open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

fix(mcp-config-validator): remove invented trust field (verify-first)

Browse source 
`.mcp.json` has no per-server `trust` key — verified 2026-06-18 against
code.claude.com/docs/en/mcp + /settings. MCP server approval is
dialog/settings-based (enableAllProjectMcpServers / enabledMcpjsonServers /
disabledMcpjsonServers), never a JSON field. The scanner's "Missing trust
level" (CA-MCP-001, medium) and "Invalid trust level" (high) were false
positives flagging a field that does not exist.

- scanner: delete both trust checks + VALID_TRUST_LEVELS; drop `trust` from
  VALID_SERVER_FIELDS so a stray `trust` is now flagged as an unknown field
- humanizer: remove the two trust-level entries
- knowledge (5 files): point to the real approval mechanism, not a trust field
- fixtures: scrub `trust` (incl. the invalid "local" in optimal-setup)
- tests: flip assertions (no trust-level finding; stray trust -> unknown
  field) + add knowledge-staleness re-freeze guards
- snapshots: reseed (marketplace-medium .mcp.json -8 tokens, hermetic)
- gap-matrix: mark the trust verify-first item DONE

Suite: 853/853 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-18 14:22:56 +02:00
commit b3c572ad46
22 changed files with 110 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

19
tests/knowledge/knowledge-staleness.test.mjs
View file

@ -73,3 +73,22 @@ test('claude-code-capabilities.md documents /config key=value', () => {
const md = read('claude-code-capabilities.md');
assert.match(md, /\/config/, '/config key=value in-session settings (2.1.181)');
});
// MCP `trust` is NOT a real .mcp.json field (verified 2026-06-18 against
// code.claude.com/docs/en/mcp + /settings). Approval is dialog/settings-based.
// These guards stop the corpus from re-fabricating the field.
test('claude-code-capabilities.md does not resurrect the invented MCP `trust` field', () => {
const md = read('claude-code-capabilities.md');
assert.doesNotMatch(md, /"trust":\s*"workspace/,
'the fabricated `trust` field must not return to the .mcp.json schema example');
assert.match(md, /enableAllProjectMcpServers|enabledMcpjsonServers/,
'must document the real MCP approval mechanism');
});
test('configuration-best-practices.md recommends real MCP approval, not a `trust` field', () => {
const md = read('configuration-best-practices.md');
assert.match(md, /enabledMcpjsonServers|enableAllProjectMcpServers/,
'must point to the real settings-based approval mechanism');
assert.doesNotMatch(md, /Set trust levels explicitly/,
'the invented "set trust levels" advice must be gone');
});