Implement a local MCP server to calculate the final line numbers of the security findings - #41
Conversation
…he security findings.
|
|
||
| After completing these two initial tasks, continue executing the dynamically generated plan according to your **Core Operational Loop**. | ||
|
|
||
| **Final Report Generation** |
There was a problem hiding this comment.
Should this go in the GEMINI.md with other reporting instructions? interested in @shrishabh thoughts as well
There was a problem hiding this comment.
Moved to the GEMINI.md file.
| "securityServer": { | ||
| "command": "node", | ||
| "args": ["${extensionPath}/mcp-server/security.ts"], | ||
| "env": {} |
There was a problem hiding this comment.
maybe remove this for now
| "name": "gemini-cli-security", | ||
| "version": "0.1.0", | ||
| "contextFileName": "GEMINI.md" | ||
| "version": "0.2.0", |
There was a problem hiding this comment.
can you keep this at 0.1.0 until we have Github releases (hopefully soon)
| const safeFilePath = await dependencies.fs.realpath( | ||
| dependencies.path.resolve(CWD, filePath) | ||
| ); | ||
| if (!safeFilePath.startsWith(CWD)) { |
There was a problem hiding this comment.
nit: can you double-check whether CWD contains the trailing separate i.e. /foo/bar/ ... otherwise this isn't an adequate check e.g. /foo/bar vs a similarly named /foo/barbar
There was a problem hiding this comment.
Good catch! Added a path.sep at the end: https://nodejs.org/api/path.html#pathsep
| dependencies.path.resolve(CWD, filePath) | ||
| ); | ||
| if (!safeFilePath.startsWith(CWD)) { | ||
| throw new Error('File path is outside of the current working directory.'); |
There was a problem hiding this comment.
here it throws errors, but elsewhere it "returns" the error. any reason why?
There was a problem hiding this comment.
Good catch. Returning the error here as well.
| if (!safeFilePath.startsWith(CWD)) { | ||
| throw new Error('File path is outside of the current working directory.'); | ||
| } | ||
| const content = await dependencies.fs.readFile(safeFilePath, 'utf-8'); |
There was a problem hiding this comment.
maybe it should return an explicit error fit he file does not exist e.g. to try to help the LLM if it makes a mistake. not entirely sure if it's needed but worth thinking about.
There was a problem hiding this comment.
We do end up returning a file not found error.
…, fix error with CWD.
|
@heltonduarte is this tool I imagine |
This tool is only to be invoked by the extension at the end of the security report generation. It's not meant for users to invoke it directly. |
4 participants
This MCP is a starting point for several other functionalities that can be added to the extension.