fix: critical security and stability improvements#1
Merged
dusterbloom merged 4 commits intomainfrom Aug 8, 2025
Merged
Conversation
## Security Fixes - Replace hardcoded "slowcat-secret" token with MCPO_API_KEY env var - Remove "." from default file_tools allowed_dirs (no repo root access) - Fix truncation detection bug that could cause incorrect file read results ## Stability Fixes - Replace global monkey-patching with dependency injection in config_minimal.py - Make HuggingFace offline mode conditional instead of forced - Add proper cleanup and context management for minimal config ## Breaking Changes - MCPO_API_KEY environment variable now required for MCP tool discovery - File tools no longer access current directory by default 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit triggers security-tests.yml workflow to validate: - Hardcoded secret elimination - File access restrictions - Component isolation - Environment variable requirements Expected: All tests PASS ✅ 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
The security fix correctly returns {} when MCPO_API_KEY is missing.
Updated test to match the actual (correct) behavior.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
dusterbloom
added a commit
that referenced
this pull request
Aug 9, 2025
fix: critical security and stability improvements
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fixes
Stability Fixes
Breaking Changes