ServiceAccount Token Scope Checker

A ServiceAccount token can do exactly what its RoleBindings and ClusterRoleBindings allow. The ServiceAccount Token Scope Checker resolves those bindings locally and shows you the aggregated permissions, so you can spot over-privileged tokens before they ship.

Paste one or more RBAC manifests. The tool maps each ServiceAccount to the Roles / ClusterRoles it is bound to, lists the apiGroups, resources and verbs it can act on, and raises risk flags for cluster-admin, wildcards and Secrets access.

Everything runs in your browser; nothing is uploaded and no cluster connection is made.

• Resolution - follows RoleBindings / ClusterRoleBindings to Roles / ClusterRoles.
• Aggregation - merges rules across multiple bindings.
• Risk flags - cluster-admin, wildcards, Secrets access.
• automount - reports automountServiceAccountToken state.
• Copy / Download / Print - export the report.

1. PasteRBAC manifests (SA + bindings + roles).
2. Generate the scope report.
3. Review permissions and risk flags.

Example 1 - cluster-admin. SA bound to cluster-admin is flagged.

Example 2 - secrets. A Role granting get/list on secrets is flagged.

Example 3 - wildcard. verbs: ["*"] raises a wildcard flag.

• Visibility - see exactly what a token can do.
• Safety - catch over-privileged SAs early.
• Local - nothing leaves the browser.
• Exportable - copy, download or print.