Problem
prompts/get reads a client-supplied prompt name and argument strings, then embeds supported argument values directly into generated prompt text. Unsupported prompt names are also echoed in errors.
Evidence
src/CodeIndex/Mcp/McpServer.cs: HandlePromptsGet reads params.name and params.arguments strings.
src/CodeIndex/Mcp/McpServer.cs: prompt text interpolates path, scope, or symbol argument values.
src/CodeIndex/Mcp/McpServer.cs: unknown prompt errors include the raw name.
Risk
Large prompt names or argument values can produce oversized prompt responses or diagnostics.
Suggested fix
Validate prompt name and argument string lengths before interpolation, and echo bounded display values in errors.
Problem
prompts/getreads a client-supplied prompt name and argument strings, then embeds supported argument values directly into generated prompt text. Unsupported prompt names are also echoed in errors.Evidence
src/CodeIndex/Mcp/McpServer.cs:HandlePromptsGetreadsparams.nameandparams.argumentsstrings.src/CodeIndex/Mcp/McpServer.cs: prompt text interpolatespath,scope, orsymbolargument values.src/CodeIndex/Mcp/McpServer.cs: unknown prompt errors include the raw name.Risk
Large prompt names or argument values can produce oversized prompt responses or diagnostics.
Suggested fix
Validate prompt name and argument string lengths before interpolation, and echo bounded display values in errors.