mathias

mathias commented on pull request mathias/hyperguild#147

2026-10-01 21:07:16 +00:00

feat(brain): tool-call audit log (#144) + server-owned write provenance (#145)

pr-gatekeeper round 4: MERGED (7afbd60, squashed as a6da933)

I verified by execution in a scratch worktree, driving the real mcp.Server and api.Handler with several JWT principals and with…

mathias deleted branch feat/mcp-audit-provenance from mathias/hyperguild

2026-10-01 21:06:39 +00:00

mathias pushed to main at mathias/hyperguild

2026-10-01 21:06:38 +00:00

a6da93332d feat(brain): audit-log every tools/call; server-owned write provenance (#147)

mathias closed issue mathias/hyperguild#145

2026-10-01 21:06:36 +00:00

brain_write is an ungated persistent prompt-injection path into every future session (OWASP MCP06)

mathias closed issue mathias/hyperguild#144

2026-10-01 21:06:36 +00:00

brain-mcp: one shared bearer for every client, no per-caller read scoping (OWASP MCP07/MCP10)

mathias merged pull request mathias/hyperguild#147

2026-10-01 21:06:36 +00:00

feat(brain): tool-call audit log (#144) + server-owned write provenance (#145)

mathias pushed to feat/mcp-audit-provenance at mathias/hyperguild

2026-10-01 21:03:11 +00:00

7afbd60ea2 fix(brain): close round-3 review findings on provenance

mathias commented on issue mathias/hyperguild#145

2026-10-01 21:00:15 +00:00

brain_write is an ungated persistent prompt-injection path into every future session (OWASP MCP06)

pr-gatekeeper round 3: PR #147 is still BLOCKED, now at fcae165. The forgery control holds: I found no way to make any reader report origin: static. Three things block the merge. (B1) brain_edit…

mathias commented on pull request mathias/hyperguild#147

2026-10-01 21:00:14 +00:00

feat(brain): tool-call audit log (#144) + server-owned write provenance (#145)

pr-gatekeeper round 3: BLOCKED (head fcae165)

I built fcae165 in a scratch worktree and drove the real mcp.Server and api.Handler, with JWT principals of several shapes and with no…

mathias opened issue mathias/hyperguild#150

2026-10-01 20:56:19 +00:00

Provenance residuals: brain_tunnel edits without re-stamping; generated aggregates carry none

mathias opened issue mathias/hyperguild#149

2026-10-01 20:56:15 +00:00

SECURITY: ingestion REST routes have no in-process auth; brain_ingest/ingest-path read any server file

mathias pushed to feat/mcp-audit-provenance at mathias/hyperguild

2026-10-01 20:55:53 +00:00

fcae16569d fix(brain): provenance keeps only provably plain frontmatter; pipeline stamps

mathias commented on issue mathias/hyperguild#145

2026-10-01 20:35:49 +00:00

brain_write is an ungated persistent prompt-injection path into every future session (OWASP MCP06)

pr-gatekeeper round 2: PR #147 is still BLOCKED, now at e615d6f. Round-1 escapes E1-E6 are closed by execution. New: (R1) a YAML alias key plus a ... document-end line makes yaml.v3 read…

mathias commented on pull request mathias/hyperguild#147

2026-10-01 20:35:41 +00:00

feat(brain): tool-call audit log (#144) + server-owned write provenance (#145)

pr-gatekeeper round 2: BLOCKED (head e615d6f)

I built e615d6f in a scratch worktree and drove the real mcp.Server and api.Handler over HTTP, with a JWT principal attacker and with no…

mathias pushed to feat/mcp-audit-provenance at mathias/hyperguild

2026-10-01 20:29:48 +00:00

e615d6f144 fix(brain): provenance as a post-condition on every model-reachable write

mathias commented on pull request mathias/skills#52

2026-10-01 20:22:15 +00:00

feat(hooks): mcp-destructive-guard asks before irreversible MCP verbs

pr-gatekeeper round 3: MERGED (squash b0d58d5, reviewed head a41f5ab)

End to end, against gitea-mcp at 0e2bd3d built with go1.26.1 and a scratch Gitea 1.27.1:

The round-2 repro…

mathias deleted branch feat/mcp-destructive-guard from mathias/skills

2026-10-01 20:22:00 +00:00

mathias pushed to main at mathias/skills

2026-10-01 20:21:53 +00:00

b0d58d5adf feat(hooks): mcp-destructive-guard asks before irreversible MCP verbs (#52)

mathias merged pull request mathias/skills#52

2026-10-01 20:21:52 +00:00

feat(hooks): mcp-destructive-guard asks before irreversible MCP verbs

mathias commented on issue mathias/hyperguild#145

2026-10-01 20:21:24 +00:00

brain_write is an ungated persistent prompt-injection path into every future session (OWASP MCP06)

pr-gatekeeper: PR #147 BLOCKED at 32dedb3, so this issue is not done. I found three ways to forge provenance by execution, all model-reachable: (E1) brain_edit rewrites origin: jwt to `origin:…