chore: remove .mcp.json (serena is being discontinued) - #16
Merged
Conversation
serena is being discontinued. The committed .mcp.json also configured a command that fetches and runs code from a git URL (uvx --from git+https://github.com/oraios/serena ...) on session start, which a security review correctly flagged as a supply-chain/RCE-shaped config to have committed to a public repository. Only the serena entry was present in the working tree; the file also previously had an unrelated mcp-gemini-cli entry on HEAD, but per the working-tree state that entry is being treated as already removed rather than restored.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThe pull request deletes Changes
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
serena is being discontinued, so remove the committed
.mcp.jsonthat configures it as an MCP server.The
serenaentry runs:This fetches and executes code from a git URL on session start. A security review flagged this shape of config (supply-chain / RCE risk) when committed to a public repository — which is a fair concern regardless of intent, since it means anyone with an MCP-aware tool pointed at this repo gets that command auto-available.
The file previously also had an unrelated
mcp-gemini-clientry, but the working tree had already dropped it before this change, so this PR removes the file entirely rather than reintroducing that entry.Summary by CodeRabbit