From 9010e903472bd26ef7bf6c170ba1b893373d8edb Mon Sep 17 00:00:00 2001 From: Ernest Provo Date: Mon, 13 Jul 2026 20:20:19 -0400 Subject: [PATCH 1/2] fix(ci): migrate org references from ernestprovo23 to DataScience-EngineeringExperts Repo was transferred to the DataScience-EngineeringExperts org. Update all github.com repo URLs and the GitHub Pages host across docs, examples, pyproject URLs, and issue templates. Critically, update the sigstore certificate-identity strings so verification matches the new OIDC SAN: - sigstore-fixture.yml verify --certificate-identity - release.yml verify-cert-identity - tests/test_signing.py FIXTURE_IDENTITY (kept in lockstep with the workflow) - src/mcp_warden/precommit.py generated snippet (matches examples/pre-commit) --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- .github/ISSUE_TEMPLATE/config.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/sigstore-fixture.yml | 4 ++-- CHANGELOG.md | 6 +++--- DOCUMENTATION_INDEX.md | 2 +- README.md | 14 ++++++------- RELEASING.md | 10 +++++----- SECURITY.md | 2 +- SYSTEM_CONTEXT_DIAGRAM.md | 2 +- docs-site/checklist.md | 4 ++-- docs-site/comparison.md | 2 +- docs-site/index.md | 2 +- docs-site/lock-format.md | 8 ++++---- docs-site/pin-in-ci.md | 20 +++++++++---------- docs-site/quickstart.md | 4 ++-- docs-site/rug-pull.md | 2 +- docs-site/tool-poisoning.md | 2 +- docs/SIGNING.md | 2 +- .../matrix-multiple-servers.yml | 2 +- .../pin-on-merge-check-on-pr.yml | 2 +- .../github-actions/private-repo-no-sarif.yml | 2 +- examples/github-actions/sarif-upload.yml | 2 +- examples/pre-commit/.pre-commit-config.yaml | 4 ++-- mkdocs.yml | 8 ++++---- pyproject.toml | 10 +++++----- src/mcp_warden/precommit.py | 2 +- tests/test_signing.py | 2 +- 28 files changed, 65 insertions(+), 65 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index da79a81..d0aa66d 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -8,7 +8,7 @@ body: ⚠️ **Do not report security vulnerabilities here.** If this is a way to bypass a control mcp-warden claims to enforce (drift slips through, a real secret is emitted unredacted, a poisoned result evades the block tier), - report it privately per [SECURITY.md](https://github.com/ernestprovo23/mcp-warden/blob/main/SECURITY.md). + report it privately per [SECURITY.md](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/SECURITY.md). - type: checkboxes id: prechecks attributes: diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index e9c15e2..15f71de 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,8 +1,8 @@ blank_issues_enabled: false contact_links: - name: πŸ”’ Report a security vulnerability - url: https://github.com/ernestprovo23/mcp-warden/security/advisories/new + url: https://github.com/DataScience-EngineeringExperts/mcp-warden/security/advisories/new about: "Security issues must be reported privately β€” do NOT open a public issue. See SECURITY.md." - name: πŸ“– Documentation & threat model - url: https://github.com/ernestprovo23/mcp-warden/tree/main/docs + url: https://github.com/DataScience-EngineeringExperts/mcp-warden/tree/main/docs about: "Read the design specs and threat model before filing β€” some behaviors are explicitly out of scope." diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8639244..6c5f0e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -101,7 +101,7 @@ jobs: # No API token, no stored secret: pypa/gh-action-pypi-publish mints a short-lived # OIDC token from this job's `id-token: write` and exchanges it for a PyPI upload # token. PyPI must have a Trusted Publisher (pending or active) for `mcp-warden-cli` - # pointing at owner=ernestprovo23, repo=mcp-warden, workflow=release.yml β€” see + # pointing at owner=DataScience-EngineeringExperts, repo=mcp-warden, workflow=release.yml β€” see # RELEASING.md. Until that exists, this job fails CLOSED (publish denied), it # never falls back to anything insecure. # @@ -197,7 +197,7 @@ jobs: # Self-check: verify what we just signed against THIS workflow's own # identity so a broken run never publishes a bad bundle. verify: true - verify-cert-identity: "https://github.com/ernestprovo23/mcp-warden/.github/workflows/release.yml@${{ github.ref }}" + verify-cert-identity: "https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/release.yml@${{ github.ref }}" verify-oidc-issuer: "https://token.actions.githubusercontent.com" # release-signing-artifacts defaults to true: on a release event the # .sigstore bundles are attached to the Release assets automatically. diff --git a/.github/workflows/sigstore-fixture.yml b/.github/workflows/sigstore-fixture.yml index 3a725fd..bf86928 100644 --- a/.github/workflows/sigstore-fixture.yml +++ b/.github/workflows/sigstore-fixture.yml @@ -4,7 +4,7 @@ # !!! NEVER RENAME OR MOVE THIS FILE !!! # # The committed offline fixture's signer identity is PINNED to this exact path: -# https://github.com/ernestprovo23/mcp-warden/.github/workflows/sigstore-fixture.yml@refs/heads/main +# https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/sigstore-fixture.yml@refs/heads/main # (issuer https://token.actions.githubusercontent.com). The offline-fixture test # (tests/test_signing.py::test_offline_fixture_verifies_when_present) and # docs/SIGNING.md both hard-code this path. Renaming/moving this file changes the @@ -63,7 +63,7 @@ jobs: --lock fixture-out/warden.lock \ --verify \ --certificate-identity \ - "https://github.com/ernestprovo23/mcp-warden/.github/workflows/sigstore-fixture.yml@${GITHUB_REF}" \ + "https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/sigstore-fixture.yml@${GITHUB_REF}" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" - name: Upload signed fixture (lock + bundle) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7148ddd..117bdc4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -146,6 +146,6 @@ v1-strong foundation. Highlights of the 0.3.0 β†’ 1.0.0 arc: declared surface, RFC 8785 (JCS) + SHA-256 canonicalization, SARIF output, and a live integrity-gate workflow with committed `clean.warden.lock`. -[Unreleased]: https://github.com/ernestprovo23/mcp-warden/compare/v1.0.1...HEAD -[1.0.1]: https://github.com/ernestprovo23/mcp-warden/compare/v1.0.0...v1.0.1 -[1.0.0]: https://github.com/ernestprovo23/mcp-warden/releases/tag/v1.0.0 +[Unreleased]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.0.1...HEAD +[1.0.1]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.0.0...v1.0.1 +[1.0.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/releases/tag/v1.0.0 diff --git a/DOCUMENTATION_INDEX.md b/DOCUMENTATION_INDEX.md index 411c095..a5c6a27 100644 --- a/DOCUMENTATION_INDEX.md +++ b/DOCUMENTATION_INDEX.md @@ -17,7 +17,7 @@ describe and visualize the implementation that satisfies that contract. ## GitHub Action (`action.yml` β€” Issue #18) The composite reusable action is the primary delivery vehicle for the `check` gate. -Consumers pin `ernestprovo23/mcp-warden@` and get a zero-copy-paste integrity +Consumers pin `DataScience-EngineeringExperts/mcp-warden@` and get a zero-copy-paste integrity gate with hash-locked supply-chain, SARIF upload, and cross-OS support. | Artifact | Purpose | diff --git a/README.md b/README.md index 4ce5d8b..60d8336 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,10 @@ # mcp-warden -[![CI](https://github.com/ernestprovo23/mcp-warden/actions/workflows/integrity-gate.yml/badge.svg)](https://github.com/ernestprovo23/mcp-warden/actions/workflows/integrity-gate.yml) +[![CI](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml/badge.svg)](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/downloads/) -[![GitHub Action](https://img.shields.io/badge/GitHub%20Action-mcp--warden-2088FF?logo=githubactions&logoColor=white)](https://github.com/ernestprovo23/mcp-warden/blob/main/action.yml) -[![Latest release](https://img.shields.io/github/v/release/ernestprovo23/mcp-warden?display_name=tag&sort=semver)](https://github.com/ernestprovo23/mcp-warden/releases) +[![GitHub Action](https://img.shields.io/badge/GitHub%20Action-mcp--warden-2088FF?logo=githubactions&logoColor=white)](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/action.yml) +[![Latest release](https://img.shields.io/github/v/release/DataScience-EngineeringExperts/mcp-warden?display_name=tag&sort=semver)](https://github.com/DataScience-EngineeringExperts/mcp-warden/releases) **mcp-warden is the lockfile and CI gate for stdio-transport MCP servers: it pins an MCP server's declared tool/resource/prompt surface into a signed `warden.lock`, @@ -79,7 +79,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: ernestprovo23/mcp-warden@v0 + - uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: "node ./build/index.js" lock: "warden.lock" @@ -107,7 +107,7 @@ mcp-warden does not replace a scanner or a gateway β€” it adds the missing **dri gate**: a signed baseline plus a deterministic CI check that the surface you approved is the surface you still run. For the full, sourced breakdown of how these layers complement each other and when to use which, see the -[**comparison page**](https://ernestprovo23.github.io/mcp-warden/comparison/) +[**comparison page**](https://datascience-engineeringexperts.github.io/mcp-warden/comparison/) on the docs site. --- @@ -221,7 +221,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: ernestprovo23/mcp-warden@v0 + - uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: "node ./build/index.js" lock: "warden.lock" @@ -324,7 +324,7 @@ Add this to your `.pre-commit-config.yaml` (a complete, copy-pasteable example): ```yaml repos: - - repo: https://github.com/ernestprovo23/mcp-warden + - repo: https://github.com/DataScience-EngineeringExperts/mcp-warden rev: v1.0.1 # pin to a release tag (supply-chain hygiene) hooks: - id: mcp-warden-check diff --git a/RELEASING.md b/RELEASING.md index e188f0f..028f317 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -8,7 +8,7 @@ Two names matter and they are deliberately different: |-------|-------| | PyPI distribution name (what `pip install` uses) | `mcp-warden-cli` | | CLI command (what users type) | `mcp-warden` | -| GitHub repository | `ernestprovo23/mcp-warden` | +| GitHub repository | `DataScience-EngineeringExperts/mcp-warden` | Install is therefore `pip install mcp-warden-cli`, but the command stays `mcp-warden`. The PyPI name `mcp-warden` is an unrelated package by another author. PyPI rejects @@ -37,7 +37,7 @@ the very first upload is already OIDC-published. 2. Go to **Account β†’ Publishing** (). 3. Under **Add a new pending publisher**, fill in **exactly**: - **PyPI Project Name**: `mcp-warden-cli` - - **Owner**: `ernestprovo23` + - **Owner**: `DataScience-EngineeringExperts` - **Repository name**: `mcp-warden` - **Workflow name**: `release.yml` - **Environment name**: *(leave blank β€” the workflow does not use a GitHub @@ -75,7 +75,7 @@ without the publish job failing red before the Trusted Publisher exists. and nothing is uploaded to PyPI. Use this to cut signed GitHub Releases for versions already published by token (e.g. `1.0.0`, `1.0.1`). - **After you have configured the Trusted Publisher above** (project - `mcp-warden-cli`, owner `ernestprovo23`, repo `mcp-warden`, workflow + `mcp-warden-cli`, owner `DataScience-EngineeringExperts`, repo `mcp-warden`, workflow `release.yml`), enable OIDC publishing for future releases by setting the variable: ```bash @@ -160,14 +160,14 @@ Do this on a clean checkout of `main` with all v1 PRs merged. sigstore verify identity dist/mcp_warden_cli-1.0.0-py3-none-any.whl \ --bundle mcp_warden_cli-1.0.0-py3-none-any.whl.sigstore \ --cert-identity \ - "https://github.com/ernestprovo23/mcp-warden/.github/workflows/release.yml@refs/tags/v1.0.0" \ + "https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/release.yml@refs/tags/v1.0.0" \ --cert-oidc-issuer "https://token.actions.githubusercontent.com" ``` (Download the `.whl` and its `.sigstore` bundle from the Release assets first.) 3. **Confirm the PyPI page.** Visit and check: - version `1.0.0` is listed; - - the project URLs (homepage / repository) point at `ernestprovo23/mcp-warden`; + - the project URLs (homepage / repository) point at `DataScience-EngineeringExperts/mcp-warden`; - "Publisher" shows the Trusted Publisher (OIDC), not a token upload. 4. **Smoke-test the gate** in a throwaway dir to confirm the published wheel works: diff --git a/SECURITY.md b/SECURITY.md index 509c8f5..34dcb9c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,7 +16,7 @@ preferred because it keeps the report, the fix, and the CVE in one place): 1. **GitHub Security Advisories** β€” go to the repository's **Security** tab and click **"Report a vulnerability"** - (). This + (). This opens a private advisory visible only to you and the maintainers. 2. **Email** β€” `ernest@thedataexperts.us`. Use a clear subject line such as `[mcp-warden security]`. If you want to encrypt, say so in a first plaintext diff --git a/SYSTEM_CONTEXT_DIAGRAM.md b/SYSTEM_CONTEXT_DIAGRAM.md index 9dda24d..ad71697 100644 --- a/SYSTEM_CONTEXT_DIAGRAM.md +++ b/SYSTEM_CONTEXT_DIAGRAM.md @@ -22,7 +22,7 @@ logic) plus a separate informational provenance section. It never prints raw > runtime dependency and is never invoked by `pin`/`check`/`policy`. > **`action.yml` (Issue #18)** is the primary consumer delivery vehicle for the `check` -> gate. Consumers pin `ernestprovo23/mcp-warden@` in their workflow; the composite +> gate. Consumers pin `DataScience-EngineeringExperts/mcp-warden@` in their workflow; the composite > action wraps the C2 sequence (steps 1–5 of the pin/check sequence above) behind a > single `uses:` step with hash-locked supply-chain, injection guard, SARIF upload, and > cross-OS support. See `action/requirements.lock` and `README.md` Β§GitHub Action. diff --git a/docs-site/checklist.md b/docs-site/checklist.md index 464f484..bbe96cc 100644 --- a/docs-site/checklist.md +++ b/docs-site/checklist.md @@ -49,7 +49,7 @@ not the right layer.** No single tool covers this list β€” that is the point. exits non-zero on any drift. Wire it into [CI](pin-in-ci.md). - [ ] **Run the same verdict locally before CI.** Catch drift at commit time, not in the pipeline. mcp-warden ships a pre-commit hook - ([example config](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/pre-commit/.pre-commit-config.yaml)) + ([example config](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/pre-commit/.pre-commit-config.yaml)) that reuses the identical drift path as `check`. - [ ] **Surface findings where your team already looks.** mcp-warden emits SARIF (`--sarif`) that uploads straight to GitHub code scanning, so drift shows up @@ -88,4 +88,4 @@ not the right layer.** No single tool covers this list β€” that is the point. only the pin-and-drift items. mcp-warden does **not** defend behavioral / runtime attacks, does **not** statically classify new definitions, and makes **no compliance or regulatory claim**. Read the limits in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). diff --git a/docs-site/comparison.md b/docs-site/comparison.md index a4406bb..f7b48aa 100644 --- a/docs-site/comparison.md +++ b/docs-site/comparison.md @@ -89,7 +89,7 @@ Each tool above is good at its own job; pick the layers you need and combine the classify new definitions (use a scanner), does **not** mediate runtime traffic as its core job (use a gateway), and makes **no compliance or regulatory claim**. Read the limits in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). --- diff --git a/docs-site/index.md b/docs-site/index.md index e87da04..4c1d7dd 100644 --- a/docs-site/index.md +++ b/docs-site/index.md @@ -31,4 +31,4 @@ definitions, alert on drift* β€” mcp-warden is the deterministic tool that does `resources/list` / `prompts/list`; it does **not** defend against behavioral attacks at runtime and makes **no compliance or regulatory claim** of any kind. Read the limits first in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). diff --git a/docs-site/lock-format.md b/docs-site/lock-format.md index 0c74191..d2fb5c9 100644 --- a/docs-site/lock-format.md +++ b/docs-site/lock-format.md @@ -31,7 +31,7 @@ the same declared surface** β€” that byte-reproducibility is the conformance bar The complete, normative specification is the source of truth and lives in the repository: -- **[MCP Lock Format v1 β€” `docs/SPEC.md`](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/SPEC.md)** +- **[MCP Lock Format v1 β€” `docs/SPEC.md`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/SPEC.md)** It covers the file format and location, server identity, the per-entry schema (tool / resource / prompt), field / entry / overall digest construction, the @@ -40,10 +40,10 @@ conformance section, and a minimal worked-example lock. The mcp-warden-specific implementation details (how *this* tool realizes the format) are documented separately in -[`docs/WARDEN_LOCK_SCHEMA.md`](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/WARDEN_LOCK_SCHEMA.md), +[`docs/WARDEN_LOCK_SCHEMA.md`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/WARDEN_LOCK_SCHEMA.md), which references `SPEC.md` as the format source of truth. A short, concrete example lock is in -[`docs/WARDEN_LOCK_EXAMPLE.md`](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/WARDEN_LOCK_EXAMPLE.md). +[`docs/WARDEN_LOCK_EXAMPLE.md`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/WARDEN_LOCK_EXAMPLE.md). ## What the format is for β€” and is not @@ -60,4 +60,4 @@ is explicitly **not**: The lock format covers declared-surface integrity only. It does **not** attest runtime behavior, does **not** judge whether a surface is benign, and makes **no compliance or regulatory claim**. Read the limits in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). diff --git a/docs-site/pin-in-ci.md b/docs-site/pin-in-ci.md index 0656446..fc45c5f 100644 --- a/docs-site/pin-in-ci.md +++ b/docs-site/pin-in-ci.md @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: ernestprovo23/mcp-warden@v0 + - uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: "node ./build/index.js" lock: "warden.lock" @@ -75,13 +75,13 @@ without GitHub Advanced Security. These live in the repository and are re-validated by CI on every change: -- [pin-on-merge + check-on-PR](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/github-actions/pin-on-merge-check-on-pr.yml) +- [pin-on-merge + check-on-PR](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/github-actions/pin-on-merge-check-on-pr.yml) β€” check on every PR, plus a manual re-pin job. -- [matrix over multiple servers](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/github-actions/matrix-multiple-servers.yml) +- [matrix over multiple servers](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/github-actions/matrix-multiple-servers.yml) β€” one gate fanned out across several servers. -- [SARIF upload to code scanning](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/github-actions/sarif-upload.yml) +- [SARIF upload to code scanning](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/github-actions/sarif-upload.yml) β€” the default mode. -- [private repo, no SARIF upload](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/github-actions/private-repo-no-sarif.yml) +- [private repo, no SARIF upload](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/github-actions/private-repo-no-sarif.yml) β€” `upload-sarif: false` for private repos / fork PRs. ## GitLab CI @@ -106,7 +106,7 @@ mcp-integrity: A complete, runnable GitLab template is in the repository: -- [`examples/gitlab-ci/.gitlab-ci.yml`](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/gitlab-ci/.gitlab-ci.yml) +- [`examples/gitlab-ci/.gitlab-ci.yml`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/gitlab-ci/.gitlab-ci.yml) ## Run it locally too (pre-commit) @@ -114,18 +114,18 @@ To catch a rug pull before it ever reaches CI, run the *same* drift verdict on every commit with the [pre-commit](https://pre-commit.com) hook. A complete, copy-pasteable config (and a pre-push variant) is in the repository: -- [`examples/pre-commit/.pre-commit-config.yaml`](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/pre-commit/.pre-commit-config.yaml) +- [`examples/pre-commit/.pre-commit-config.yaml`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/pre-commit/.pre-commit-config.yaml) ## Worked examples: real pinned servers The repository ships real, openly-available MCP servers pinned to a committed `warden.lock` each, re-checked by CI so they never go stale: -- [`examples/pinned-servers/`](https://github.com/ernestprovo23/mcp-warden/tree/main/examples/pinned-servers) +- [`examples/pinned-servers/`](https://github.com/DataScience-EngineeringExperts/mcp-warden/tree/main/examples/pinned-servers) β€” `server-everything`, `server-memory`, and `server-sequential-thinking`, each with the exact `pin` argv and a sample `check`. -See the [examples index](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/README.md) +See the [examples index](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/README.md) for the full gallery. !!! warning "What this does NOT cover" @@ -134,4 +134,4 @@ for the full gallery. classify a new surface as malicious (pair it with a scanner β€” see the [comparison](comparison.md)), and makes **no compliance or regulatory claim**. Read the limits in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). diff --git a/docs-site/quickstart.md b/docs-site/quickstart.md index 9f04043..be18169 100644 --- a/docs-site/quickstart.md +++ b/docs-site/quickstart.md @@ -72,7 +72,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: ernestprovo23/mcp-warden@v0 + - uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: "node ./build/index.js" lock: "warden.lock" @@ -95,4 +95,4 @@ the pin-once / check-on-PR pattern, see *contents* of tool descriptions for malicious wording (that is a scanner's job β€” see the [comparison](comparison.md)), and makes **no compliance or regulatory claim**. Read the limits in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). diff --git a/docs-site/rug-pull.md b/docs-site/rug-pull.md index fc12a17..1b18422 100644 --- a/docs-site/rug-pull.md +++ b/docs-site/rug-pull.md @@ -64,4 +64,4 @@ changes each surface as their own finding with a severity. See the It does **not** defend behavioral / runtime attacks, does **not** classify a new surface as safe or malicious, and makes **no compliance or regulatory claim**. Read the limits in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). diff --git a/docs-site/tool-poisoning.md b/docs-site/tool-poisoning.md index b444fd9..90af383 100644 --- a/docs-site/tool-poisoning.md +++ b/docs-site/tool-poisoning.md @@ -71,4 +71,4 @@ in the first place β€” pair it with a scanner for that. defend against behavioral / runtime attacks, does **not** statically classify new descriptions as malicious, and makes **no compliance or regulatory claim**. Read the limits in the - [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md). + [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md). diff --git a/docs/SIGNING.md b/docs/SIGNING.md index f046d5a..4bb0b33 100644 --- a/docs/SIGNING.md +++ b/docs/SIGNING.md @@ -268,5 +268,5 @@ out-of-digest provenance change does NOT require regeneration (the signed 3. Drop `warden.lock` + `warden.lock.sigstore` into `tests/fixtures/signed/`. 4. The offline-fixture test now runs (no longer skips), verifying the committed bundle against the pinned identity - `https://github.com/ernestprovo23/mcp-warden/.github/workflows/sigstore-fixture.yml@refs/heads/main` + `https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/sigstore-fixture.yml@refs/heads/main` (issuer `https://token.actions.githubusercontent.com`). diff --git a/examples/github-actions/matrix-multiple-servers.yml b/examples/github-actions/matrix-multiple-servers.yml index 0a62c04..96c45d2 100644 --- a/examples/github-actions/matrix-multiple-servers.yml +++ b/examples/github-actions/matrix-multiple-servers.yml @@ -38,7 +38,7 @@ jobs: category: "mcp-warden-search" steps: - uses: actions/checkout@v4 - - uses: ernestprovo23/mcp-warden@v0 + - uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: ${{ matrix.server-cmd }} lock: ${{ matrix.lock }} diff --git a/examples/github-actions/pin-on-merge-check-on-pr.yml b/examples/github-actions/pin-on-merge-check-on-pr.yml index 109832b..699b3c9 100644 --- a/examples/github-actions/pin-on-merge-check-on-pr.yml +++ b/examples/github-actions/pin-on-merge-check-on-pr.yml @@ -27,7 +27,7 @@ jobs: security-events: write # required for the default upload-sarif: true steps: - uses: actions/checkout@v4 - - uses: ernestprovo23/mcp-warden@v0 + - uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: "node ./build/index.js" lock: "warden.lock" diff --git a/examples/github-actions/private-repo-no-sarif.yml b/examples/github-actions/private-repo-no-sarif.yml index 4d81bf9..bb1acd3 100644 --- a/examples/github-actions/private-repo-no-sarif.yml +++ b/examples/github-actions/private-repo-no-sarif.yml @@ -22,7 +22,7 @@ jobs: steps: - uses: actions/checkout@v4 - id: warden - uses: ernestprovo23/mcp-warden@v0 + uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: "node ./build/index.js" lock: "warden.lock" diff --git a/examples/github-actions/sarif-upload.yml b/examples/github-actions/sarif-upload.yml index a1ef933..4a1d3a2 100644 --- a/examples/github-actions/sarif-upload.yml +++ b/examples/github-actions/sarif-upload.yml @@ -23,7 +23,7 @@ jobs: steps: - uses: actions/checkout@v4 - id: warden - uses: ernestprovo23/mcp-warden@v0 + uses: DataScience-EngineeringExperts/mcp-warden@v0 with: server-cmd: "node ./build/index.js" lock: "warden.lock" diff --git a/examples/pre-commit/.pre-commit-config.yaml b/examples/pre-commit/.pre-commit-config.yaml index f87964f..317c782 100644 --- a/examples/pre-commit/.pre-commit-config.yaml +++ b/examples/pre-commit/.pre-commit-config.yaml @@ -11,7 +11,7 @@ # `--lock` path is resolved relative to your git repo root. repos: # --- Variant 1 (minimal): run on every commit --------------------------- - - repo: https://github.com/ernestprovo23/mcp-warden + - repo: https://github.com/DataScience-EngineeringExperts/mcp-warden rev: v1.0.1 # pin to a release tag (supply-chain hygiene) hooks: - id: mcp-warden-check @@ -21,7 +21,7 @@ repos: # Spawning the server on every commit adds latency; teams that find this too # slow can move the gate to pre-push. Drift still blocks the push (exit 1). # Enable with: pre-commit install --hook-type pre-push - - repo: https://github.com/ernestprovo23/mcp-warden + - repo: https://github.com/DataScience-EngineeringExperts/mcp-warden rev: v1.0.1 hooks: - id: mcp-warden-check diff --git a/mkdocs.yml b/mkdocs.yml index 3c69a4d..b092e18 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -2,9 +2,9 @@ site_name: mcp-warden site_description: >- Task-focused guides for pinning an MCP server's declared tool/resource/prompt surface into a signed lock and failing CI when that surface drifts. -site_url: https://ernestprovo23.github.io/mcp-warden/ -repo_url: https://github.com/ernestprovo23/mcp-warden -repo_name: ernestprovo23/mcp-warden +site_url: https://datascience-engineeringexperts.github.io/mcp-warden/ +repo_url: https://github.com/DataScience-EngineeringExperts/mcp-warden +repo_name: DataScience-EngineeringExperts/mcp-warden edit_uri: edit/main/docs-site/ docs_dir: docs-site @@ -69,5 +69,5 @@ nav: extra: social: - icon: fontawesome/brands/github - link: https://github.com/ernestprovo23/mcp-warden + link: https://github.com/DataScience-EngineeringExperts/mcp-warden name: mcp-warden on GitHub diff --git a/pyproject.toml b/pyproject.toml index 5b58452..1af9e95 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -42,11 +42,11 @@ mcp-warden = "mcp_warden.cli:app" mcp-warden-precommit = "mcp_warden.precommit:main" [project.urls] -Homepage = "https://github.com/ernestprovo23/mcp-warden" -Repository = "https://github.com/ernestprovo23/mcp-warden" -Documentation = "https://ernestprovo23.github.io/mcp-warden/" -Changelog = "https://github.com/ernestprovo23/mcp-warden/blob/main/CHANGELOG.md" -Issues = "https://github.com/ernestprovo23/mcp-warden/issues" +Homepage = "https://github.com/DataScience-EngineeringExperts/mcp-warden" +Repository = "https://github.com/DataScience-EngineeringExperts/mcp-warden" +Documentation = "https://datascience-engineeringexperts.github.io/mcp-warden/" +Changelog = "https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/CHANGELOG.md" +Issues = "https://github.com/DataScience-EngineeringExperts/mcp-warden/issues" [build-system] requires = ["hatchling"] diff --git a/src/mcp_warden/precommit.py b/src/mcp_warden/precommit.py index 5c88e36..14b4bba 100644 --- a/src/mcp_warden/precommit.py +++ b/src/mcp_warden/precommit.py @@ -70,7 +70,7 @@ def _redact_server(command: str, args: list[str]) -> str: "error: no MCP server command supplied.\n" "Configure the server command via `args:` in .pre-commit-config.yaml, using\n" "the `--` separator to mark where the server launch argv begins, e.g.:\n\n" - " - repo: https://github.com/ernestprovo23/mcp-warden\n" + " - repo: https://github.com/DataScience-EngineeringExperts/mcp-warden\n" " rev: v1.0.1\n" " hooks:\n" " - id: mcp-warden-check\n" diff --git a/tests/test_signing.py b/tests/test_signing.py index efbf360..722c885 100644 --- a/tests/test_signing.py +++ b/tests/test_signing.py @@ -587,7 +587,7 @@ def noisy_boom(statement, token): #: workflow path. NEVER rename .github/workflows/sigstore-fixture.yml or this #: identity breaks (see docs/SIGNING.md). FIXTURE_IDENTITY = ( - "https://github.com/ernestprovo23/mcp-warden/" + "https://github.com/DataScience-EngineeringExperts/mcp-warden/" ".github/workflows/sigstore-fixture.yml@refs/heads/main" ) FIXTURE_ISSUER = "https://token.actions.githubusercontent.com" From 615329de89a87f4b7fd0861ecf61b6f2896c32b5 Mon Sep 17 00:00:00 2001 From: Ernest Provo Date: Mon, 13 Jul 2026 20:20:19 -0400 Subject: [PATCH 2/2] ci: harden workflows with least-privilege permissions and concurrency - Add top-level 'permissions: contents: read' to integrity-gate, action-test, and examples workflows; per-job id-token/security-events overrides preserved. - Add concurrency groups (workflow+ref, cancel-in-progress) to integrity-gate, action-test, examples, and deps-locked, mirroring docs.yml. - Batch dependabot github-actions bumps into a single grouped PR. --- .github/dependabot.yml | 5 +++++ .github/workflows/action-test.yml | 9 +++++++++ .github/workflows/deps-locked.yml | 4 ++++ .github/workflows/examples.yml | 8 ++++++++ .github/workflows/integrity-gate.yml | 9 +++++++++ 5 files changed, 35 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fb277d3..0dcf89b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,3 +22,8 @@ updates: - "ci" commit-message: prefix: "ci" + # Batch all github-actions bumps into a single PR to reduce CI churn. + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/action-test.yml b/.github/workflows/action-test.yml index 2c13746..6fcf221 100644 --- a/.github/workflows/action-test.yml +++ b/.github/workflows/action-test.yml @@ -22,6 +22,15 @@ on: - "tests/fixtures/**" - ".github/workflows/action-test.yml" +# Least-privilege by default; the action-upload-sarif job widens scope locally +# (security-events: write) for the real SARIF upload path. +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: # -------------------------------------------------------------------------- # Matrix job: pass path + blocking proof on ubuntu / macos / windows. diff --git a/.github/workflows/deps-locked.yml b/.github/workflows/deps-locked.yml index ef101b3..ed81a81 100644 --- a/.github/workflows/deps-locked.yml +++ b/.github/workflows/deps-locked.yml @@ -24,6 +24,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: deps-locked: name: Hash-locked dev/CI install diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml index 144de1f..43a7605 100644 --- a/.github/workflows/examples.yml +++ b/.github/workflows/examples.yml @@ -16,6 +16,14 @@ on: pull_request: branches: [main] +# Least-privilege: both jobs only read the repo. +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: # -------------------------------------------------------------------------- # Job 1: YAML-lint the example workflows. diff --git a/.github/workflows/integrity-gate.yml b/.github/workflows/integrity-gate.yml index 00dbe7d..8816289 100644 --- a/.github/workflows/integrity-gate.yml +++ b/.github/workflows/integrity-gate.yml @@ -6,6 +6,15 @@ on: pull_request: branches: [main] +# Least-privilege by default; the sigstore-e2e job widens scope locally +# (id-token: write) for ambient-OIDC signing. +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: # -------------------------------------------------------------------------- # Job 1: pytest suite