Release/v2.30.0 - #116
Conversation
… (v2.30.0) - New `init` subcommand: scans the project for agent dirs (claude, codex, gemini, qwen, kiro) and installs the bundled marm-init skill; falls back to a .agents folder when none are found; per-agent --g-<agent> flags install into the home-folder equivalents (global mode, separate from project mode). - Bundle the skill into the package (resources/skills/marm-init/SKILL.md), read via importlib.resources so installs work offline; drift-guard test keeps it byte-identical to the repo-root source. - Refresh the marm-init skill to lead with `marm-memory fast-start-http` and the managed `marm-memory docker` commands; bump skill version 2 -> 3. - Bump package version to 2.30.0.
# Conflicts: # CHANGELOG.md # marm-mcp-server/marm_mcp_server/cli.py
|
Warning Review limit reached
Next review available in: 10 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughChangesMARM v2.30.0 adds Init skill installer
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03c5960b5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| try: | ||
| target.parent.mkdir(parents=True, exist_ok=True) | ||
| existed = target.exists() | ||
| target.write_text(text, encoding="utf-8") |
There was a problem hiding this comment.
When init is run in a cloned project containing a symlink at a detected agent's skills/marm-init/SKILL.md or in one of its parent components, Path.write_text follows that link and overwrites its destination. Because the repository controls this path, invoking the advertised initializer can corrupt another repository or user file; reject symlinked components or atomically replace the directory entry without following it.
Useful? React with 👍 / 👎.
| `claude mcp add --transport http marm-memory http://localhost:8001/mcp --header "Authorization: Bearer <paste-your-key>"` | ||
| 3. Optional, code-graph tools: the container only sees host paths that are | ||
| mounted. Re-run with a repo mount, then index using the container path: | ||
| `marm-memory docker run --repo <host-repo-path>` then |
There was a problem hiding this comment.
When the Docker HTTP path has already run as instructed, repeating marm-memory docker run --repo ... cannot add the mount: services/docker_commands.py::run_container rejects any existing container named marm-mcp-server, including a stopped one. The guided setup should explicitly remove and safely recreate the managed container with the repository mount rather than telling users to rerun this command directly.
Useful? React with 👍 / 👎.
| 1. If the MARM server is not already running, start it now using the runtime and | ||
| transport chosen above (Docker run command or the Python entry point). If it | ||
| is already running, skip the start. | ||
| transport chosen above (`marm-memory fast-start-http` or `marm-memory docker | ||
| run`). If a fast-start-http path already started it, skip the start. |
There was a problem hiding this comment.
When the user selected either local or Docker STDIO in Step 3, Step 4 configured a client-launched STDIO command and there is no persistent server to start. This handoff now offers only fast-start-http or docker run, both of which start the HTTP transport, so the executor starts an unnecessary transport different from the user's selection; skip server startup for STDIO or invoke it through the configured client.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
skills/marm-init/SKILL.md (1)
58-61: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winSecurity Misconfiguration (CWE-494): Download of Code Without Integrity Check
Reachability: External
Pin bootstrap artifacts to the release.
These instructions fetch an implicit latest PyPI package and a mutable
:latestimage, so the v2.30.0 skill can execute a different, unreviewed runtime. Pin the package and image to2.30.0or an approved digest, then regenerate the bundled copy.
skills/marm-init/SKILL.md#L58-L61: pin the pip package and Docker image.marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md#L58-L61: keep the packaged copy byte-identical after pinning.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/marm-init/SKILL.md` around lines 58 - 61, Pin the pip package and Docker image in skills/marm-init/SKILL.md lines 58-61 to version 2.30.0 or an approved immutable digest instead of latest, then regenerate the packaged copy at marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md lines 58-61 so it is byte-identical to the source.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@marm-mcp-server/docker-compose.yml`:
- Line 21: Update the docker-compose service’s image reference and
SERVER_VERSION configuration so they use the same immutable 2.30.0 release,
replacing the latest image tag while preserving the reported version value.
In `@marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md`:
- Around line 73-84: Update the protocol-loading instructions in the skill to
use only the packaged `marm-mcp-server/marm-docs/PROTOCOL.md` by default,
removing remote and repository-local sources from the agent setup path. If
update support is required, only use a remote artifact after validating it
against a package-controlled immutable digest or signature, and do not execute
unverified fetched content as instructions.
- Around line 164-172: Update the “HTTP + Local Python, exposed” instructions to
refuse or clearly mark remote bearer-token access over plaintext http:// as
unsupported. Require a TLS-protected https:// endpoint or a secure reverse proxy
before directing users to pass MARM_API_KEY or an Authorization header, while
preserving localhost-only instructions for non-remote use and adjusting
verification accordingly.
In `@marm-mcp-server/marm_mcp_server/services/skill_install.py`:
- Around line 35-39: Update the file-writing flow in the skill installation
function around target.write_text so refreshed skills are written to a temporary
sibling file first, then atomically replace target only after the temporary
write succeeds. Preserve the existing error response and ensure temporary files
are cleaned up on failure, leaving any existing SKILL.md unchanged.
In `@marm-mcp-server/pyproject.toml`:
- Line 87: Bundle marm-docs/PROTOCOL.md under marm_mcp_server/resources and
include that resource in marm-mcp-server/pyproject.toml package data. Update the
fallback in skills/marm-init/SKILL.md lines 73-77 to resolve the installed
protocol resource, then regenerate
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md lines 73-77
with the same fallback.
In `@marm-mcp-server/tests/test_skill_install.py`:
- Line 8: Remove the unused pytest import from the test_skill_install module so
Ruff no longer reports F401 and release validation passes.
In `@skills/marm-init/SKILL.md`:
- Around line 233-235: The Step 6 startup instructions must branch on the
selected transport: for HTTP, verify whether the MARM server is running and
start the chosen HTTP runtime when needed; for STDIO, skip HTTP startup and hand
off directly to the selected STDIO client command. Apply the same change to
skills/marm-init/SKILL.md lines 233-235 and keep
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md lines
233-235 byte-identical to it.
---
Outside diff comments:
In `@skills/marm-init/SKILL.md`:
- Around line 58-61: Pin the pip package and Docker image in
skills/marm-init/SKILL.md lines 58-61 to version 2.30.0 or an approved immutable
digest instead of latest, then regenerate the packaged copy at
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md lines 58-61
so it is byte-identical to the source.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: eada0e0d-ad25-4059-ba82-7d6dce93aad9
📒 Files selected for processing (24)
CHANGELOG.mdREADME.mddocs/INSTALL-DOCKER.mddocs/INSTALL-LINUX.mddocs/INSTALL-PLATFORMS.mddocs/INSTALL-WINDOWS.mddocs/TECHNICAL-OVERVIEW.mdmarm-mcp-server/Dockerfilemarm-mcp-server/README.mdmarm-mcp-server/docker-compose.ymlmarm-mcp-server/marm-docs/README.mdmarm-mcp-server/marm_mcp_server/__init__.pymarm-mcp-server/marm_mcp_server/cli.pymarm-mcp-server/marm_mcp_server/config/settings.pymarm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.mdmarm-mcp-server/marm_mcp_server/server.pymarm-mcp-server/marm_mcp_server/services/cli_parser.pymarm-mcp-server/marm_mcp_server/services/product_help.pymarm-mcp-server/marm_mcp_server/services/skill_install.pymarm-mcp-server/pyproject.tomlmarm-mcp-server/server.jsonmarm-mcp-server/tests/test_command_smoke.pymarm-mcp-server/tests/test_skill_install.pyskills/marm-init/SKILL.md
📜 Review details
🧰 Additional context used
📓 Path-based instructions (12)
marm-mcp-server/README.md
📄 CodeRabbit inference engine (AGENTS.md)
Treat
marm-mcp-server/README.mdas the generated PyPI variant rather than an independently edited README.
Files:
marm-mcp-server/README.md
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Only flag documentation issues that are materially wrong, misleading for installation/release behavior, or inconsistent with live MCP behavior. Skip style, phrasing, formatting, and wording preferences.
Files:
marm-mcp-server/README.mddocs/INSTALL-PLATFORMS.mddocs/INSTALL-DOCKER.mdmarm-mcp-server/marm-docs/README.mddocs/INSTALL-WINDOWS.mddocs/TECHNICAL-OVERVIEW.mddocs/INSTALL-LINUX.mdREADME.mdskills/marm-init/SKILL.mdCHANGELOG.mdmarm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md
**/*.{py,json}
📄 CodeRabbit inference engine (AGENTS.md)
Keep HTTP and STDIO MCP transports in exact parity; when adding or removing a tool, update the endpoint implementation, HTTP route and whitelist, STDIO registration, server manifest, canonical tool list, documentation, and tests for both transports.
Files:
marm-mcp-server/marm_mcp_server/server.pymarm-mcp-server/marm_mcp_server/__init__.pymarm-mcp-server/marm_mcp_server/services/product_help.pymarm-mcp-server/marm_mcp_server/config/settings.pymarm-mcp-server/marm_mcp_server/cli.pymarm-mcp-server/server.jsonmarm-mcp-server/tests/test_command_smoke.pymarm-mcp-server/marm_mcp_server/services/cli_parser.pymarm-mcp-server/marm_mcp_server/services/skill_install.pymarm-mcp-server/tests/test_skill_install.py
marm-mcp-server/marm_mcp_server/**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
marm-mcp-server/marm_mcp_server/**/*.py: All memory writes must use the serialized asynchronous write queue; do not bypass it.
A semantic-store failure inmarm_log_entrymust never fail the corresponding log write.
Never share SQLite connections between the memory database and the isolated concept-graph database.
Graph and concept failures must never break the seven core memory tools; graph processes start lazily and run degraded on failure.
marm_smart_recallmust keep primary memory ranking authoritative; graph enrichment is bounded, read-only, fail-open, and trimmed before primary results when enforcing limits.
Use one lazy-loaded, lock-serializedjinaai/jina-embeddings-v2-small-enencoder with 512 dimensions; writes must succeed when it is unavailable.
Keep orchestration in its current owner file and extract modules only at real boundaries; prefer the smallest change and avoid speculative abstractions or unused configuration flags.
Use minimal comments that explain only non-obvious reasons; never narrate what the next line does.
When upgrading embeddings from MiniLM, migrate existing data withmarm-mcp-server --migrate-embeddingsbefore restarting.
Files:
marm-mcp-server/marm_mcp_server/server.pymarm-mcp-server/marm_mcp_server/__init__.pymarm-mcp-server/marm_mcp_server/services/product_help.pymarm-mcp-server/marm_mcp_server/config/settings.pymarm-mcp-server/marm_mcp_server/cli.pymarm-mcp-server/marm_mcp_server/services/cli_parser.pymarm-mcp-server/marm_mcp_server/services/skill_install.py
**/*.py
⚙️ CodeRabbit configuration file
**/*.py: Prioritize runtime correctness, async/concurrency safety, SQLite transaction safety, auth/rate-limit behavior, release-breaking packaging issues, and MCP protocol compatibility.
Files:
marm-mcp-server/marm_mcp_server/server.pymarm-mcp-server/marm_mcp_server/__init__.pymarm-mcp-server/marm_mcp_server/services/product_help.pymarm-mcp-server/marm_mcp_server/config/settings.pymarm-mcp-server/marm_mcp_server/cli.pymarm-mcp-server/tests/test_command_smoke.pymarm-mcp-server/marm_mcp_server/services/cli_parser.pymarm-mcp-server/marm_mcp_server/services/skill_install.pymarm-mcp-server/tests/test_skill_install.py
marm-mcp-server/marm-docs/README.md
📄 CodeRabbit inference engine (AGENTS.md)
Treat
marm-mcp-server/marm-docs/README.mdas the generated text-only agent-facing README subset rather than an independently edited source.
Files:
marm-mcp-server/marm-docs/README.md
marm-mcp-server/Dockerfile
📄 CodeRabbit inference engine (AGENTS.md)
Update the Docker image version label when bumping the project version.
Files:
marm-mcp-server/Dockerfile
marm-mcp-server/pyproject.toml
📄 CodeRabbit inference engine (AGENTS.md)
When bumping the version, update the package version and audit all required version locations with
python scripts/find-versions.py; follow SemVer: MAJOR for breaking changes, MINOR for tools/parameters/features, PATCH for fixes and documentation.
Files:
marm-mcp-server/pyproject.toml
README.md
📄 CodeRabbit inference engine (AGENTS.md)
The root
README.mdis the single source of truth; README mirrors must be generated and never hand-edited.
Files:
README.md
marm-mcp-server/server.json
📄 CodeRabbit inference engine (AGENTS.md)
Keep all three
server.jsonversion occurrences synchronized, including the Docker identifier.
Files:
marm-mcp-server/server.json
marm-mcp-server/tests/**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
marm-mcp-server/tests/**/*.py: Run tests withpytestfrommarm-mcp-server/; use real FastAPI endpoints and real SQLite, mocking only when it meaningfully speeds tests and matches real behavior with at least 95% fidelity.
Every new MARM Console API route must have at least one happy-path FastAPI response-contract test with the MCP adapter stubbed.
Do not write existence-check or coded-to-pass tests; prefer deep tests exercising real paths over broad shallow coverage.
Usepytest.mark.skiponly for genuinely unavailable dependencies, never merely for effort.
Files:
marm-mcp-server/tests/test_command_smoke.pymarm-mcp-server/tests/test_skill_install.py
**/tests/**
⚙️ CodeRabbit configuration file
**/tests/**: Focus on tests that are flaky, non-isolated, incorrectly asserting behavior, or missing coverage for a changed high-risk path. Skip minor naming, comments, and layout preferences.
Files:
marm-mcp-server/tests/test_command_smoke.pymarm-mcp-server/tests/test_skill_install.py
🪛 GitHub Actions: Ruff CI / 0_ruff.txt
marm-mcp-server/tests/test_skill_install.py
[error] 8-8: ruff check: F401 pytest imported but unused
🪛 GitHub Actions: Ruff CI / ruff
marm-mcp-server/tests/test_skill_install.py
[error] 8-8: ruff check reported an unused import: F401 pytest imported but unused
🪛 GitHub Check: ruff
marm-mcp-server/tests/test_skill_install.py
[failure] 8-8: ruff (F401)
tests/test_skill_install.py:8:8: F401 pytest imported but unused
help: Remove unused import: pytest
🪛 SkillSpector (2.3.11)
skills/marm-init/SKILL.md
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
🔇 Additional comments (12)
docs/INSTALL-DOCKER.md (1)
5-5: LGTM!docs/INSTALL-PLATFORMS.md (1)
1-1: LGTM!docs/INSTALL-WINDOWS.md (1)
5-5: LGTM!Also applies to: 297-297
docs/TECHNICAL-OVERVIEW.md (1)
3-3: LGTM!marm-mcp-server/Dockerfile (1)
76-76: LGTM!marm-mcp-server/README.md (1)
10-10: LGTM!docs/INSTALL-LINUX.md (1)
5-5: LGTM!Also applies to: 323-323
marm-mcp-server/marm-docs/README.md (1)
1-1: LGTM!marm-mcp-server/marm_mcp_server/__init__.py (1)
17-20: LGTM!marm-mcp-server/marm_mcp_server/config/settings.py (1)
125-125: LGTM!marm-mcp-server/marm_mcp_server/server.py (1)
8-8: LGTM!marm-mcp-server/server.json (1)
6-6: LGTM!Also applies to: 20-25
| - SERVER_HOST=0.0.0.0 | ||
| - SERVER_PORT=8001 | ||
| - SERVER_VERSION=2.29.0 | ||
| - SERVER_VERSION=2.30.0 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Pin the image and reported version to the same release.
image: lyellr88/marm-mcp-server:latest can run newer code while SERVER_VERSION=2.30.0 makes health and metadata report 2.30.0. Pin the image to :2.30.0 or derive both values from one immutable release source.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@marm-mcp-server/docker-compose.yml` at line 21, Update the docker-compose
service’s image reference and SERVER_VERSION configuration so they use the same
immutable 2.30.0 release, replacing the latest image tag while preserving the
reported version value.
| 1. Read the full MARM protocol from source: | ||
| `https://raw.githubusercontent.com/Lyellr88/marm-memory/MARM-main/docs/PROTOCOL.md` | ||
| If the network read fails, fall back in this order: | ||
| - local repo `docs/PROTOCOL.md` | ||
| - packaged copy `marm-mcp-server/marm-docs/PROTOCOL.md` | ||
| 2. Freshness check: read the `version:` field in this file's frontmatter and | ||
| compare it against the `version:` in the source copy at `metadata.source`. | ||
| If the source version is higher, tell the user once: | ||
| "Your MARM init skill is out of date. Re-run `marm-memory init` to refresh it." | ||
| Then continue with the version you have. | ||
|
|
||
| Hold the protocol in context. You will operate under it after setup. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files around target:"
git ls-files | rg '(^|/)SKILL\.md$|marm-docs/PROTOCOL\.md$|docs/PROTOCOL\.md$|marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL\.md$' || true
echo
echo "Target excerpt:"
if [ -f marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md ]; then
sed -n '55,95p' marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md | cat -n
fi
echo
echo "Search for installed-protocol behavior / fallback references:"
rg -n "metadata\.source|version:|marm-docs/PROTOCOL\.md|docs/PROTOCOL\.md|PROTOCOL\.md|raw.githubusercontent.com/Lyellr88/marm-memory/MARM-main|network read" .
echo
echo "Inspect resource package files matching protocol/skill names:"
for f in $(git ls-files | rg '(^|/)SKILL\.md$|PROTOCOL\.md$'); do
echo "--- $f ---"
wc -l "$f"
sed -n '1,180p' "$f" | cat -n
done
echo
echo "Inspect changed files/stat if available:"
git diff --stat || trueRepository: Lyellr88/marm-memory
Length of output: 50377
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Frontmatter excerpts:"
for f in \
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md \
skills/marm-init/SKILL.md \
docs/PROTOCOL.md \
marm-mcp-server/marm-docs/PROTOCOL.md
do
if [ -f "$f" ]; then
echo "--- $f ---"
sed -n '1,20p' "$f" | cat -n
fi
done
echo
echo "Relevant helper:"
if [ -f marm-mcp-server/marm_mcp_server/utils/helpers.py ]; then
sed -n '1,120p' marm-mcp-server/marm_mcp_server/utils/helpers.py | cat -n
fi
echo
echo "Exact protocol source references (excluding dist/static/js):"
python3 - <<'PY'
from pathlib import Path
roots = [Path('marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md'), Path('skills/marm-init/SKILL.md')]
lines_found = []
for p in roots:
if p.exists():
for i, line in enumerate(p.read_text().splitlines(), 1):
if 'https://raw.githubusercontent.com/Lyellr88/marm-memory/MARM-main/docs/PROTOCOL.md' in line or line.lstrip().startswith('- ') or 'Run' in line:
if 'docs/PROTOCOL.md' in line or 'local repo' in line or 'packaged copy' in line or 'version:' in line or 'source copy' in line:
lines_found.append((str(p), i, line.strip()))
for item in lines_found:
print(f"{item[0]}:{item[1]} {item[2]}")
PY
echo
echo "Static files with target URL (if any):"
rg -n "https://raw.githubusercontent.com/Lyellr88/marm-memory/MARM-main/docs/PROTOCOL\.md|protocol_source:" \
marm-mcp-server/marm_mcp_server/resources marm-mcp-server -g '!**/*.js' -g '!**/*.map' || trueRepository: Lyellr88/marm-memory
Length of output: 10624
LLM Security (CWE-494): Download of Code Without Integrity Check
Reachability: External
Do not fetch remote protocol/skill content into agent context
This skill asks already-installed agents to read MARM-main/docs/PROTOCOL.md from an unprotected raw GitHub branch and treat it as setup/operator instructions, falling back to repo-local copies before the package-bundled copy. A compromised or updated upstream can inject instructions into installed MCP agents without a package release. Load only bundled package content by default; if updates are needed, keep the remote artifact immutable and verify a package-controlled digest/signature before use.
🧰 Tools
🪛 SkillSpector (2.3.11)
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md` around
lines 73 - 84, Update the protocol-loading instructions in the skill to use only
the packaged `marm-mcp-server/marm-docs/PROTOCOL.md` by default, removing remote
and repository-local sources from the agent setup path. If update support is
required, only use a remote artifact after validating it against a
package-controlled immutable digest or signature, and do not execute unverified
fetched content as instructions.
| ### HTTP + Local Python, exposed (key required) | ||
| Only applies if the user asked for remote/network access in Step 2. Give them | ||
| these steps to run themselves; do not execute steps 1 or 2 on their behalf: | ||
| 1. Generate a key: `marm-memory key generate` | ||
| 2. Start with their own key: `MARM_API_KEY=<paste-your-key> SERVER_HOST=0.0.0.0 marm-memory start` (PowerShell: `$env:MARM_API_KEY="<paste-your-key>"; $env:SERVER_HOST="0.0.0.0"; marm-memory start`) | ||
| 3. Connect their client with their own key: | ||
| `claude mcp add --transport http marm-memory http://localhost:8001/mcp --header "Authorization: Bearer <paste-your-key>"` | ||
|
|
||
| Verify with `curl http://localhost:8001/health` once they confirm it's running. Do not ask them to paste the key into the chat. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
git ls-files | rg '(^|/)SKILL\.md$|MARM_API_KEY|SERVER_HOST|marm-memory' | head -200
echo
echo "== target file lines =="
file="marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md"
if [ -f "$file" ]; then
wc -l "$file"
nl -ba "$file" | sed -n '120,210p'
else
echo "missing $file"
fi
echo
echo "== search for remote/local instructions and auth/env tokens =="
rg -n --text --glob '!*.pyc' 'remote|localhost|0\.0\.0\.0|SERVER_HOST|MARM_API_KEY|Authorization|bearer|bearer-token|bearer token|TLS|HTTPS|http://' marm-mcp-server -S | head -300Repository: Lyellr88/marm-memory
Length of output: 412
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target file lines 140-190 =="
file="marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md"
python3 - <<'PY'
from pathlib import Path
p = Path('marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md')
lines = p.read_text().splitlines()
for i in range(140, 191):
print(f"{i}: {lines[i-1]}")
PY
echo
echo "== other SKILL.md lines around localhost/http sections =="
p="marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md"
python3 - <<'PY'
from pathlib import Path
text = Path('marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md').read_text()
for needle in ['http', 'localhost', '0.0.0.0', 'SERVER_HOST', 'MARM_API_KEY']:
print(f'--- {needle} occurrences in {p} ---')
for j, line in enumerate(text.splitlines(), 1):
if needle in line:
print(f"{j}: {line}")
PY
echo
echo "== search for remote/local instructions and auth/env tokens =="
python3 - <<'PY'
from pathlib import Path
terms = ['remote', 'localhost', '0.0.0.0', 'SERVER_HOST', 'MARM_API_KEY', 'Authorization', 'bearer', 'TLS', 'HTTPS', 'http://']
for path in Path('.').rglob('*'):
if path.is_file() and 'marm-mcp-server' in str(path):
try:
text = path.read_text(errors='ignore')
except Exception:
continue
if any(t in text for t in terms):
print(f'--- {path} ---')
for i, line in enumerate(text.splitlines(), 1):
if any(t in line for t in terms):
print(f"{i}: {line}")
PYRepository: Lyellr88/marm-memory
Length of output: 3835
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file="marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md"
echo "== target file lines =="
python3 - <<'PY'
from pathlib import Path
text = Path('marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md').read_text()
lines = text.splitlines()
for idx in range(1, len(lines)+1):
print(f"{idx}: {lines[idx-1]}")
PY
echo
echo "== remote/network guidance occurrences =="
python3 - <<'PY'
terms = ['remote', 'network', 'localhost', '0.0.0.0', 'SERVER_HOST', 'MARM_API_KEY', 'Authorization', 'bearer', 'Bearer', 'TLS', 'HTTPS', 'http://', 'https://', 'proxy', 'tunnel', 'expose']
path = Path('marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md')
lines = path.read_text(errors='ignore').splitlines()
for i, line in enumerate(lines, 1):
if any(t.lower() in line.lower() for t in terms):
print(f"{i}: {line}")
PYRepository: Lyellr88/marm-memory
Length of output: 15017
Sensitive Data Exposure (CWE-319): Cleartext Transmission of Sensitive Information
Reachability: External
Do not guide remote users to send MARM bearer tokens over plaintext HTTP
The exposed Local Python path binds via SERVER_HOST=0.0.0.0 while Step 6 and the remote override say to use localhost, so users can connect to http://<remote-host>:8001/mcp with an Authorization: Bearer <token> header on an unencrypted endpoint. Treat this as unsupported for remote access unless the endpoint is behind TLS, or block/refuse the bearer-token setup over plaintext http:// endpoints.
🧰 Tools
🪛 SkillSpector (2.3.11)
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 187: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md` around
lines 164 - 172, Update the “HTTP + Local Python, exposed” instructions to
refuse or clearly mark remote bearer-token access over plaintext http:// as
unsupported. Require a TLS-protected https:// endpoint or a secure reverse proxy
before directing users to pass MARM_API_KEY or an Authorization header, while
preserving localhost-only instructions for non-remote use and adjusting
verification accordingly.
|
|
||
| [tool.setuptools.package-data] | ||
| "*" = ["*.json", "*.yaml", "*.yml", "config/*", "templates/*", "models/en_core_web_sm/**/*"] | ||
| "*" = ["*.json", "*.yaml", "*.yml", "config/*", "templates/*", "models/en_core_web_sm/**/*", "resources/**/*"] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Make the advertised offline protocol fallback available in wheels.
The skill falls back to source-checkout paths, while the shown package data only includes resources/**/*; marm-docs/PROTOCOL.md is not a packaged resource. A wheel installation without network access therefore cannot complete Step 0. Bundle the protocol under marm_mcp_server/resources and update the skill to resolve that installed resource.
marm-mcp-server/pyproject.toml#L87-L87: include the bundled protocol resource in the distribution.skills/marm-init/SKILL.md#L73-L77: replace the checkout-relative fallback with the installed resource path.marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md#L73-L77: regenerate the bundled skill with the same fallback.
📍 Affects 3 files
marm-mcp-server/pyproject.toml#L87-L87(this comment)skills/marm-init/SKILL.md#L73-L77marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md#L73-L77
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@marm-mcp-server/pyproject.toml` at line 87, Bundle marm-docs/PROTOCOL.md
under marm_mcp_server/resources and include that resource in
marm-mcp-server/pyproject.toml package data. Update the fallback in
skills/marm-init/SKILL.md lines 73-77 to resolve the installed protocol
resource, then regenerate
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md lines 73-77
with the same fallback.
- test_skill_install: drop unused pytest import (ruff F401, was failing the gate). - skill_install: write skill atomically (temp + os.replace) and refuse symlinked targets, so a failed write cannot truncate an existing skill and a symlinked target is replaced rather than followed. - marm-init skill: correct the code-graph docker instruction (docker run will not alter an existing container; stop/rm then recreate with the mount) and the Step 6 handoff (STDIO paths have no persistent server to start). Both SKILL.md copies kept byte-identical. - docker-compose: pin image to :2.30.0 and teach scripts/find-versions.py to sync the image tag per release so it never drifts from SERVER_VERSION. Deferred (pre-existing protocol-loading design, tracked for a follow-up): remote PROTOCOL.md fetch (CWE-494), plaintext bearer on exposed HTTP (CWE-319), and the offline PROTOCOL.md fallback not shipping in the wheel.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/find-versions.py`:
- Line 59: Update DOCKER_IMAGE_RE and the replacement logic in the
version-update flow to accept only the pinned semver image tag and require
exactly one successful Docker image-tag replacement. If the tag is non-semver,
missing, or replacement count is not one, fail the update instead of reporting
success.
In `@skills/marm-init/SKILL.md`:
- Around line 236-240: The Step 6 HTTP startup instructions must preserve the
selected runtime and its options: in skills/marm-init/SKILL.md lines 236-240,
branch on the selected mode, skip automatic startup for user-run exposed
local-Python flows, and retain Docker exposure options; apply the identical
runtime-selection fix in
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md lines
236-240.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a8076ee4-891e-416f-9100-85029c222a08
📒 Files selected for processing (6)
marm-mcp-server/docker-compose.ymlmarm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.mdmarm-mcp-server/marm_mcp_server/services/skill_install.pymarm-mcp-server/tests/test_skill_install.pyscripts/find-versions.pyskills/marm-init/SKILL.md
💤 Files with no reviewable changes (1)
- marm-mcp-server/tests/test_skill_install.py
🚧 Files skipped from review as they are similar to previous changes (1)
- marm-mcp-server/marm_mcp_server/services/skill_install.py
📜 Review details
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{py,json}
📄 CodeRabbit inference engine (AGENTS.md)
Keep HTTP and STDIO MCP transports in exact parity; when adding or removing a tool, update the endpoint implementation, HTTP route and whitelist, STDIO registration, server manifest, canonical tool list, documentation, and tests for both transports.
Files:
scripts/find-versions.py
**/*.py
⚙️ CodeRabbit configuration file
**/*.py: Prioritize runtime correctness, async/concurrency safety, SQLite transaction safety, auth/rate-limit behavior, release-breaking packaging issues, and MCP protocol compatibility.
Files:
scripts/find-versions.py
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Only flag documentation issues that are materially wrong, misleading for installation/release behavior, or inconsistent with live MCP behavior. Skip style, phrasing, formatting, and wording preferences.
Files:
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.mdskills/marm-init/SKILL.md
🪛 SkillSpector (2.3.11)
marm-mcp-server/marm_mcp_server/resources/skills/marm-init/SKILL.md
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 189: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 189: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
skills/marm-init/SKILL.md
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 189: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes.
Remediation: Pin the version: pip install package==1.2.3
(MCP Rug Pull (RP1))
[warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 189: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Remediation: Pin the image: image:tag or image@sha256:abc123
(MCP Rug Pull (RP1))
[warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
🔇 Additional comments (2)
marm-mcp-server/docker-compose.yml (1)
8-8: LGTM!Also applies to: 21-21
skills/marm-init/SKILL.md (1)
164-184: Duplicate: do not send remote bearer tokens over plaintext HTTP.The exposed local-Python and Docker paths still show
http://MCP URLs withAuthorization: Bearer ...while enabling network access. Require an HTTPS/TLS proxy for remote use, or restrict these instructions to loopback; apply the fix identically to the packaged copy.
| re.IGNORECASE, | ||
| ) | ||
| OCI_IDENTIFIER_RE = re.compile(r"(\"identifier\"\s*:\s*\"[^\"]+:)(\d+\.\d+\.\d+)(\")") | ||
| DOCKER_IMAGE_RE = re.compile(r"(lyellr88/marm-mcp-server:)(\d+\.\d+\.\d+)") |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Reject releases when the Docker image tag is not synchronized.
DOCKER_IMAGE_RE silently skips :latest and other non-semver tags. Since other critical references can still increment count, the script may report a successful update while Docker Compose continues using a floating or stale image. Require exactly one image-tag replacement, or fail when the tag is not a pinned semver release.
Also applies to: 270-275
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/find-versions.py` at line 59, Update DOCKER_IMAGE_RE and the
replacement logic in the version-update flow to accept only the pinned semver
image tag and require exactly one successful Docker image-tag replacement. If
the tag is non-semver, missing, or replacement count is not one, fail the update
instead of reporting success.
Packaged-doc indexing was silently a no-op on pip installs: get_docs_to_load and _index_doc only resolved a source checkout (parent/marm-docs) or the Docker layout (/app/marm-docs), neither of which exists under site-packages, so the marm_system doc index was empty for pip users and only failed with a warning print. - Bundle marm-docs/*.md into marm_mcp_server/resources/marm-docs (ships via the existing resources/**/* package-data; confirmed present in the built wheel). - Resolve the docs dir through a shared _docs_dir() that prefers the packaged copy, then a source checkout, then /app, so pip, Docker, and dev all read one location. - Keep the bundled copy in lockstep: find-versions.py now syncs version strings in resources/marm-docs, and a drift-guard test asserts it stays byte-identical to the source marm-docs.
- marm-init skill Step 6: branch server startup on the mode chosen in Steps 3-4 instead of always offering fast-start-http/docker run. STDIO starts nothing; loopback local-Python uses fast-start-http; exposed local-Python is user-run (do not auto-bind loopback without their key); Docker keeps --expose-network. Applied to both SKILL.md copies (kept byte-identical). - find-versions.py: warn loudly when a docker-compose image file does not have exactly one pinned lyellr88/marm-mcp-server:<semver> tag to sync, so an unpinned :latest regression can't pass silently. Chose a warning over a hard abort to stay consistent with the script's other sync passes and not break mid-edit runs.
1 participant
v2.30.0 One-command skill install
marm-memory initinstalls the MARM skill into your coding agents in a single command, and the guided setup skill now leads with thefast-start-httpone-shot. It runs with no server, database, or network access required.marm-memory initscans the current project for supported agents (Claude, Codex, Gemini, Qwen, Kiro) and installs the MARM skill into each one found, overwriting any existing copy so re-running refreshes it. If no agent directory is present, it falls back to creating a.agents/skills/marm-init/folder.--g-claude,--g-codex,--g-gemini,--g-qwen,--g-kiro) install into the matching home-folder directory instead. Global and project are separate modes; a run does one or the other, never both.resources/skills/marm-init/) and read viaimportlib.resources, so installs work offline and always match the installed version. A test keeps the bundled copy byte-identical to the source skill.marm-memory fast-start-http(one-shot: server + Console + browser, loopback, no key) and the managedmarm-memory dockercommands, preserving the seven-step guided flow and the rule that key values never enter the setup conversation.Additive change, no breaking changes, no migration. Version bumped to 2.30.0 across package metadata and docs. The v2.30.0 changelog entry also records the CLI and Console module splits already merged to
MARM-main, since they ship in this release.Validation: 66 tests pass (full
test_skill_installsuite, static command-inventory match, root-help listing, every command help route, and thecli_outputunit tests).Summary by CodeRabbit
marm-memory initto install the MARM setup skill into detected agents, either per-project or globally.marm-memory fast-start-http, with improved Docker HTTP/STDIO connection guidance and managed Docker key handling.marm-memory initandmarm-memory init --g-claudeusage.