GHAS code-scanning alerts on this PR:
- dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on
untrusted input, letting a crafted payload force unbounded error
enumeration. Switch to allErrors:false (default) so validation
short-circuits on the first failure; the 400 still names that path.
- http.ts (js/missing-rate-limiting): the authenticated routes (/mcp,
/tools/:name) had no edge throttle — auth/JWT verification ran on every
request before the per-sub dispatch limiter could apply. Add an IP-keyed
express-rate-limit in front of authenticate (120/60s default, configurable),
returning the standard 429 shape. Defense-in-depth over the per-sub +
per-tool limiter in executeTool; API GW/WAF remains the production edge.
Tests: +2 cases proving the edge limiter throttles before auth (429, not
401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean.
Add the single authoritative tool-execution path (executeTool) plus the two
universal interfaces over it (design.md §2.5, §7.3):
- dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance
egress redaction (redactDeep), and structured audit emission on one path.
- audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions.
- mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and
tools/call routed through executeTool.
- http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz.
- openapi.ts: buildOpenApiDocument wraps the existing path generator into a full
OpenAPI 3.1 document.
- local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct
outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6).
