")
+		}
+	}
 	return nil
 }
 

pkg/config/validate_test.go

@@ -639,6 +639,103 @@ func (s *ValidateSuite) TestClusterAuthMode() {
 	})
 }
 
+func (s *ValidateSuite) TestRedactedResources() {
+	s.Run("redacted_fields without kind is rejected", func() {
+		cfg := s.validConfig()
+		cfg.DeniedResources = []api.GroupVersionKind{
+			{
+				Group:          "",
+				Version:        "v1",
+				RedactedFields: []string{"data.*"},
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "redacted_fields requires kind to be set")
+	})
+
+	s.Run("invalid redaction_mode is rejected", func() {
+		cfg := s.validConfig()
+		cfg.DeniedResources = []api.GroupVersionKind{
+			{
+				Group:          "",
+				Version:        "v1",
+				Kind:           "Secret",
+				RedactedFields: []string{"data.*"},
+				RedactionMode:  "invalid-mode",
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "invalid redaction_mode")
+		s.Contains(err.Error(), "invalid-mode")
+	})
+
+	s.Run("opaque redaction_mode is accepted", func() {
+		cfg := s.validConfig()
+		cfg.DeniedResources = []api.GroupVersionKind{
+			{
+				Group:          "",
+				Version:        "v1",
+				Kind:           "Secret",
+				RedactedFields: []string{"data.*"},
+				RedactionMode:  "opaque",
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+
+	s.Run("hashed redaction_mode is accepted", func() {
+		cfg := s.validConfig()
+		cfg.DeniedResources = []api.GroupVersionKind{
+			{
+				Group:          "",
+				Version:        "v1",
+				Kind:           "Secret",
+				RedactedFields: []string{"data.*"},
+				RedactionMode:  "hashed",
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+
+	s.Run("empty redaction_mode defaults to opaque and is accepted", func() {
+		cfg := s.validConfig()
+		cfg.DeniedResources = []api.GroupVersionKind{
+			{
+				Group:          "",
+				Version:        "v1",
+				Kind:           "Secret",
+				RedactedFields: []string{"data.*"},
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+
+	s.Run("denied_resources without redacted_fields is accepted", func() {
+		cfg := s.validConfig()
+		cfg.DeniedResources = []api.GroupVersionKind{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+
+	s.Run("denied_resources without redacted_fields and without kind is accepted", func() {
+		cfg := s.validConfig()
+		cfg.DeniedResources = []api.GroupVersionKind{
+			{
+				Group:   "",
+				Version: "v1",
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+}
+
 func TestValidate(t *testing.T) {
 	suite.Run(t, new(ValidateSuite))
 }

pkg/kubernetes/accesscontrol_round_tripper.go

@@ -155,6 +155,11 @@ func (rt *AccessControlRoundTripper) isAllowed(
 	}
 
 	for _, val := range rt.deniedResourcesProvider.GetDeniedResources() {
+		// Entries with redacted_fields are not full denials — they allow access
+		// but specific fields will be redacted at the tool handler level.
+		if len(val.RedactedFields) > 0 {
+			continue
+		}
 		// If kind is empty, that means Group/Version pair is denied entirely
 		if val.Kind == "" {
 			if gvk.Group == val.Group && gvk.Version == val.Version {

pkg/kubernetes/accesscontrol_round_tripper_test.go

@@ -403,6 +403,31 @@ func (s *AccessControlRoundTripperTestSuite) TestRoundTripForDeniedAPIResources(
 
 	})
 
+
+	s.Run("Redacted fields entries allow access", func() {
+		s.Require().NoError(toml.Unmarshal([]byte(`
+			denied_resources = [ { version = "v1", kind = "Pod", redacted_fields = ["spec.containers.*.env.*.value"] } ]
+		`), rt.deniedResourcesProvider), "Expected to parse redacted resources config")
+
+		s.Run("Get pod is allowed when redacted_fields is set", func() {
+			delegateCalled = false
+			req := httptest.NewRequest("GET", "/api/v1/namespaces/default/pods/my-pod", nil)
+			resp, err := rt.RoundTrip(req)
+			s.NoError(err)
+			s.NotNil(resp)
+			s.True(delegateCalled, "Expected delegate to be called for resource with redacted_fields")
+		})
+
+		s.Run("List pods is allowed when redacted_fields is set", func() {
+			delegateCalled = false
+			req := httptest.NewRequest("GET", "/api/v1/pods", nil)
+			resp, err := rt.RoundTrip(req)
+			s.NoError(err)
+			s.NotNil(resp)
+			s.True(delegateCalled, "Expected delegate to be called for resource list with redacted_fields")
+		})
+	})
+
 	s.Run("RESTMapper error for unknown resource", func() {
 		rt.deniedResourcesProvider = nil
 		delegateCalled = false