fix(mcp): reject local targets over HTTP transport

[rodboev]

Summary

HTTP MCP callers can currently pass local filesystem targets to scan_skill, and the server forwards those paths into the normal scan graph. This adds an MCP transport guard so routable HTTP use rejects local paths and file:// targets before the graph can read them, while CLI and stdio MCP scans keep their existing local-path behavior.

Closes #191

Root cause

scan_skill forwards the caller-provided target to run_scan without transport context. The input resolver then treats local files and directories as valid scan targets, which is correct for trusted local use but too broad for unauthenticated HTTP exposure.

Diff Notes

• Add an MCP-layer local-target guard for HTTP server calls.
• Make direct build_server() construction fail closed until a trusted transport explicitly enables local targets.
• Keep unknown transports fail closed, and reject local YARA configuration when local targets are disabled.
• Preserve local filesystem scans for CLI and stdio/default run_scan use.
• Keep existing URL allowlist and private-IP protections in the input layer unchanged.
• Add focused MCP unit tests for local-target rejection, UNC-style path classification, remote-target allowance, and default local-target compatibility.

Scope

This does not add MCP authentication, change the generic input resolver, or alter report output. PR #193 covers the documentation warning slice; this PR covers the code guard.

Verification

• python -m pytest tests/unit/test_mcp_server.py -q -> 26 passed
• uv run ruff check src/ tests/ -> passed
• uv run ruff format --check src/ tests/ -> passed
• git diff --check -> passed
• CI Lint & Test (Python 3.12), Lint & Test (Python 3.13), and DCO Check -> pending maintainer approval

Notes

• Rebased onto current main at a818f50f541ab2bbb4751e3c2490778f7a1b7c2b; the final diff remains limited to the two MCP guard files.
• Follow-up to maintainer review on feat(mcp): expose SkillSpector as an MCP server with a scan_skill tool #36 (review).

[rng1995]

Approving — solid, fail-closed hardening: HTTP transport sets allow_local_targets=False and _is_local_target() rejects file://, absolute/drive, and UNC paths before the graph runs, while remote schemes pass through. Test coverage is thorough (local/file:// rejected, remote allowed, UNC + relative-path classification, transport policy stdio=allow/http=disallow, and default-compat).

Non-blocking notes:

• _is_local_target() calls Path(target).expanduser().exists() for the relative/no-scheme case, i.e. an unauthenticated HTTP caller can make the server stat() arbitrary relative paths (a minor file-existence oracle). The read itself is still blocked, so impact is low, but consider dropping the .exists() probe and classifying unknown bare strings as non-local.
• Touches mcp_server.py alongside #204, and the README note in #193 documents this behavior — expect a merge-order/rebase with those.

[rng1995]

[Automated SkillSpector Review]

Re-review: approved. The HTTP local-target guard remains unchanged from the prior approved head. The only subsequent commit is formatter-only normalization of static_runner.py and three tests, with no semantic change to the MCP security behavior.

[rng1995]

[Automated SkillSpector Review]

Re-review: requesting changes. The HTTP local-target guard itself remains sound, but the rebased exact head has four failing MCP tests. The new cases still patch mcp_server.resolve_provider_credentials, which no longer exists after main switched this path to is_llm_available; each fails with AttributeError before exercising the guard. Update those tests to patch the current availability seam (for example is_llm_available) and restore the focused suite to green before approval. Exact-head result: 4 failed, 17 passed.