Teknium 4494fba140 feat: OSV malware check for MCP extension packages (#5305) ... Before launching an MCP server via npx/uvx, queries the OSV (Open Source Vulnerabilities) API to check if the package has known malware advisories (MAL-* IDs). Regular CVEs are ignored — only confirmed malware is blocked. - Free, public API (Google-maintained), ~300ms per query - Runs once per MCP server launch, inside _run_stdio() before subprocess spawn - Parallel with other MCP servers (asyncio.gather already in place) - Fail-open: network errors, timeouts, unrecognized commands → allow - Parses npm (scoped @scope/pkg@version) and PyPI (name[extras]==version) Inspired by Block/goose extension malware check.		2026-04-05 12:46:07 -07:00
..
browser_providers	Gate tool-gateway behind an env var, so it's not in users' faces until we're ready. Even if users enable it, it'll be blocked server-side for now, until we unlock for non-admin users on tool-gateway.	2026-03-30 13:28:10 +09:00
environments	feat: execute_code runs on remote terminal backends (#5088)	2026-04-04 12:57:49 -07:00
neutts_samples	refactor(tts): replace NeuTTS optional skill with built-in provider + setup flow	2026-03-17 02:33:12 -07:00
__init__.py	Merge branch 'main' into rewbs/tool-use-charge-to-subscription	2026-03-31 08:48:54 +09:00
ansi_strip.py	fix: strip ANSI at the source — clean terminal output before it reaches the model	2026-03-23 07:43:12 -07:00
approval.py	security(approval): fix privilege escalation in gateway once-approval logic	2026-04-05 12:31:27 -07:00
browser_camofox.py	security: redact secrets from auxiliary and vision LLM responses	2026-04-01 12:03:56 -07:00
browser_camofox_state.py	feat(browser): add persistent Camofox sessions and VNC URL discovery (salvage #4400) (#4419)	2026-04-01 04:18:50 -07:00
browser_tool.py	feat(browser): add JS evaluation via browser_console expression parameter (#5303)	2026-04-05 12:42:52 -07:00
checkpoint_manager.py	chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)	2026-03-25 19:47:58 -07:00
clarify_tool.py	chore: remove ~100 unused imports across 55 files (#3016)	2026-03-25 15:02:03 -07:00
code_execution_tool.py	feat: execute_code runs on remote terminal backends (#5088)	2026-04-04 12:57:49 -07:00
credential_files.py	feat: wire skills.external_dirs into all remaining discovery paths	2026-04-03 21:14:42 -07:00
cronjob_tools.py	feat(cron): add script field for pre-run data collection (#5082)	2026-04-04 10:43:39 -07:00
debug_helpers.py	refactor: consolidate debug logging across tools with shared DebugSession class	2026-02-21 03:53:24 -08:00
delegate_tool.py	feat(api): structured run events via /v1/runs SSE endpoint	2026-04-05 12:05:13 -07:00
env_passthrough.py	feat: env var passthrough for skills and user config (#2807)	2026-03-24 08:19:34 -07:00
file_operations.py	fix: remove stale test skips, fix regex backtracking, file search bug, and test flakiness	2026-04-04 10:18:57 -07:00
file_tools.py	perf: fix O(n²) catastrophic backtracking in redact regex + reorder file read guard	2026-04-03 22:40:37 -07:00
fuzzy_match.py	chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)	2026-03-25 19:47:58 -07:00
homeassistant_tool.py	feat(tools): centralize tool emoji metadata in registry + skin integration	2026-03-15 20:21:21 -07:00
image_generation_tool.py	Gate tool-gateway behind an env var, so it's not in users' faces until we're ready. Even if users enable it, it'll be blocked server-side for now, until we unlock for non-admin users on tool-gateway.	2026-03-30 13:28:10 +09:00
interrupt.py	feat: enhance interrupt handling and container resource configuration	2026-02-23 02:11:33 -08:00
managed_tool_gateway.py	fix(tools): add debug logging for token refresh and tighten domain check	2026-04-02 12:40:03 +11:00
mcp_oauth.py	fix(mcp): stability fix pack — reload timeout, shutdown cleanup, event loop handler, OAuth non-blocking (#4757)	2026-04-03 02:29:20 -07:00
mcp_tool.py	feat: OSV malware check for MCP extension packages (#5305)	2026-04-05 12:46:07 -07:00
memory_tool.py	fix(memory): profile-scoped memory isolation and clone support (#4845)	2026-04-03 13:10:11 -07:00
mixture_of_agents_tool.py	fix: guard aux LLM calls against None content + reasoning fallback + retry (salvage #3389) (#3449)	2026-03-27 15:28:19 -07:00
neutts_synth.py	fix(tts): document NeuTTS provider and align install guidance (#1903)	2026-03-18 02:55:30 -07:00
openrouter_client.py	refactor: route ad-hoc LLM consumers through centralized provider router	2026-03-11 20:02:36 -07:00
osv_check.py	feat: OSV malware check for MCP extension packages (#5305)	2026-04-05 12:46:07 -07:00
patch_parser.py	fix: handle addition-only hunks in V4A patch parser (#3325)	2026-03-26 19:38:04 -07:00
process_registry.py	chore: remove ~100 unused imports across 55 files (#3016)	2026-03-25 15:02:03 -07:00
registry.py	feat(mcp): dynamic tool discovery via notifications/tools/list_changed (#3812)	2026-03-29 15:52:54 -07:00
rl_training_tool.py	chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)	2026-03-25 19:47:58 -07:00
send_message_tool.py	fix(matrix): E2EE cron delivery via live adapter + HTML formatting + origin fallback	2026-04-05 11:07:47 -07:00
session_search_tool.py	fix: session_search fallback preview on summarization failure (salvage #3413) (#3478)	2026-03-27 21:27:51 -07:00
skill_manager_tool.py	feat: wire skills.external_dirs into all remaining discovery paths	2026-04-03 21:14:42 -07:00
skills_guard.py	fix: guard aux LLM calls against None content + reasoning fallback + retry (salvage #3389) (#3449)	2026-03-27 15:28:19 -07:00
skills_hub.py	feat(skills): size limits for agent writes + fuzzy matching for patch (#4414)	2026-04-01 04:19:19 -07:00
skills_sync.py	refactor: consolidate get_hermes_home() and parse_reasoning_effort() (#3062)	2026-03-25 15:54:28 -07:00
skills_tool.py	feat: wire skills.external_dirs into all remaining discovery paths	2026-04-03 21:14:42 -07:00
terminal_tool.py	feat: add exit code context for common CLI tools in terminal results (#5144)	2026-04-04 16:57:24 -07:00
tirith_security.py	chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)	2026-03-25 19:47:58 -07:00
todo_tool.py	feat(tools): centralize tool emoji metadata in registry + skin integration	2026-03-15 20:21:21 -07:00
tool_backend_helpers.py	Merge branch 'main' into rewbs/tool-use-charge-to-subscription	2026-03-31 08:48:54 +09:00
transcription_tools.py	refactor: simplify and harden PR fixes after review	2026-04-03 00:50:17 -07:00
tts_tool.py	feat: add MiniMax TTS provider support (speech-2.8)	2026-04-03 22:42:14 -07:00
url_safety.py	fix(security): add SSRF protection to vision_tools and web_tools (hardened)	2026-03-23 15:40:42 -07:00
vision_tools.py	fix: background task media delivery + vision download timeout (#3919)	2026-03-30 02:59:39 -07:00
voice_mode.py	fix: allow voice mode in WSL when PulseAudio bridge is configured	2026-03-31 12:13:33 -07:00
web_tools.py	fix: web_extract fast-fail on scrape timeout + summarizer resilience	2026-04-05 11:16:45 -07:00
website_policy.py	refactor: consolidate get_hermes_home() and parse_reasoning_effort() (#3062)	2026-03-25 15:54:28 -07:00