chore(agents): untrack .mcp.json — internal agent infra in a public repo - #70
Merged
Conversation
`.mcp.json` declares project-scoped MCP servers (`akira-mcp-board`, `akira-mcp-grc`). Those are Enkom-internal agent infrastructure: nobody outside Enkom has those commands on PATH, so for an external contributor this file is dead config that only fails to start. It also names internal tooling in the one Enkom repo with an external audience. Every sibling of this file is already ignored — .cursor/, .claude/, .agents/, AGENTS.md (.gitignore:237-241). `.mcp.json` was simply missed when that block was written; it was added by 5847caa alongside the hermes-board mount. This adds it to the same block. The file stays on disk and keeps working locally — only the tracking is removed, so the agent tooling can keep regenerating it without producing a diff. Note this does not unpublish anything: .mcp.json has been on public origin/main since 5847caa and remains in history. Purging it would need a history rewrite + force-push. Not done here, and judged not worth it — the exposed content is two command names, no paths, credentials, or tokens.
🔒 Security Validation ReportGenerated: Tue Jul 28 23:26:38 UTC 2026 📊 Summary
✅ Overall Security Status: PASSEDAll critical security validations passed successfully. 🔍 DetailsThis report covers:
📋 Next Steps✅ Security validation passed. Code is ready for deployment. ✅ Security validation passed! This code meets all security requirements. |
🔍 Pull Request SummaryGenerated: Tue Jul 28 23:30:28 UTC 2026 📋 Validation Results
✅ Overall Status: PASSED🔒 Security Checklist
📝 Review NotesPlease review the security implications of this change carefully. ✅ Automated validation passed! This PR is ready for review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.mcp.jsondeclares project-scoped MCP servers (akira-mcp-board,akira-mcp-grc) — Enkom-internal agent infrastructure. Nobody outside Enkom has those commands on PATH, so for an external contributor the file is dead config that only fails to start, and it names internal tooling in the one Enkom repo with an external audience.Every sibling of this file is already ignored —
.cursor/,.claude/,.agents/,AGENTS.md(.gitignore:237-241)..mcp.jsonwas simply missed when that block was written; it came in via 5847caa alongside the hermes-board mount. This adds it to the same block.The file stays on disk and keeps working locally — only tracking is removed, so the agent tooling can keep regenerating it without producing a diff.
This does not unpublish anything.
.mcp.jsonhas been on publicmainsince 5847caa and remains in history; purging it would need a history rewrite + force-push. Not done here, and judged not worth it — the exposed content is two command names, with no paths, credentials, or tokens.Verified
.mcp.jsonis the only tracked file in this repo that references akira/hermes/kanban/grc, by name or by content.