Repository navigation
feat(security): validate offline MCP catalog approval pins - #2408
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
ci/cd
documentation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Please add a See governance: #898 |
|
Exact-head execution receipt: fetched and checked out Merge HOLD: current-head workflows and independent review are pending. Ruleset 24057160 requires |
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
|
CI evidence update for unchanged head Latest merge HOLD: Python 3.10/3.12, build, Trivy and independent reviews still pending; classic branch-protection requirements remain unreadable (403). PR is unmerged, mergeable but |
There was a problem hiding this comment.
🔵 Needs a closer look
Security-sensitive trusted-pin logic warrants final human review and completion of the pending exact-head gates.
0 open findings
What changed in this PR
Adds an offline, fail-closed validator for comparing recorded MCP tool catalogs against reviewed approval pins.
Changes:
- Adds identity-bound catalog comparison and drift diagnostics.
- Adds hermetic tests covering malformed input and contract drift.
- Adds CI enforcement and documents the trusted-pin boundary.
| File | Description |
|---|---|
scripts/security/audit_local_mcp_configs.py |
Implements catalog records and approval comparison. |
scripts/security/validate_mcp_catalog.py |
Provides the offline validation CLI. |
tests/security/test_mcp_catalog_approval.py |
Tests matching, drift, redaction, and malformed inputs. |
artifacts/security/local-mcp-catalog-approval.md |
Documents approval semantics and limitations. |
artifacts/security/local-mcp-audit-stage-one.md |
References the new comparison stage. |
.github/workflows/ci.yml |
Runs catalog regressions in CI. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
0c6026c to
4314868
Compare
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Add test to verify significance of schema array order.
Closes #2407
Bounded follow-up to #2349 / GRV-780; the parent remains open.
Recorded MCP catalogs previously had an identity-bound hash but no approval comparator. Add a fixture-only CLI that exits zero only when a complete capture exactly matches a separately reviewed approved pin. Split schema/description digests explain drift; the full catalog/tool hashes still block every contract change, including metadata and annotations. Diagnostics emit hashes/codes only. No RugSnare dependency or copied code, server execution, credential lookup, active configuration change or deployment.
The reviewed pin is a trusted file, not a signature. Caller-supplied identity still needs independent provenance/configuration binding. Real capture, launcher containment, credential migration and active runtime/CI enforcement remain in the parent; inventory catalog values are not fabricated.
Local validation on current main
33a3a47e314dbc5d1aff2f5e8a7ccc8f7a684a78plus exact update heade7e06c0e28182f6eede0ecc11b87345990f4cc4b: 12 stdlib offline security tests passed with sockets/DNS/subprocess creation forbidden; 36 workflow-gate tests passed; the extracted GitHub Script body compiled;git diff --checkpassed. All six PR paths classifyneeds_preview=false.Fresh exact-head GitHub result: 28 successful checks and two expected skips, with zero failures and zero pending checks. The required E2E job passed through its explicit not-applicable path: deployment classification and the N/A receipt passed; preview lookup, dependency installation, live E2E execution, result parsing/commenting and the live green-signal step were skipped. Copilot reports zero open findings and GitHub reports zero review threads. This is check evidence, not production-deployment evidence.
Risk: medium, security validation logic; fail-closed on malformed, unapproved, or incompletely listed data. Rollback: revert this patch. Production evidence is not applicable to an offline validator. Exact-head gates passed; squash merge remains separately gated. Parent #2349 remains open.