fix(mcp): judge run_command on the command and flags cobra resolves - #402

Merged

ktn-jamf merged 28 commits into

mainfrom

fix/mcp-run-command-resolved-boundary

Oct 1, 2026

Commits on Sep 30, 2026

test(mcp): run_command boundary repros for resolved spellings and local paths

ktn-jamf
and
claude
committed
6eb4b8b
fix(mcp): judge run_command on the command and flags cobra resolves

ktn-jamf
and
claude
committed
1e6cdad
feat(mcp): allow read-side path flags inside an operator-chosen --input-dir

ktn-jamf
and
claude
committed
1837530
fix(mcp): hold pro diff directory sides to the --input-dir rule

ktn-jamf
and
claude
committed
1a498d4
fix(mcp): address review findings

ktn-jamf
and
claude
committed
7111d7e
fix(mcp): refuse the commands that print an access token

ktn-jamf
and
claude
committed
f77cc32

Commits on Oct 1, 2026

test(mcp): third-party secrets and minted credentials reach the model

ktn-jamf
and
claude
committed
a5ba414
fix(mcp): keep third-party secrets and minted credentials from the model

ktn-jamf
and
claude
committed
41f1f70
test(mcp): credential printers and Classic secret fields reach the model

ktn-jamf
and
claude
committed
9ca8c83
fix(mcp): refuse the remaining credential printers and redact Classic secrets

ktn-jamf
and
claude
committed
9aef814
test(mcp): pro diff prints Classic credential fields to the model

ktn-jamf
and
claude
committed
87f58e0
fix(mcp): mask Classic credential fields in pro diff over MCP

ktn-jamf
and
claude
committed
c5337df
Merge remote-tracking branch 'origin/main' into fix/mcp-run-command-resolved-boundary
ktn-jamf
committed
ccf8ff9
fix(mcp): run cloud-distribution-point list over MCP with the key redacted

ktn-jamf
and
claude
committed
9f23d67
Merge remote-tracking branch 'origin/main' into fix/mcp-run-command-resolved-boundary
ktn-jamf
committed
44ee64a
test(mcp): classify cloud-ldap update in the secret-naming guard

ktn-jamf
and
claude
committed
8b7ab94
Merge branch 'main' into fix/mcp-run-command-resolved-boundary
ktn-jamf
authored
f919e4e
test(mcp): configuration profile payload secrets reach the model

ktn-jamf
and
claude
committed
a7612bf
fix(mcp): redact secrets inside configuration profile payloads

ktn-jamf
and
claude
committed
2b4bd96
docs(mcp): name profile payload redaction and blueprint configuration

ktn-jamf
and
claude
committed
2b9f2de
test(mcp): classify every response that returns a secret-named field

ktn-jamf
and
claude
committed
11e1092
test(mcp): blueprint profile conversion and token-named payload keys leak

ktn-jamf
and
claude
committed
c17fad5
fix(mcp): redact the profile blueprints components configuration-profile downloads

ktn-jamf
and
claude
committed
5070faa
fix(mcp): redact token- and key-named payload values, and say what is shown

ktn-jamf
and
claude
committed
b70aed3
test(mcp): -vvv body logs and cookie headers reach the model

ktn-jamf
and
claude
committed
ad18fdb
fix(client): redact Cookie and Set-Cookie values in the header log

ktn-jamf
and
claude
committed
7ddd0a0
fix(mcp): refuse -vvv body logging over MCP

ktn-jamf
and
claude
committed
ca06b80
test(mcp): -vv, not -vvv, is the verbose level that stays available over MCP

ktn-jamf
and
claude
committed
87b521c

Navigation Menu

fix(mcp): judge run_command on the command and flags cobra resolves - #402

fix(mcp): judge run_command on the command and flags cobra resolves#402
ktn-jamf merged 28 commits into
mainfrom
fix/mcp-run-command-resolved-boundary

Commits on Sep 30, 2026

test(mcp): run_command boundary repros for resolved spellings and local paths

fix(mcp): judge run_command on the command and flags cobra resolves

feat(mcp): allow read-side path flags inside an operator-chosen --input-dir

fix(mcp): hold pro diff directory sides to the --input-dir rule

fix(mcp): address review findings

fix(mcp): refuse the commands that print an access token

Commits on Oct 1, 2026

test(mcp): third-party secrets and minted credentials reach the model

fix(mcp): keep third-party secrets and minted credentials from the model

test(mcp): credential printers and Classic secret fields reach the model

fix(mcp): refuse the remaining credential printers and redact Classic secrets

test(mcp): pro diff prints Classic credential fields to the model

fix(mcp): mask Classic credential fields in pro diff over MCP

Merge remote-tracking branch 'origin/main' into fix/mcp-run-command-resolved-boundary

fix(mcp): run cloud-distribution-point list over MCP with the key redacted

Merge remote-tracking branch 'origin/main' into fix/mcp-run-command-resolved-boundary

test(mcp): classify cloud-ldap update in the secret-naming guard

Merge branch 'main' into fix/mcp-run-command-resolved-boundary

test(mcp): configuration profile payload secrets reach the model

fix(mcp): redact secrets inside configuration profile payloads

docs(mcp): name profile payload redaction and blueprint configuration

test(mcp): classify every response that returns a secret-named field

test(mcp): blueprint profile conversion and token-named payload keys leak

fix(mcp): redact the profile blueprints components configuration-profile downloads

fix(mcp): redact token- and key-named payload values, and say what is shown

test(mcp): -vvv body logs and cookie headers reach the model

fix(client): redact Cookie and Set-Cookie values in the header log

fix(mcp): refuse -vvv body logging over MCP

test(mcp): -vv, not -vvv, is the verbose level that stays available over MCP