mathiasandClaude Opus 5.5 724a997002 feat(mcp): audit-log every tools/call (OWASP MCP08) ...

tools/call dispatched with no record, so repo_delete, pr_merge and
file_delete left no trail in gitea-mcp; only auth acceptance was logged.

One slog record per call: tool, caller, token fingerprint, target
(owner/repo/number/branch/path/tag), outcome, duration. Every other
argument is reduced to args_bytes so the audit line never copies file
content or issue bodies.

Closes #64

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-01 20:34:59 +02:00

..

audit_test.go

feat(mcp): audit-log every tools/call (OWASP MCP08)

2026-10-01 20:34:59 +02:00

audit.go

feat(mcp): audit-log every tools/call (OWASP MCP08)

2026-10-01 20:34:59 +02:00

jsonrpc_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

jsonrpc.go

test(mcp): pin session concurrency, document error codes, assert id round-trip

2026-05-04 20:46:07 +02:00

origin_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

origin.go

feat(mcp): origin allowlist middleware

2026-05-04 20:41:21 +02:00

server_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

server.go

feat(mcp): audit-log every tools/call (OWASP MCP08)

2026-10-01 20:34:59 +02:00

session_test.go

chore(rename): module gitea.d-ma.be → git.d-ma.be/mathias/gitea-mcp (#39)

2026-07-03 22:48:26 +02:00

session.go

feat(mcp): session id store

2026-05-04 20:40:53 +02:00

stdio_test.go

chore(lint): adopt the canonical .golangci.yml from infra/ci-templates

2026-09-05 14:42:59 +02:00

stdio.go

feat(admin): local-only stdio MCP server to mint scoped service-account tokens (dispatch#67)

2026-09-05 11:25:41 +02:00