fix(memory-mcp): accept metadata on initialized notifications - #3111
Fibilisim-Tekno wants to merge 1 commit into
Conversation
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 2 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 1 PR taxonomy bucket(s): CI/CD Recommendation. Scanned 2 changed file(s). Roadmap taxonomy buckets: CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 1/7 areas (14%) across 2 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 2 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used📓 Path-based instructions (19)Focus on command injection, unsafe subprocess usage, path traversal, SSRF, secret exposure, and missing tests for new CLI behavior.⚙️ CodeRabbit configuration file Files:
Lightweight agents with frequent invocation Pair programming and code generation Worker agents in multi-agent systems Main development work Orchestrating multi-agent workflows Complex coding tasks Complex architectural decisions Maximum rea...📄 CodeRabbit inference engine (.cursor/rules/common-performance.md) Files:
NEVER hardcode secrets in source code - ALWAYS use environment variables or a secret manager📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
No hardcoded secrets (API keys, passwords, tokens) - validate before any commit📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Always create new objects, never mutate existing ones.📄 CodeRabbit inference engine (.cursor/rules/common-coding-style.md) Files:
Use parameterized queries to prevent SQL injection📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Implement XSS prevention by sanitizing HTML output📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
All user inputs must be validated Enable CSRF protection on all state-changing endpoints Verify authentication and authorization for all protected endpoints Implement rate limiting on all endpoints to prevent abuse Ensure error messages do...📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Write tests before implementation (test-driven development); target 80%+ coverage Achieve minimum 80% test coverage across all three layers: Unit, Integration, and E2E Use AAA structure (Arrange / Act / Assert) in tests with descriptive tes...📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Do not hardcode secrets, API keys, passwords, or tokens📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Always create new objects and never mutate in place; return new copies instead Keep files between 200–400 lines typical, with a maximum of 800 lines Extract helpers when a file exceeds 200 lines Handle errors explicitly at every level; neve...📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
HTML output must be sanitized where applicable📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Auto-format JavaScript/TypeScript files using Prettier after edit Warn about `console.log` statements in edited files Check all modified files for `console.log` statements before session ends📄 CodeRabbit inference engine (.cursor/rules/typescript-hooks.md) Files:
Never hardcode secrets; always use environment variables for sensitive credentials like API keys Throw an error when required environment variables are not configured to fail fast and ensure security prerequisites are met📄 CodeRabbit inference engine (.cursor/rules/typescript-security.md) Files:
Use Playwright as the E2E testing framework for critical user flows in TypeScript/JavaScript📄 CodeRabbit inference engine (.cursor/rules/typescript-testing.md) Files:
Use spread operator for immutable updates in TypeScript/JavaScript instead of direct mutation Use async/await with try-catch for error handling in TypeScript/JavaScript Use Zod for schema-based input validation in TypeScript/JavaScript No c...📄 CodeRabbit inference engine (.cursor/rules/typescript-coding-style.md) Files:
Use the ApiResponse interface pattern with generic type parameter: `interface ApiResponse { success: boolean; data?: T; error?: string; meta?: { total: number; page: number; limit: number; } }` Implement custom React hooks following the...📄 CodeRabbit inference engine (.cursor/rules/typescript-patterns.md) Files:
Required environment variables must be validated at startup📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Use parameterized queries for all database writes (no string interpolation) Auth/authz must be checked server-side for every sensitive path Rate limiting must be applied to all public endpoints📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
🔇 Additional comments (2)
📝 SummarySummary by CodeRabbit
WalkthroughThe ChangesInitialized notification metadata
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The metadata support accepts valid object metadata while malformed and premature notifications remain rejected. No actionable merge risk remains. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
1 participant
Summary
A client sending
notifications/initializedwith validparams: {"_meta": {}}never completes initialization: subsequenttools/listrequests return-32002 Server is not initialized.The handler currently requires an empty params object, although the MCP schema permits optional_metathroughNotificationParams.Accept object-valued
_metaon this notification while preserving validation of unknown fields, malformed metadata, and initialization ordering. This is a protocol-level reproduction; it does not claim a particular client currently emits this metadata.Testing
EPERMtest.EPERMtest remains.git diff --check: passed.npm testwas attempted but is not green: unrelated hook/Windows shell tests also fail. No full-suite success is claimed.Only the notification handler and its tests are changed.