[jdx]

https://entire.io/gh/jdx/mise/trails/427

Requested by Jeff

The MCP run_task tool passed the caller's task straight to mise run, so a task name beginning with - was parsed as a flag. MCP callers are AI agents; the tool should only ever run the task it names.

Before: run_task with task: "--raw" ran mise run --raw (the default task with raw I/O); task: "--cd=/path" ran default in another directory.

After: the call fails with an INVALID_PARAMS error:

invalid task name '--raw': task names cannot start with '-'

An empty name is rejected too (invalid task name '': a task name is required). Normal names such as build, //sub:build, lint:fix and a-b are unchanged, and args were already passed after --.

Tests: unit tests for rejected and accepted names; clippy clean.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: 2.1.289.

🤖 Generated with Claude Code

---

Note

Low Risk
Input validation on the MCP tool path only; valid task names behave as before and the change reduces mistaken or abusive flag injection from MCP clients.

Overview
Hardens the MCP run_task tool so caller-supplied task names cannot be interpreted as mise run CLI flags.

run_task now runs validate_task_name before spawning mise run. Empty names and any name starting with - (e.g. --raw, --cd=/tmp) return INVALID_PARAMS with explicit messages instead of running unintended behavior such as the default task with raw I/O or a different working directory. Legitimate task names (build, //sub:build, lint:fix, etc.) are unchanged; task arguments still go after --.

Unit tests cover rejected flag-like/empty names and accepted normal names.

^{Reviewed by Cursor Bugbot for commit b87e829. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Task names that are empty or begin with a hyphen are now rejected before running, preventing them from being treated as command options.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: d5064582-e137-4cd8-a00b-58041cd428f3

📥 Commits

Reviewing files that changed from the base of the PR and between 5b57299 and b87e829.

📒 Files selected for processing (1)

• src/cli/mcp.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The MCP task runner now rejects empty task names and names beginning with a hyphen before it resolves or launches the executable. Tests cover rejected names and accepted task-name forms.

Changes

Task name validation

Layer / File(s)	Summary
Task validation and execution src/cli/mcp.rs	run_task validates the task name before resolving the executable or spawning a child process. The validator returns INVALID_PARAMS for empty names and names beginning with -. Tests cover these cases and accepted task names.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: risu729

Merge Risk: ⚪ Minimal · up to b87e8

Empty and flag-like task names are rejected before execution, while valid task names and arguments retain the existing path. No actionable merge-blocking risk is evident.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b87e8

The change rejects ambiguous task names before execution and preserves the existing path for accepted names. No introduced or worsened security concern was established. Project tasks retain their existing authority to run with the user's permissions; broader execution isolation remains outside the verified scope.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed control applies to MCP callers supplying task names. It reduces option-like input reachability without granting new identity, directory, or process authority. Accepted project tasks retain their pre-existing ability to affect resources available to the executing user; this is not an established new exposure.

Trust Boundaries and Controls

• observed — The new control prevents caller-controlled task strings beginning with a hyphen from being interpreted as mise run options, including options that change execution directory or mode. The existing -- separator continues to distinguish task arguments from CLI options. This is a task-name control, not a restriction on what an authorized project task may execute.

Resilience and Maintainability Implications

• observed — Rejected requests terminate before acquiring a child process or running-PID guard, so the new rejection path requires no execution rollback. Repeating or concurrently submitting rejected inputs does not reach task execution. Accepted requests retain the existing spawn-error, timeout, wait-error, success, and failure paths, including the existing kill-on-drop setting; descendant-process cleanup guarantees were not independently established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting run_task task names that start with a dash.
Docstring Coverage	✅ Passed	Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds input validation to the task execution handler.

This PR appears safe to merge; no actionable issues were found.

What we checked:

• Task names cannot become flags: run_task rejects names starting with - before starting the child. Accepted names remain one command argument.

Summary

run_task now rejects empty and dash-prefixed task names with INVALID_PARAMS before starting a child process.

• Other names and task arguments keep their existing behavior.
• New unit tests cover rejected names, accepted names, and the error message for --raw.
• No actionable issues found. Tests were not run during this review.

_{Reviews (1) · Last reviewed commit: "fix(mcp): reject run_task task names tha..."}

[github-actions]

Instruction counts

Nothing was compared, and so nothing was gated. No series appears on both sides: either the base has no measurements recorded, or the two were measured on different runner classes, which are deliberately not comparable — counts shift between machine types by more than a real regression does.

New, nothing to compare against: env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, hook-env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, ls on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, registry on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, startup on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{b87e82916202 vs 5b57299abfaa · measured on the runner, not pushed to the history.}