[ivanpaghubasan]

Summary

Two repo-scope rules over committed MCP client config, using the existing
MCPCFG-002/003 parse:

• MCPCFG-004 (high, 0.6): a server started with a credential and none of the scope
  options its own docs or source offer. Four cases: github-mcp-server (binary or
  ghcr.io image) with GITHUB_PERSONAL_ACCESS_TOKEN and no read-only/toolset option;
  the deprecated @modelcontextprotocol/server-github with that token; Supabase MCP
  with neither --read-only nor --project-ref; an env key containing SERVICE_ROLE.
• MCPCFG-005 (medium, 0.6): a remote server URL over http:// on a host that is not
  localhost, 127.0.0.0/8 or ::1 (RFC 6750 §5.3: bearer tokens require TLS).

Changes

• New predicates repo_mcp_config_unscoped_credential and
  repo_mcp_config_remote_plain_http; classifiers in
  internal/analysis/mcp_client_scope.go.
• Secrecy contract extended narrowly: GITHUB_READ_ONLY and GITHUB_TOOLSETS values are
  reduced to a boolean (strconv.ParseBool, as the server binds them) and never stored.
  A planted fake token is asserted absent from facts, reasons and JSON.
• Schema 37 → 38 (provisional). Rules 383 → 385.
• Corpus fixture testdata/corpus/mcp-credential-scope-fixture/ with a PROVENANCE row.
• CHANGELOG, ARCHITECTURE, COVERAGE and CLAUDE.md updated.

Not built

The "no credentials" half of the proposal (Claude Code, Cursor, Gemini CLI and Codex
document OAuth sign-in with nothing in the file), remote GitHub/Supabase scope
settings, ADMIN/ROOT/_SUPERUSER env names, GITHUB_TOKEN, Codex env_vars forwarding,
Windsurf serverUrl.

Verification

• go build, go vet, go test ./... pass; check-rules-sync.sh in sync.
• Corpus before/after: only the new fixture changes (MCPCFG-004 and MCPCFG-005).
• The origin/main binary skips both rules with META-005.

Related

Rules: trustabl/agent-reliability-rules#208
Rulebook: trustabl/trustabl-rulebook#159
Merge order: engine, rules, rulebook; the rules PR waits for the rulebook PR.