◈ Drawn by PR Lens, free for open source
fix(devframe): enforce MCP state exposure policy
devframes/devframe #336
Architecture
Open full size
Container view — Architecture
Applies the exposeSharedState filter predicate to direct devframe://state/<key> resource reads in the MCP server adapter, closing an authorization bypass where callers knowing a key could retrieve shared state even if exposure was disabled or filtered. Direct resource reads now throw diagnostic DF0048 when access is disallowed, ensuring consistent access control across resource discovery, resource reads, and the built-in state read tool.
DEVFRAME CORE ENGINE
Single-Tool Instance Shell
MCP Server Adapter
CHANGED
provides context & shared state RPC
View the pull request on GitHub
fix(devframe): enforce MCP state exposure policy