fix(docs): documented dependency-scan command does not match the MCP prompt name

Aperta Adatta ai principianti
  • Qualcosa non va?
#180 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
1/5
Tempo stimato
Meno di un'ora
Idoneità per principianti
79/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
node.js, typescript
Ambito
developer-experience, documentation

Direzione di ricerca

Leggi le istruzioni per la scansione delle dipendenze in README.md e confronta il comando slash documentato con il prompt registrato in mcp-server/src/index.ts. Correggi la grafia in README.md affinché corrisponda al prompt esistente; verifica che il comando documentato corrisponda al nome registrato e che il controllo di ripristino nell’issue sia soddisfatto.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

The README instructs users to run /security:scan-deps, but the extension registers the dependency-scanning MCP prompt as security:scan_deps. Gemini CLI preserves the underscore when converting this prompt into a slash command, so the documented spelling does not resolve. The dependency-scanning prompt exists; a separate TOML command file is not required.

Runtime or environment

The latest published extension release is v0.5.0, tag commit 0e4812c469a61fb87e29ce939f393715221553fb. Current main is 2227f3cf7150972baac695b8233abc2186408538. The README, command tree, extension manifest, and MCP entry-point source are identical across those two revisions. Runtime checks used the release's darwin.arm64.security.tar.gz installed into a disposable Gemini CLI home, Gemini CLI 0.67.0 (latest stable npm release), and Node.js v26.12.1. The CLI source tag resolves to dc6602cec4a6e823aa33937144245dc421e5165f.

Steps to reproduce

  1. Inspect README.md lines 57 and 59–62 on either extension baseline: the dependency-scanning instructions specify /security:scan-deps.
  2. Inspect the securityServer entry in gemini-extension.json, then its MCP prompt registration in mcp-server/src/index.ts lines 176–180: the registered name is security:scan_deps.
  3. For the executed runtime check, install the published extension asset into an isolated CLI home, connect an MCP SDK stdio client to the installed mcp-server/dist/index.js, and call prompts/list and prompts/get with both spellings. Feed the actual returned prompt descriptors into the installed CLI's exported McpPromptLoader.loadCommands, then call its exported parseSlashCommand with each spelling. The probe supplies only the configuration methods used to expose the observed server and prompt descriptors; it does not modify the loader or parser.

These checks exercised MCP discovery, prompt retrieval, slash-command construction, and command lookup. An authenticated interactive UI session and an actual vulnerability scan were not run.

Expected behavior

The dependency-scan command documented in the README should resolve to the extension's dependency-scanning prompt. MCP-backed slash commands are supported, so this does not require adding a command file.

Actual behavior

The installed extension's MCP server and the CLI loader return the underscore spelling. The CLI parser resolves that spelling and does not resolve the documented hyphen spelling. Meaningful probe output:

prompts/list: ["security:note-adder","security:scan_deps"]
McpPromptLoader commands: ["security:note-adder","security:scan_deps"]
parseSlashCommand /security:scan-deps: commandToExecute is undefined; canonicalPath is []
parseSlashCommand /security:scan_deps: commandToExecute.name is "security:scan_deps"
prompts/get underscore: text response, length 1790
prompts/get hyphen error: MCP error -32602: MCP error -32602: Prompt security:scan-deps not found

The complete commands/security/ tree contains only analyze.toml, analyze-full.toml, and analyze-github-pr.toml. There is no hyphen alias there. The CLI's MCP loader only replaces whitespace in prompt names, and its parser matches exact command names or explicitly supplied aliases.

Evidence

  • Expected source: README dependency-scanning instructions.
  • Failure source: Executed MCP and CLI loader/parser probe against the installed release; prompt registration establishes the same mismatch on main.
  • Evidence provenance: observed
  • Local verification: reproduced
  • Reproduction completeness: complete

The CLI prompt-name conversion preserves underscores; command lookup does not interchange underscores and hyphens. The extension manifest connects securityServer to this MCP entry point. Runtime observations concern command registration and retrieval, not scan execution or scan-result correctness.

Restoration check

Using the published extension, the dependency-scan spelling documented in the README should appear among registered slash commands, resolve in command lookup, and retrieve the dependency-scanning prompt. Retain a control showing that the resolved prompt requests dependency scanning rather than a code-change analysis.

References

Open PR #155 proposes renaming the prompt to match the README. It remains unmerged, and both checked extension baselines retain the mismatch. This report records the current released behavior; no PR comment is requested.

Triage assessment

  • Impact level: P2
  • Assessment status: supported
  • Impact basis: Following the documented dependency-scan command fails command lookup, blocking that documented entry point. The failure is bounded to its spelling; the dependency-scanning prompt is present.
  • Workaround status: available
  • Workaround basis: Use /security:scan_deps; the executed lookup resolves it and the MCP server returns its dependency-scanning prompt. End-to-end vulnerability scanning was not tested.
Lingua principale
TypeScript
Stelle
793
Fork
60
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di gemini-cli-extensions/security

Tutte le issue di gemini-cli-extensions/security

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.