diff --git a/internal/tools/tool_search_test.go b/internal/tools/tool_search_test.go
index b30c7072..2212328e 100644
--- a/internal/tools/tool_search_test.go
+++ b/internal/tools/tool_search_test.go
@@ -186,6 +186,28 @@ func TestToolSearch_FinancialObliqueDiscoverability(t *testing.T) {
 	}
 }
 
+// TestToolSearch_CloudCredentialDiscoverability locks in that the
+// cloud-platform credential decoders, which name themselves by the
+// platform contraction (kubeconfig_decode, gcp_service_account_decode),
+// are reachable by an operator's full-word phrasing. These returned
+// nothing before the kubernetes/k8s/google synonyms were added.
+func TestToolSearch_CloudCredentialDiscoverability(t *testing.T) {
+	cases := map[string]string{
+		"kubernetes config":            "kubeconfig_decode",
+		"k8s credentials":              "kubeconfig_decode",
+		"google cloud service account": "gcp_service_account_decode",
+	}
+	for q, want := range cases {
+		out, err := toolSearchHandler(context.Background(), nil, map[string]any{"query": q, "limit": 8})
+		if err != nil {
+			t.Fatalf("%q: handler: %v", q, err)
+		}
+		if !strings.Contains(out, `"name": "`+want+`"`) {
+			t.Errorf("query %q did not surface %s in the top results:\n%s", q, want, out)
+		}
+	}
+}
+
 // TestToolSearch_AirTagDiscoverability locks in that the Apple Continuity
 // decoders (the AirTag / Find My BLE-tracker sweep) are reachable by the
 // consumer terms operators actually use. All of these returned nothing
diff --git a/internal/toolsearch/search.go b/internal/toolsearch/search.go
index 7be63754..f982361c 100644
--- a/internal/toolsearch/search.go
+++ b/internal/toolsearch/search.go
@@ -92,6 +92,16 @@ var synonyms = map[string][]string{ //nolint:gochecknoglobals
 	"rfid":       {"rfid", "em4100", "t5577", "indala"},
 	"card":       {"nfc", "mifare", "rfid", "emv"},
 	"badge":      {"nfc", "rfid", "wiegand", "pacs"},
+	// Cloud-platform credential triage: the secret-bearing config decoders
+	// name themselves by the platform contraction (kubeconfig_decode,
+	// gcp_service_account_decode), so an operator's full-word phrasing
+	// ("kubernetes config", "google cloud service account") ranked them out
+	// of the top results. These route the spoken platform name to the
+	// contraction the tool name uses. Platform-specific (low collision).
+	"kubernetes": {"kubeconfig"},
+	"k8s":        {"kubeconfig"},
+	"google":     {"gcp"},
+	"gcloud":     {"gcp"},
 	// Financial-data triage: the IBAN / LEI / ISIN / ABA-routing decoder family
 	// (iban_decode, lei_decode, isin_decode, aba_routing_decode) handles the
 	// account / entity / security / US-bank identifiers found in BEC lures,