Verify/security - #1211

Closed

skevin220 wants to merge 15 commits into

CoplayDev:betafrom

skevin220:verify/security

Commits on Jun 19, 2026

docs: add security analysis of MCP for Unity
claude
committed
b31b17e
harden(R1): remove Roslyn runtime_compilation tool
claude
committed
b2c7549
harden(R1): disable Roslyn auto-installer fetch path
claude
committed
d1c03e5
harden(R4,R5): token-gate the local bridge
claude
committed
2e993b6
harden(R9): make tool enable/disable a real dispatch boundary
claude
committed
58a67ce
harden(R6): default-disable code-exec tools; allow-list execute_menu_item
claude
committed
bfdcbd6
harden(R11): pin the launched server to an exact reviewed version
claude
committed
1f591a9
harden(R10): disable telemetry by default
claude
committed
1dd633d
harden(R8): fail loud on off-loopback HTTP binds
claude
committed
c39b925
harden(docs): record hardening pass and accepted risks (R3, R12)
claude
committed
3a66299
docs: add hardening change document
claude
committed
f74491d
test(R4): update transport-framing fakes for the bridge auth handshake
claude
committed
b2ae8a1
test(R4,R8,R10): add runnable security-behavior tests
claude
committed
6cb903e
test(R9,R6): EditMode tests for the dispatch boundary and play-mode gate
claude
committed
bc0317f
docs: add verification report
claude
committed
5f7a668