Skip to content

fix(security): audit MCP dispatch and harden tabular imports - #231

Merged
VforVitorio merged 3 commits into
mainfrom
fix/security-227-228
Oct 18, 2026
Merged

VforVitorio merged 3 commits into
mainfrom
fix/security-227-228

Conversation

@VforVitorio

@VforVitorio VforVitorio commented Oct 18, 2026 •

Copy link
Copy Markdown
Owner

Changes

  • Redact provider and tool failures, centralize provider endpoint configuration, and audit every FastMCP dispatch without recording payloads.
  • Bound the browser's CSV and Parquet import before parsing/decompression; rejected files retain the previous dataset.
  • Add OSV, Gitleaks, and CodeQL workflows.
  • Upgrade MCP to 1.30.0 for the fix to CVE-2026-59951 and sentence-transformers to 5.6.0 for the fix to CVE-2026-68770.

Verification

  • Telemetry Python suite: 246 passed.
  • Webapp suite: 198 passed; typecheck, Prettier, and production build passed.
  • Changed-file Ruff, formatting, and lock checks passed.
  • Root F1 StratLab suite: 1,709 passed.
  • GitHub CI, OSV, CodeQL, and Gitleaks are running for this head.

The full pip-audit advisory reports 112 remaining entries across 15 packages after the two scoped upgrades. They are not hidden by this PR; broader dependency remediation remains separate. The root checkout will update its submodule pointer after this PR is merged.

@coderabbitai

coderabbitai Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 18e0a296-fd2f-4c7e-b947-1266b18c9f1f
📥 Commits

Reviewing files that changed from the base of the PR and between 9a25aeb and def94d4.

📒 Files selected for processing: 28
  • .github/workflows/ci.yml
  • .github/workflows/codeql.yml
  • .github/workflows/gitleaks.yml
  • .github/workflows/osv-scanner.yml
  • backend/api/v1/endpoints/chat.py
  • backend/api/v1/endpoints/circuit_domination.py
  • backend/api/v1/endpoints/comparison.py
  • backend/api/v1/endpoints/strategy.py
  • backend/core/config.py
  • backend/core/mcp_audit.py
  • backend/mcp_tools.py
  • backend/services/chatbot/chat_engine.py
  • backend/services/chatbot/llm_service.py
  • backend/services/chatbot/mcp_bridge.py
  • backend/services/simulation/simulator.py
  • backend/verify_dependencies.py
  • tests/fixtures/sse/generate_transcripts.py
  • tests/test_chat_engine.py
  • tests/test_chat_sse.py
  • tests/test_fake_openai.py
  • tests/test_mcp_audit.py
  • tests/test_mcp_bridge.py
  • tests/test_security_gp_boundaries.py
  • tests/test_security_provider_logs.py
  • tests/test_security_public_errors.py
  • tests/test_security_tool_allowlist.py
  • webapp/src/features/race/lib/uploadParse.test.tsx
  • webapp/src/features/race/lib/uploadParse.ts
+--------------------------------------------+
| Let's git serious about your code quality. |
+--------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       /   づ
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

try:
logger.info(
f"Comparing fastest laps: {driver1} vs {driver2} - {year} {gp} {session}")
logger.info(f"Comparing fastest laps: {driver1} vs {driver2} - {year} {gp} {session}")
# No common phase - use overall fastest laps with warning
logger.warning(
f"No common qualifying phase for {driver1} and {driver2}")
logger.warning(f"No common qualifying phase for {driver1} and {driver2}")

logger.info(
f"Fetched telemetry: {driver1} ({len(driver1_data['x'])} points), {driver2} ({len(driver2_data['x'])} points)")
f"Fetched telemetry: {driver1} ({len(driver1_data['x'])} points), {driver2} ({len(driver2_data['x'])} points)"
)
except Exception as exc: # noqa: BLE001 - corpus is optional; degrade to no RCM
logger.warning("Radio/RCM corpus unavailable for %s %d: %s", gp, year, exc)
logger.warning("Radio/RCM corpus unavailable for %s %d (%s)", gp, year, type(exc).__name__)
f" Part {j}: type={part_type}, url_prefix={url[:50]}...")
else:
logger.debug(f" Part {j}: type={part_type}")
logger.debug("Message %d: role=%s, multimodal_parts=%d", i, role, len(content))
else:
logger.debug(
f" Message {i}: role={role}, text={str(content)[:100]}...")
logger.debug("Message %d: role=%s, text_content=true", i, role)
@VforVitorio VforVitorio changed the title fix(security): audit tool dispatch and bound Parquet imports fix(security): audit MCP dispatch and harden tabular imports Oct 18, 2026
@VforVitorio
VforVitorio merged commit 888e4f3 into main Oct 18, 2026
12 checks passed
@VforVitorio
VforVitorio deleted the fix/security-227-228 branch October 18, 2026 16:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants