Skip to content
CI

Harden MCP file and Assembly access #1563

Sign in to view logs

Harden MCP file and Assembly access

Harden MCP file and Assembly access #1563

Triggered via pull request September 23, 2026 10:31
@tim-kostim-kos
opened #512
fix/mcp-public-file-inputs
Status Failure
Total duration 6m 15s
Artifacts 3

ci.yml

on: pull_request
E2E tests
2m 20s
E2E tests
Matrix: unit
Lockfile guard
6s
Lockfile guard
Build package
1m 2s
Build package
Verify (fast)
3m 12s
Verify (fast)
Verify (full)
3m 7s
Verify (full)
Release dry run
2m 35s
Release dry run
Image package Next.js fixture
6m 11s
Image package Next.js fixture
SDK Supabase Edge fixture
1m 45s
SDK Supabase Edge fixture
Slack notification
Slack notification
Publish coverage Pages
Publish coverage Pages
Upload coverage
Upload coverage
Fit to window
Zoom out
Zoom in

Annotations

9 errors and 11 notices
Unit tests (Node 24)
Process completed with exit code 1.
test/unit/file-inputs.test.ts > MCP file inputs > rejects file URLs: packages/mcp-server/test/unit/file-inputs.test.ts#L245
AssertionError: expected { status: 'ok', …(4) } to match object { status: 'error', …(1) } (7 matching properties omitted from actual) - Expected + Received { - "errors": [ - { - "code": "mcp_invalid_args", - }, - ], - "status": "error", + "status": "ok", } ❯ test/unit/file-inputs.test.ts:245:38
test/unit/file-inputs.test.ts > MCP file inputs > rejects downloads from the local network before making the request: packages/mcp-server/test/unit/file-inputs.test.ts#L232
AssertionError: expected { status: 'ok', …(4) } to match object { status: 'error', …(1) } (7 matching properties omitted from actual) - Expected + Received { - "errors": [ - { - "code": "mcp_invalid_args", - }, - ], - "status": "error", + "status": "ok", } ❯ test/unit/file-inputs.test.ts:232:38
Verify (full)
Process completed with exit code 1.
test/unit/file-inputs.test.ts > MCP file inputs > rejects file URLs: packages/mcp-server/test/unit/file-inputs.test.ts#L245
AssertionError: expected { status: 'ok', …(4) } to match object { status: 'error', …(1) } (7 matching properties omitted from actual) - Expected + Received { - "errors": [ - { - "code": "mcp_invalid_args", - }, - ], - "status": "error", + "status": "ok", } ❯ test/unit/file-inputs.test.ts:245:38
test/unit/file-inputs.test.ts > MCP file inputs > rejects downloads from the local network before making the request: packages/mcp-server/test/unit/file-inputs.test.ts#L232
AssertionError: expected { status: 'ok', …(4) } to match object { status: 'error', …(1) } (7 matching properties omitted from actual) - Expected + Received { - "errors": [ - { - "code": "mcp_invalid_args", - }, - ], - "status": "error", + "status": "ok", } ❯ test/unit/file-inputs.test.ts:232:38
Verify (fast)
Process completed with exit code 1.
test/unit/file-inputs.test.ts > MCP file inputs > rejects file URLs: packages/mcp-server/test/unit/file-inputs.test.ts#L245
AssertionError: expected { status: 'ok', …(4) } to match object { status: 'error', …(1) } (7 matching properties omitted from actual) - Expected + Received { - "errors": [ - { - "code": "mcp_invalid_args", - }, - ], - "status": "error", + "status": "ok", } ❯ test/unit/file-inputs.test.ts:245:38
test/unit/file-inputs.test.ts > MCP file inputs > rejects downloads from the local network before making the request: packages/mcp-server/test/unit/file-inputs.test.ts#L232
AssertionError: expected { status: 'ok', …(4) } to match object { status: 'error', …(1) } (7 matching properties omitted from actual) - Expected + Received { - "errors": [ - { - "code": "mcp_invalid_args", - }, - ], - "status": "error", + "status": "ok", } ❯ test/unit/file-inputs.test.ts:232:38
Lockfile guard
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Unit tests (Node 22)
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Build package
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Unit tests (Node 20)
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Unit tests (Node 24)
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
SDK Supabase Edge fixture
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
E2E tests
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Release dry run
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Verify (full)
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Verify (fast)
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Image package Next.js fixture
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

Artifacts

Produced during runtime
Name Size Digest
img-browser-evidence
526 KB
sha256:d7b0a83e55aac04880e52192b4e6439572bfcbcafe295aac9c918638d4dd3187
package
1.04 MB
sha256:b25842b2ea1c1cf761ac6ef41d6a42a6c70cb58daf2fa7162b481e9fe9b0131a
sdk-edge-evidence
11.9 MB
sha256:e553dab7548e0455784a95d9282504c6d1eca2e1faf60f7d61d28f4661e140c6