Kubernetes manifest cross-reference check

$0.005 USDC per call · Developer and security · POST /api/v1/k8s-crosscheck · Id k8s-crosscheck

Parses up to 20 Kubernetes YAML manifests and checks that they agree with each other, for an agent that generated or edited manifests before kubectl apply: Service selectors against pod template labels (with the nearest near-miss), named targetPorts against containerPort names, Service port naming, Deployment selector against its template labels, Ingress backends against Services, and ConfigMap/Secret names and keys referenced by env, envFrom, volumes and imagePullSecrets. It does not render Helm or Kustomize, contact a cluster, validate against the OpenAPI schema, or read Secret values (only key names). References to objects absent from the supplied files are reported as unverified, not as errors, unless closedWorld is true.

What you get

A one-character label typo leaves a Service with no endpoints and the deploy still applies cleanly. The cross-check catches it before apply.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/k8s-crosscheck. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/k8s-crosscheck \
  -H 'content-type: application/json' \
  -d '{"manifests":["apiVersion: apps/v1\nkind: Deployment\nmetadata: {name: web}\nspec:\n  selector: {matchLabels: {app: web}}\n  template:\n    metadata: {labels: {app: web}}\n    spec:\n      containers:\n      - name: web\n        image: nginx\n        ports: [{name: http, containerPort: 8080}]\n        envFrom: [{configMapRef: {name: web-config}}]\n---\napiVersion: v1\nkind: Service\nmetadata: {name: web}\nspec:\n  selector: {app: web}\n  ports: [{port: 80, targetPort: http}]\n---\napiVersion: v1\nkind: ConfigMap\nmetadata: {name: web-config}\ndata: {LEVEL: info}\n"]}'

Input

Field	Type	Required	Description
`manifests`	array<string; length 0..200000>; max 20 items	yes	YAML text, multi-document allowed. At most 24000 characters in total (the parser costs about 1 ms per 1,000 characters).
`closedWorld`	boolean	no	Declare that the manifests are the complete set: a reference to an object that is not supplied then fails instead of staying unverified.

Example request body

{
  "manifests": [
    "apiVersion: apps/v1\nkind: Deployment\nmetadata: {name: web}\nspec:\n  selector: {matchLabels: {app: web}}\n  template:\n    metadata: {labels: {app: web}}\n    spec:\n      containers:\n      - name: web\n        image: nginx\n        ports: [{name: http, containerPort: 8080}]\n        envFrom: [{configMapRef: {name: web-config}}]\n---\napiVersion: v1\nkind: Service\nmetadata: {name: web}\nspec:\n  selector: {app: web}\n  ports: [{port: 80, targetPort: http}]\n---\napiVersion: v1\nkind: ConfigMap\nmetadata: {name: web-config}\ndata: {LEVEL: info}\n"
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`objects`	integer	no	Objects parsed.
`findings`	array<object>	no	Capped at 100.
`findingCount`	integer	no
`unverified`	array<object>	no	References whose target is not in the supplied manifests.
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the infra-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent