fix: vulnerabilities#2494
Conversation
JivusAyrus
requested review from
a team,
StarpTech,
endigma,
jensneuse and
wilsonrivera
as code owners
WalkthroughReplaced many MCP tool registrations from server.tool(...) to server.registerTool(...) using a config object (title, description, inputSchema). Bumped Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
Router-nonroot image scan passed✅ No security vulnerabilities found in image: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
cli/src/commands/mcp/tools/list-subgraphs.ts (1)
6-39:⚠️ Potential issue | 🟡 MinorPrettier formatting check is failing — fix indentation before merge.
"The register* methods (registerTool, registerPrompt, registerResource) are the recommended approach for new code." The migration to
registerToolis correct and the handler signature (no-args for a tool with no input) matches the SDK pattern.However, the CI pipeline reports a Prettier formatting failure for this file. The handler body (lines 13–38) appears to retain the indentation level from the prior
server.tool()call rather than being properly indented within the newregisterToolwrapper. Runprettier --writeon this file to resolve.
🤖 Fix all issues with AI agents
In `@cli/src/commands/mcp/tools/get-subgraphs.ts`:
- Around line 8-17: Update the project's zod dependency to at least ^3.25.0 to
satisfy the peer dependency required by `@modelcontextprotocol/sdk`@1.26.0: modify
package.json to bump "zod" to "^3.25.0" (or a later compatible version), run
your package manager to update lockfiles (npm/yarn/pnpm install), and rebuild to
ensure types/usages like the inputSchema in server.registerTool (the
z.array(z.string()) and z.string().optional() calls) still compile; if any
breaking changes appear, adjust imports/usages accordingly or consider migrating
to zod@4 after verifying compatibility.
In `@cli/src/commands/mcp/tools/schema-change-proposal-workflow.ts`:
- Around line 19-25: Prettier is failing for this file due to formatting (likely
the long description string in the registerTool call), so run the code formatter
and commit the changes: run prettier --write on this file (or project) and
ensure the registerTool call (the object with title, description, and
inputSchema) is reformatted; if you prefer a minimal manual change, shorten or
break the description string for 'description' in the registerTool invocation so
it conforms to Prettier rules, then re-run prettier and commit the formatted
file.
🧹 Nitpick comments (1)
cli/src/commands/mcp/tools/verify-query-against-remote-schema.ts (1)
14-19: Consider using the sharedToolContexttype for consistency.Other tool files (e.g.,
subgraph-verify-schema-changes.ts,search-docs.ts,supergraph_changelog.ts) use the sharedToolContexttype from./types.js, while this file andverify-query-against-in-memory-schema.tsdefine an inline type. Aligning to the shared type would improve consistency across tools.
JivusAyrus
deleted the
suvij/eng-8728-vanta-remediate-high-vulnerabilities
branch
2 participants
Summary by CodeRabbit
Chores
Refactor
Checklist