feat(mcp): carry MCP to cursor, gemini and zed, merging shared settings safely - #111
Merged
Conversation
…gs safely Six of the eleven targets now carry an MCP declaration, up from three. cursor gets a dedicated .cursor/mcp.json: `type` on stdio entries (its field table marks it required while its examples omit it, so writing it satisfies both readings) and omitted on remote entries, where Cursor documents no type at all. Its format has no allowlist field, so a declared one is reported as unenforced rather than silently widened. gemini and zed keep servers inside a settings file that also holds unrelated user configuration, which is a different risk class from writing a dedicated file: getting it wrong destroys settings that have nothing to do with skills, and these are the same paths malware targets for persistence. The merge has three rules — only the server key is touched and every other key is preserved; servers kitbash did not write are left alone, so a hand-added one survives; and a file that cannot be parsed is never overwritten. A file containing comments is refused outright, because JSON.parse cannot round-trip them and rewriting would silently delete the user's annotations. The per-client traps are handled rather than passed through: gemini needs an explicit type (a bare url there defaults to Streamable HTTP, the exact inverse of Cline's SSE default) and uses includeTools for the allowlist; zed takes no type key at all, wants timeouts in seconds where every other target uses milliseconds, and silently clamps above 600s, so an over-long timeout is converted and warned about. Gemini also strips credential-shaped variables from the environment it passes to a server, unconditionally, so relying on an ambient token fails with no discoverable cause — that now warns by name. Adds 13 tests, including that unrelated settings survive a merge and that a commented or malformed settings file is left byte-identical. 0.21.0.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Six of eleven targets now carry an MCP declaration, up from three.
New emitters
cursor.cursor/mcp.jsongemini.gemini/settings.jsontype,includeToolsallowlistzed.zed/settings.jsontypekey, timeouts in seconds, 600s clamp warnedThe merge is a destructive-write class
Gemini and Zed keep servers inside settings files holding configuration that has nothing to do with skills — and these are the same paths malware targets for persistence. Three rules:
JSON.parsecan't round-trip them, so rewriting would silently delete the user's annotations.Tested explicitly: unrelated settings (
theme,vim_mode) and the user's own server survive; a commented file and a malformed file are both left byte-identical.Per-client traps handled, not passed through
type— a bareurldefaults to Streamable HTTP there, the exact inverse of Cline's SSE default.typekey (untagged enum), wants seconds where every other target uses milliseconds, and silently clamps above 600s — so an over-long timeout is converted and warned about.TOKEN,SECRET,KEY,AUTH…), so a server relying on an ambient credential fails auth with no discoverable cause. Now warned by name.13 new tests; suite, typecheck, site
--checkand bench gate all green. Ships as 0.21.0.