FreeOnePlus opened a new pull request, #137: URL: https://github.com/apache/doris-mcp-server/pull/137
## Summary - install Bandit through the reproducible development dependency group and replace the narrowed two-rule profile with the full default source scan - eliminate the 36-finding baseline, including three high-severity MD5 findings, silent exception paths, and hardcoded-credential false positives - centralize public OAuth wire identifiers and the intentionally empty retained-credential value without changing protocol behavior - add a repository gate that requires zero configured Bandit findings and only permits rule-specific, locally documented non-SQL exceptions ## Validation - `uvx --from 'uv==0.9.0' uv lock --check` - `uv run ruff check .` - `uv run mypy doris_mcp_server` — 58 source files, zero errors - configured Bandit source scan — 30,000+ lines, zero findings - `uv run pytest -q -W error` — 629 passed, 64 skipped, zero warnings - `uv build` plus isolated wheel installation and both CLI entry-point smoke checks - real Doris integration on Streamable HTTP and true subprocess Stdio — 7 passed, including read/write, read-only denial, timeout and connection recovery, tool regressions, and independent FE/BE monitoring endpoints -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
