diff --git a/npx/mcp-server-neon/spec.yaml b/npx/mcp-server-neon/spec.yaml deleted file mode 100644 index b25e9f94..00000000 --- a/npx/mcp-server-neon/spec.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Neon MCP Server Configuration -# MCP server for interacting with Neon Management API and databases -# Package: https://www.npmjs.com/package/@neondatabase/mcp-server-neon -# Repository: https://github.com/neondatabase-labs/mcp-server-neon -# Will build as: ghcr.io/stacklok/dockyard/npx/mcp-server-neon:0.6.3 - -metadata: - name: mcp-server-neon - description: "MCP server for interacting with Neon Management API and databases" - protocol: npx - -spec: - package: "@neondatabase/mcp-server-neon" - version: "0.6.5" - -provenance: - repository_uri: "https://github.com/neondatabase-labs/mcp-server-neon" - repository_ref: "refs/heads/main" - -security: - # Server requires NEON_API_KEY to start - cannot be scanned in CI - insecure_ignore: true - allowed_issues: - - code: "AITech-12.1" - reason: "Tool descriptions use structured XML-like documentation (e.g., , ) to provide AI assistants with workflow guidance. This is legitimate documentation pattern for MCP tools, not tool poisoning." - - code: "AITech-1.1" - reason: "Tool descriptions contain SQL examples and structured workflow instructions with MUST directives for database migration and query tuning tools. These are legitimate documentation patterns, not prompt injection attacks." - - code: "AITech-9.1" - reason: "SQL examples in prepare_database_migration tool description (e.g., ALTER TABLE, SELECT) are documentation showing usage patterns, not SQL injection payloads." - - code: "AITech-8.2" - reason: "The provision_neon_auth tool legitimately provisions authentication credentials and explains how to use them. References to credential names in documentation are necessary for proper tool usage, not credential harvesting."