mirror of
https://github.com/github/awesome-copilot.git
synced 2026-08-25 18:25:01 +00:00
Aaron Powell
37dcfd2325
* fix(plugins): discover MCP servers from spec-mandated mcp.json at plugin root MCP config was declared via an extensions.com.github.awesome-copilot.mcpServers pointer to a .mcp.json file. That namespace is stripped from the served manifest, so nothing carried the MCP declaration through materialization. Per Agent Plugins v1.0.0 the fixed location is mcp.json at the plugin root, which already ships as-is. Drop the pointer, rename both .mcp.json files, and validate mcp.json (schema, closed top-level fields, server transport variants). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Validate mcp.json against the full v1.0.0 schema with Ajv Replace the hand-rolled MCP checks with Ajv validation against the canonical Agent Plugins v1.0.0 MCP schema, so non-spec configs (empty command/url, non-string args, reserved PLUGIN_ROOT/PLUGIN_DATA env keys, invalid cwd, unknown server fields) are rejected. Per-server errors are re-derived from the matching discriminated branch to avoid unhelpful oneOf output. Also reject a top-level extensions.mcpServers placement, which slipped through because the manifest schema allows arbitrary object-valued extension keys. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9 * Strengthen mcpServers and stdio semantic validation Reject mcpServers under any extensions namespace in plugin.json so inline MCP config cannot bypass root-level mcp.json enforcement. Also run stdio semantic checks after schema validation to reject absolute command paths and cwd values that escape the plugin root, with regression tests for both cases. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9 * Enforce MCP path containment across platform path styles Resolve plugin-relative commands and placeholder-rooted cwd values against the plugin root, normalize Windows separators, and reject lexical or symlink escapes. Add regression coverage for traversal, placeholders, Windows paths, and symlink targets. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9 * Align MCP semantics with the v1.0.0 specification Restore the canonical cwd pattern and literal ./ command prefix. Validate remote HTTP URLs and headers, including HTTPS requirements, header syntax, control characters, and case-insensitive duplicates. Keep PLUGIN_DATA checks lexical-only so it is not conflated with the plugin filesystem root. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9 * Reject unsafe MCP symlink paths Resolve mcp.json through the filesystem and require a regular file inside the real plugin root, reporting dangling links explicitly. Harden command and PLUGIN_ROOT containment checks to inspect symlink ancestors with lstat and realpath instead of treating unresolved paths as ordinary missing segments. Add regression coverage for outside, dangling, and ancestor symlink cases. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9 * Handle mixed separators in MCP data paths Split PLUGIN_DATA traversal checks on both slash types so mixed separators cannot bypass lexical containment on Windows clients. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9 * Reject credentials in MCP package headers MCP headers are visible package data, so reject credential-bearing headers including authorization, proxy authorization, cookies, and common API-key or token names. Preserve ordinary custom headers and add focused regression coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 764c5bb4-2811-4dc1-b61d-56c4a5597cc9
Contributor Reporting (Maintainers) 🚧
This directory contains build scripts and utilities for maintaining the repository.
Build Scripts
update-readme.mjs
Generates the main README.md and documentation files from the repository content (agents, prompts, instructions, skills, hooks, collections).
generate-marketplace.mjs
Automatically generates .github/plugin/marketplace.json from all plugin directories in the plugins/ folder. This file is used by the GitHub Copilot CLI to discover and install plugins from this repository.
How it works:
- Scans all directories in
plugins/ - Reads each plugin's root
plugin.jsonfor metadata - Generates a consolidated
marketplace.jsonwith all available plugins - Runs automatically as part of
npm run build
To run manually:
npm run plugin:generate-marketplace
generate-website-data.mjs
Generates JSON data files for the website from repository content.
Contributor Tools
contributor-report.mjs— generates a markdown report of merged PRs for missing contributors (includes shared helpers).add-missing-contributors.mjs— on-demand maintainer script to automatically add missing contributors to.all-contributorsrc(infers contribution types from merged PR files, then runs the all-contributors CLI).
Key notes for maintainers
- Reports are generated on-demand and output to
reports/contributor-report.mdfor human review. - The report output is intentionally minimal: a single list of affected PRs and one command to add missing contributor(s).
- This repository requires full git history for accurate analysis. In CI, set
fetch-depth: 0. - Link: all-contributors CLI documentation
On-demand scripts (not CI)
These are maintainer utilities. They are intentionally on-demand only (but could be wired into CI later).
add-missing-contributors.mjs
- Purpose: detect missing contributors, infer contribution types from their merged PR files, and run
npx all-contributors add ...to update.all-contributorsrc. - Requirements:
- GitHub CLI (
gh) available (used to query merged PRs). .all-contributorsrcexists.- Auth token set to avoid the anonymous GitHub rate limits:
- Set
GITHUB_TOKEN(preferred), orGH_TOKENfor theghCLI. - If you use
PRIVATE_TOKENlocally,contributor-report.mjswill map it toGITHUB_TOKEN.
- Set
- GitHub CLI (
Graceful shutdown
contributor-report.mjscallssetupGracefulShutdown('script-name')fromeng/utils/graceful-shutdown.mjsearly in the file to attach signal/exception handlers.
Testing & maintenance
- Helper functions have small, deterministic behavior and include JSDoc comments.
- The
getMissingContributorsfunction incontributor-report.mjsis the single source of truth for detecting missing contributors fromall-contributors checkoutput.