Stdio MCP porting: structure travels, secrets never do

Stdio MCP porting: structure travels, secrets never docoldteadotai/agent-sync #20 · 5 diagrams

◈ Rendered by PR Lens · crafted with ❤️ by the Coldtea team

100%

01 / 06Command MCP servers now travel with consentCommand structure travels behind --mcp while secret environment values are dropped at scan time.
02 / 06Classifier now drops secret env valuesOnly command, args, and env names travel. Secret values never reach the manifest or downstream code.
03 / 06Guided apply now prompts for masked secretsThe interactive flow shows the full command and asks for missing env values via a masked password prompt.
04 / 06Apply now revalidates manifest commandsChecks argument length, control characters, and portability gates before passing args to claude.
05 / 06Added dedicated stdio MCP test suite519 lines of tests cover classification, sanitization, masked prompts, dry runs, and fail-closed errors.
06 / 06Everything this change touchedCommand MCP export, manifest revalidation, masked secret prompts, and automated test coverage.

esc to leave