chore(deps): update dependency octocode-mcp to v18.2.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
octocode-mcp (source)	18.0.1 → 18.2.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

bgauryy/octocode (octocode-mcp)

v18.2.2

Compare Source

v18.2.1

Compare Source

v18.2.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🔒 MCP Security Scan Results

❌ octocode-mcp

• Status: Failed
• Tools scanned: 14
• Vulnerabilities found: 1

Security issues detected:

• [AITech-1.1] Explicit attempts to override, replace, or modify the model's system instructions, operational directives, or behavioral guidelines through direct user input, causing the model to follow attacker-controlled instructions instead of its intended programming (e.g., "Ignore previous instructions").

Allowed issues (not blocking):

• [AITech-8.2] Unintentional and/or unauthorized exposure or exfiltration of sensitive information, such as private or sensitive data, intellectual property, and proprietary algorithms through exploitation of agent tools, integrations, or capabilities, where the agent is manipulated to use legitimate tools for malicious data exfiltration purposes. (Allowed: Flagged on localSearchCode and localFindDeadCode, both read-only local
  file search/analysis tools that return results to the calling agent.
  This is the same allowlisted finding carried forward from v16.0.0 (see
  PR chore(deps): update dependency octocode-mcp to v16 - abandoned #776), where the equivalent tools (ghSearchCode, localViewStructure)
  tripped the same YARA heuristic on caching/cloning/structured-output
  phrasing without a new data path. Verified directly against the
  @octocodeai/octocode-tools-core v18.0.1 source: localSearchCode wraps
  ripgrep/AST search over local files, and localFindDeadCode performs
  local static analysis for unused exports. Both operate only on the
  local filesystem the agent already has access to.
  )
• [AITech-8.2] Unintentional and/or unauthorized exposure or exfiltration of sensitive information, such as private or sensitive data, intellectual property, and proprietary algorithms through exploitation of agent tools, integrations, or capabilities, where the agent is manipulated to use legitimate tools for malicious data exfiltration purposes. (Allowed: Flagged on localSearchCode and localFindDeadCode, both read-only local
  file search/analysis tools that return results to the calling agent.
  This is the same allowlisted finding carried forward from v16.0.0 (see
  PR chore(deps): update dependency octocode-mcp to v16 - abandoned #776), where the equivalent tools (ghSearchCode, localViewStructure)
  tripped the same YARA heuristic on caching/cloning/structured-output
  phrasing without a new data path. Verified directly against the
  @octocodeai/octocode-tools-core v18.0.1 source: localSearchCode wraps
  ripgrep/AST search over local files, and localFindDeadCode performs
  local static analysis for unused exports. Both operate only on the
  local filesystem the agent already has access to.
  )

---

Summary: Scanned 1 MCP server(s), found 1 security issue(s).

⚠️ Action Required: Security issues were detected. Please review and address them before merging.