Skip to content

Release v3.17.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Sep 10:27
v3.17.1
dfbe8e1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

cratis ai install and update read MCP server descriptors from the corpus and write them into native client configs (Claude Code, VS Code/Copilot, Cursor, Codex, OpenCode). Installing from an alternate --source could therefore register any executable: a descriptor with "command":"/bin/sh","args":["-c",…] was written verbatim into .mcp.json and .codex/config.toml, and the host later launches it. The official Cratis AI source is trusted, so this needed an untrusted --source. It still crossed a source-to-execution boundary the Pi bridge already guards.

Security

  • The screenplay MCP descriptor must be stdio, command cratis, with exactly screenplay mcp as arguments. Anything else is refused before any file is written, matching the rule the Pi bridge in Cratis/AI enforces.
  • cratis ai status flags a managed MCP entry whose launch command is not the allowed one.
Assets 6
Loading