mathiasandClaude Opus 5.5
9ba7cb2dcd
gitea-mcp authenticates by PAT pass-through, so an agent holds the caller's full PAT scope, and repo_delete's confirm field is filled in by the model. The infra-mcp README said client-side deny lists covered destructive verbs; on 2026-10-01 none existed in any settings file. PreToolUse hook on mcp__.*: repo_delete, file_delete, branch_delete, pr_merge, tbd_ship, repo_update and repo_mirror_push get "ask". Matched on the verb, not the server name, so the connector namespace or a renamed registration cannot bypass it. Never emits allow; malformed input fails closed. Scope limit: MCP calls only. The Gitea REST API via Bash with the PAT in env is not covered (recorded in infra ADR-0027). Refs mathias/infra#508 Bump-Type: minor Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
1.0 KiB
JSON
50 lines
1.0 KiB
JSON
{
|
|
"hooks": {
|
|
"SessionStart": [
|
|
{
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "sh \"${CLAUDE_PLUGIN_ROOT}/bin/doctor\" --quiet",
|
|
"timeout": 5,
|
|
"statusMessage": "Checking skills wiring..."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"UserPromptSubmit": [
|
|
{
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/pre-task-ritual.sh\"",
|
|
"timeout": 5
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"PreToolUse": [
|
|
{
|
|
"matcher": "Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-guard.sh\"",
|
|
"timeout": 5
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": "mcp__.*",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/mcp-destructive-guard.sh\"",
|
|
"timeout": 5
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|