v0.2.1

A security and quality pass on 0.2.0. Three new reviews this time: one looked at what a hostile repository can do through stackhint, one ran every registry entry through every command (about 16 000 runs and 630 install/rollback round trips), and one ran stackhint on 15 public projects it had never seen. After the fixes, two more reviews checked the fixes themselves and found more, which are fixed too. Every fix has a test; there are now 340 tests.

Security

• git log on a scanned repository could run a program: in a partial clone, git fetched a missing commit lazily and ran the repository's core.sshCommand. All fetches are now off, and a bare repository planted in a subfolder is ignored. A repository whose git files point at a network share gets no history, so git never connects to someone else's server.
• Names and paths from a scanned project (server names, skill names, file names, package names) are filtered before they reach the hook context, the MCP server or the terminal: no fake tags, no terminal escape sequences, no live Markdown links. A "name" that reads like an instruction is hidden, and the hook context says that quoted names are data, not instructions.
• Configured servers are recognised by the program they actually launch: the package after npx/uvx/dnx, the image after docker run, the script after node. So npx evil-pkg @playwright/mcp, look-alike hosts such as mcp.sentry.dev.evil.example and a URL passed to some unknown program no longer count as the real tool.
• The Markdown install plan now quotes the claude mcp add command. Copied without quotes, ${TOKEN} would have expanded and the real secret would have been written into ~/.claude.json.
• If a folder name contains characters that bash, PowerShell or cmd.exe would interpret, the suggested command leaves the path out instead of printing it.

Recommendations

• One stray file (a Homebrew formula, an editor config in Lua) or a manifest without code (docs/requirements.txt for mkdocs, a CocoaPods Gemfile) no longer makes something the project's language.
• Repeating the same kind of hint no longer adds up to certainty, and "Why now" quotes the strongest evidence instead of the first one found.
• A server that is configured but not active (an untrusted Codex project, a disabled server) is not recommended again. The plan says how to enable it.
• recommend --all really lists everything.
• Rolling back installs in the wrong order now tells you which install to undo first.

Smaller fixes

• Opening a session in a drive root or the home folder no longer starts a scan (it used to take 2–3 s).
• .env.production.sample is read, and DB_CONNECTION=mysql is understood.
• Cloudflare Turnstile keys, # nosemgrep comments, Angular templates and example-apps/ folders no longer mislead the scan.

Full list: CHANGELOG.md.