Skip to content

Fix MCP cursor and guard filter bounds - #3326

Merged
Widthdom merged 4 commits into
mainfrom
fix-issue3112-3193-3073
Jun 6, 2026
Merged

Fix MCP cursor and guard filter bounds#3326
Widthdom merged 4 commits into
mainfrom
fix-issue3112-3193-3073

Conversation

@Widthdom

@Widthdom Widthdom commented Jun 6, 2026

Copy link
Copy Markdown
Owner

Summary

  • Cap resources/list cursors, use checked page-limit arithmetic, and avoid emitting nextCursor values outside the accepted range.
  • Reject MCP search cursors with non-finite scores or negative chunk/offset fields.
  • Stop reading MCP search guard filters as soon as the combined guard-filter limit is exceeded.

Validation

  • dotnet build
  • dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~McpServerTests.ResourcesList"
  • dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ToolsCall_Search_InvalidCursorDomain"
  • dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ToolsCall_Search_GuardFiltersFailFastWhenCombinedArraysExceedLimit"
  • dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~McpServerTests"
  • dotnet run --project tools/CodeIndex.Changelog -- check
  • dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
  • Codex adversarial review of origin/main..HEAD; initial finding fixed, second review reported no blocking/actionable issues.

Documentation / Changelog

  • Added changelog fragments:
    • changelog.d/unreleased/3073.fixed.md
    • changelog.d/unreleased/3112.fixed.md
    • changelog.d/unreleased/3193.fixed.md

Follow-up Candidates

None.

Fixes #3112
Fixes #3193
Fixes #3073

@Widthdom
Widthdom marked this pull request as ready for review June 6, 2026 12:37
@Widthdom
Widthdom merged commit b524f28 into main Jun 6, 2026
10 checks passed
@Widthdom
Widthdom deleted the fix-issue3112-3193-3073 branch June 6, 2026 18:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant