Release v2.23.0 console transition - #98
Conversation
Remove the legacy bundled marm-dashboard runtime from the MCP server package, Docker image, auth middleware, tests, and maintenance scripts. Carry forward Console memory parity and safe mutation work, update public docs toward marm-console, and bump release metadata to v2.23.0.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (55)
💤 Files with no reviewable changes (20)
📜 Recent review details🧰 Additional context used📓 Path-based instructions (10)**/*.md⚙️ CodeRabbit configuration file
Files:
marm-mcp-server/marm_mcp_server/**/*.py📄 CodeRabbit inference engine (AGENTS.md)
Files:
marm-mcp-server/{pyproject.toml,server.json,marm_mcp_server/__init__.py,marm_mcp_server/config/settings.py,marm_mcp_server/server.py,Dockerfile,docker-compose.yml}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.py⚙️ CodeRabbit configuration file
Files:
marm-mcp-server/tests/**/*.py📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/tests/**⚙️ CodeRabbit configuration file
Files:
marm-mcp-server/server.json📄 CodeRabbit inference engine (AGENTS.md)
Files:
marm-mcp-server/marm_mcp_server/server.py📄 CodeRabbit inference engine (AGENTS.md)
Files:
{README.md,docs/PROTOCOL.md,docs/PROTOCOL-LITE.md,marm-mcp-server/marm-docs/README.md,marm-mcp-server/marm-docs/docs/PROTOCOL.md,marm-mcp-server/marm-docs/docs/PROTOCOL-LITE.md}📄 CodeRabbit inference engine (AGENTS.md)
Files:
{README.md,marm-mcp-server/README.md,marm-mcp-server/marm-docs/README.md}📄 CodeRabbit inference engine (AGENTS.md)
Files:
🪛 ast-grep (0.44.1)marm-mcp-server/tests/test_docker_static_config.py[warning] 174-174: Regex pattern passed to re is built from a non-literal (variable, call, concatenation, or f-string) value. If that value is attacker-controlled it can introduce a malicious pattern with catastrophic backtracking (ReDoS). Use a hardcoded literal pattern, or validate/escape untrusted input with re.escape() and bound the regex complexity before compiling. (redos-non-literal-regex-python) 🪛 SkillSpector (2.3.11)skills/marm-init/SKILL.md[info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes. Remediation: Pin the version: pip install package==1.2.3 (MCP Rug Pull (RP1)) [warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 147: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 229: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills. Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation. (Agent Snooping (AS3)) [warning] 139: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted. (Data Exfiltration (E1)) [info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes. Remediation: Pin the version: pip install package==1.2.3 (MCP Rug Pull (RP1)) [warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 147: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 229: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills. Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation. (Agent Snooping (AS3)) [warning] 139: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted. (Data Exfiltration (E1)) [info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes. Remediation: Pin the version: pip install package==1.2.3 (MCP Rug Pull (RP1)) [warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 147: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 229: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills. Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation. (Agent Snooping (AS3)) [warning] 139: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted. (Data Exfiltration (E1)) [info] 58: [RP1] null: pip install without ==version installs the latest release, which could include malicious changes. Remediation: Pin the version: pip install package==1.2.3 (MCP Rug Pull (RP1)) [warning] 60: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 147: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 229: [RP1] null: Docker image references without a specific tag (:latest is implicit) or digest ( Remediation: Pin the image: image:tag or image@sha256:abc123 (MCP Rug Pull (RP1)) [warning] 7: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills. Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation. (Agent Snooping (AS3)) [warning] 139: [E1] External Transmission: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Remediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted. (Data Exfiltration (E1)) 🔇 Additional comments (36)
📝 WalkthroughWalkthroughMARM v2.23.0 removes the bundled dashboard from the MCP server and Docker package, unmounts ChangesDashboard runtime retirement
Release and Console transition
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Validation
Summary by CodeRabbit
New Features
Bug Fixes
Documentation