Skip to content

Commit 6824e4d

Browse files
DumbrisDumbris
authored
chore: OSS repo hygiene — CoC, issue templates, dependabot, security policy (#487)
* docs: add Contributor Covenant code of conduct * chore(github): add issue templates and dependabot config * docs(security): add coordinated disclosure reporting process * chore: strip pre-existing trailing whitespace and add final newline in SECURITY.md * chore(security): move SECURITY.md to .github/ to declutter repo root GitHub still detects .github/SECURITY.md for the community profile, and it leaves the top-level listing (README surfaces sooner).
1 parent 6290fdf commit 6824e4d

6 files changed

Lines changed: 273 additions & 7 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Bug report
2+
description: Report a problem with MCPProxy
3+
title: "[Bug]: "
4+
labels: ["bug"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for taking the time to file a bug report. Please search existing
10+
issues first to avoid duplicates.
11+
- type: textarea
12+
id: what-happened
13+
attributes:
14+
label: What happened?
15+
description: A clear and concise description of the bug.
16+
placeholder: When I run `mcpproxy serve` ...
17+
validations:
18+
required: true
19+
- type: textarea
20+
id: expected
21+
attributes:
22+
label: Expected behavior
23+
validations:
24+
required: true
25+
- type: textarea
26+
id: repro
27+
attributes:
28+
label: Steps to reproduce
29+
description: Minimal, ordered steps so a maintainer can reproduce.
30+
value: |
31+
1.
32+
2.
33+
3.
34+
validations:
35+
required: true
36+
- type: input
37+
id: version
38+
attributes:
39+
label: MCPProxy version
40+
description: Output of `mcpproxy version`
41+
placeholder: "v0.31.1 (personal) darwin/arm64"
42+
validations:
43+
required: true
44+
- type: dropdown
45+
id: os
46+
attributes:
47+
label: Operating system
48+
options:
49+
- macOS
50+
- Linux
51+
- Windows
52+
validations:
53+
required: true
54+
- type: textarea
55+
id: logs
56+
attributes:
57+
label: Relevant logs
58+
description: |
59+
Logs from `~/.mcpproxy/logs/main.log` or `mcpproxy upstream logs <name>`.
60+
Redact any secrets first.
61+
render: shell
62+
- type: checkboxes
63+
id: checks
64+
attributes:
65+
label: Pre-submission checklist
66+
options:
67+
- label: I searched existing issues and did not find a duplicate
68+
required: true
69+
- label: I ran `mcpproxy doctor` and reviewed the output
70+
required: false

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Questions & ideas (GitHub Discussions)
4+
url: https://github.com/smart-mcp-proxy/mcpproxy-go/discussions
5+
about: Ask usage questions, propose RFCs, or share your setup here.
6+
- name: Report a security vulnerability
7+
url: https://github.com/smart-mcp-proxy/mcpproxy-go/security/advisories/new
8+
about: Please report security issues privately via GitHub Security Advisories, not public issues.
9+
- name: Documentation
10+
url: https://docs.mcpproxy.app/
11+
about: Read the docs before filing; your answer may already be there.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Feature request
2+
description: Suggest an idea or enhancement for MCPProxy
3+
title: "[Feature]: "
4+
labels: ["enhancement"]
5+
body:
6+
- type: textarea
7+
id: problem
8+
attributes:
9+
label: Problem / motivation
10+
description: What problem does this solve? What are you trying to do?
11+
validations:
12+
required: true
13+
- type: textarea
14+
id: proposal
15+
attributes:
16+
label: Proposed solution
17+
validations:
18+
required: true
19+
- type: textarea
20+
id: alternatives
21+
attributes:
22+
label: Alternatives considered
23+
- type: dropdown
24+
id: edition
25+
attributes:
26+
label: Which edition?
27+
options:
28+
- Personal
29+
- Server
30+
- Both / not sure
31+
validations:
32+
required: true
33+
- type: checkboxes
34+
id: checks
35+
attributes:
36+
label: Pre-submission checklist
37+
options:
38+
- label: I searched existing issues and discussions for a similar request
39+
required: true

SECURITY.md renamed to .github/SECURITY.md

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ Returns:
7474
{
7575
"servers": [
7676
{
77-
"name": "untrusted-server",
77+
"name": "untrusted-server",
7878
"quarantined": true,
7979
"url": "http://example.com",
8080
"created": "2024-01-01T00:00:00Z"
@@ -95,7 +95,7 @@ Returns detailed tool descriptions for security analysis with quoted description
9595
```json
9696
{
9797
"server": "untrusted-server",
98-
"quarantine_status": "ACTIVE",
98+
"quarantine_status": "ACTIVE",
9999
"tools": [
100100
{
101101
"name": "suspicious_tool",
@@ -239,7 +239,7 @@ The system tray includes quarantine management:
239239
### For Users
240240

241241
1. **Always review quarantined servers** before approving
242-
2. **Be suspicious of complex tool descriptions**
242+
2. **Be suspicious of complex tool descriptions**
243243
3. **Check for hidden instructions** in tool descriptions
244244
4. **Verify server sources** before adding to mcpproxy
245245
5. **Use quarantine management tools** regularly
@@ -299,7 +299,25 @@ The system tray includes quarantine management:
299299

300300
### Reporting
301301

302-
If you discover Tool Poisoning Attacks or other security vulnerabilities, please report them through the appropriate channels for your organization or the mcpproxy-go project.
302+
We take security seriously. **Please do not report security vulnerabilities through
303+
public GitHub issues, discussions, or pull requests.**
304+
305+
Instead, report them privately using
306+
**[GitHub Security Advisories](https://github.com/smart-mcp-proxy/mcpproxy-go/security/advisories/new)**
307+
("Report a vulnerability" on the repository's Security tab). This creates a private,
308+
coordinated disclosure channel visible only to maintainers.
309+
310+
Please include, where possible:
311+
312+
- A description of the vulnerability and its impact
313+
- Steps to reproduce (proof-of-concept welcome)
314+
- Affected version(s) (`mcpproxy version`)
315+
- Any suggested remediation
316+
317+
**Response targets:** initial acknowledgement within 48 hours, triage and severity
318+
assessment within 5 business days. We follow coordinated disclosure and aim to ship a
319+
fix or mitigation before public disclosure (typically within 90 days). We are happy to
320+
credit reporters in the release notes unless you prefer to remain anonymous.
303321

304322
## References
305323

@@ -598,7 +616,7 @@ When reviewing quarantined tools, look for:
598616
- [ ] Social engineering language and urgency tactics
599617
- [ ] Credential theft attempts
600618
- [ ] Instructions to conceal actions from users
601-
- [ ] Base64 encoding or other obfuscation methods
619+
- [ ] Base64 encoding or other obfuscation methods
602620

603621
## LLM Security Analysis Guide
604622

@@ -614,7 +632,7 @@ upstream_servers list_quarantined
614632
This shows all servers currently in quarantine that need security review.
615633

616634
#### Step 2: Inspect Each Server's Tools
617-
```bash
635+
```bash
618636
upstream_servers inspect_quarantined name="server-name"
619637
```
620638

@@ -676,4 +694,4 @@ Based on your analysis:
676694
**Analysis:**
677695
❌ **MALICIOUS** - Contains hidden instruction in `<IMPORTANT>` tag requesting SSH key access. This is a classic Tool Poisoning Attack attempting to exfiltrate sensitive credentials.
678696

679-
**Recommendation:** Keep server quarantined indefinitely.
697+
**Recommendation:** Keep server quarantined indefinitely.

‎.github/dependabot.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directory: "/"
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 10
8+
commit-message:
9+
prefix: "chore(deps)"
10+
groups:
11+
go-dependencies:
12+
patterns:
13+
- "*"
14+
- package-ecosystem: github-actions
15+
directory: "/"
16+
schedule:
17+
interval: weekly
18+
commit-message:
19+
prefix: "chore(ci)"
20+
- package-ecosystem: npm
21+
directory: "/frontend"
22+
schedule:
23+
interval: weekly
24+
open-pull-requests-limit: 10
25+
commit-message:
26+
prefix: "chore(deps)"
27+
groups:
28+
frontend-dependencies:
29+
patterns:
30+
- "*"
31+
- package-ecosystem: npm
32+
directory: "/website"
33+
schedule:
34+
interval: weekly
35+
open-pull-requests-limit: 10
36+
commit-message:
37+
prefix: "chore(deps)"
38+
groups:
39+
website-dependencies:
40+
patterns:
41+
- "*"

‎CODE_OF_CONDUCT.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
6+
7+
We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
8+
9+
## Our Standards
10+
11+
Examples of behavior that contributes to a positive environment for our community include:
12+
13+
* Demonstrating empathy and kindness toward other people
14+
* Being respectful of differing opinions, viewpoints, and experiences
15+
* Giving and gracefully accepting constructive feedback
16+
* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
17+
* Focusing on what is best not just for us as individuals, but for the overall community
18+
19+
Examples of unacceptable behavior include:
20+
21+
* The use of sexualized language or imagery, and sexual attention or advances of any kind
22+
* Trolling, insulting or derogatory comments, and personal or political attacks
23+
* Public or private harassment
24+
* Publishing others' private information, such as a physical or email address, without their explicit permission
25+
* Other conduct which could reasonably be considered inappropriate in a professional setting
26+
27+
## Enforcement Responsibilities
28+
29+
Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
30+
31+
Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
32+
33+
## Scope
34+
35+
This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
36+
37+
## Enforcement
38+
39+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
40+
reported to the project maintainers privately by opening a confidential report
41+
via the repository's **Security → Report a vulnerability** form
42+
(GitHub private vulnerability reporting). All complaints will be reviewed and
43+
investigated promptly and fairly.
44+
45+
All community leaders are obligated to respect the privacy and security of the reporter of any incident.
46+
47+
## Enforcement Guidelines
48+
49+
Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
50+
51+
### 1. Correction
52+
53+
**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
54+
55+
**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
56+
57+
### 2. Warning
58+
59+
**Community Impact**: A violation through a single incident or series of actions.
60+
61+
**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
62+
63+
### 3. Temporary Ban
64+
65+
**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
66+
67+
**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
68+
69+
### 4. Permanent Ban
70+
71+
**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
72+
73+
**Consequence**: A permanent ban from any sort of public interaction within the community.
74+
75+
## Attribution
76+
77+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
78+
79+
Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
80+
81+
For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq][FAQ]. Translations are available at [https://www.contributor-covenant.org/translations][translations].
82+
83+
[homepage]: https://www.contributor-covenant.org
84+
[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
85+
[Mozilla CoC]: https://github.com/mozilla/diversity
86+
[FAQ]: https://www.contributor-covenant.org/faq
87+
[translations]: https://www.contributor-covenant.org/translations

0 commit comments

Comments
 (0)