Bryan Thompson 3fa4bc1ae3

ci(scan): adopt static pin check for auto-exec MCP launchers (annotate-only) + waivers file ...

Re-pin scan-plugins to the community#2361 head: deterministic detection
of floating npx/bunx/uvx/pipx MCP-server launcher specs (registry-resolved
at session start, not fixed by the pinned source SHA). This surface stays
annotate-only — fail-on-unpinned-autoexec is deliberately not set. Ships
.github/policy/launch-shape-waivers.txt with the two existing
maintainer-adjudicated grants (@azure/ scope; ui5-modernization).

Re-pin to the merge SHA once community#2361 lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-18 11:16:25 -05:00

..

launch-shape-waivers.txt

ci(scan): adopt static pin check for auto-exec MCP launchers (annotate-only) + waivers file

2026-08-18 11:16:25 -05:00

prompt.md

policy(scan): review whole payload incl. .claude/ + flag cross-service credential routing (#2360)

2026-06-30 19:58:10 -05:00

schema.json

Tighten policy scan: hook scope, telemetry, disclosure; make blocking (#1771)

2026-05-07 17:34:32 -05:00