Skip to content

2.0.0: remove execute_ruby (introspection-only)

Latest
Latest

Choose a tag to compare

View all tags
@mariochavez mariochavez released this 04 Aug 17:06
v2.0.0
f28bbfb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Breaking release. Removes the execute_ruby tool; the server is now introspection-only via its dedicated analyzers.

Why

execute_ruby executed caller-supplied Ruby via bin/rails runner. It was originally built for Rails introspection — routes, schema, model queries — but accepting arbitrary Ruby made it an arbitrary-code-execution surface that a regex denylist and in-process monkey-patching could not safely contain. That was the root cause behind the entire 1.6.x hardening series (PTY command-execution escape, dynamic-dispatch bypasses, a ReDoS in the scanner). Rather than keep hardening a denylist, 2.0.0 removes the tool and the whole vulnerability class with it.

The server is an introspection tool for AI coding agents, and its dedicated analyzers already cover everything execute_ruby was meant for.

Removed

  • execute_ruby tool (breaking). The only capability dropped is running arbitrary live Ruby against the app (ad-hoc data queries) — out of scope for an introspection server, and precisely the risky part.

What to use instead

execute_ruby use Dedicated tool
Read a file get_file ({ path: … })
Find files list_files ({ pattern: … })
Routes / schema / models / controllers / env / structure get_routes, get_schema, analyze_models, analyze_controller_views, analyze_environment_config, project_info

Changed

  • Bootstrap tools reduced 4 → 3: switch_project, search_tools, execute_tool. The internal analyzers are unchanged and still discovered via search_tools / invoked via execute_tool.
  • switch_project quick-start now points to get_file / list_files.
  • Docs (README.md, docs/AGENT.md, docs/COPILOT_AGENT.md, SECURITY.md) rewritten to route file reads/finds through get_file / list_files and to describe the server as introspection-only. The remaining file tools are protected by PathValidator (path-traversal and sensitive-file checks); the app-booting analyzers pass caller input as validated parameters, never as code.

Migration

Remove execute_ruby from client tool configs. Replace file reads with get_file ({ path: … }) and globs with list_files ({ pattern: … }). Ad-hoc data queries (User.count, custom scopes) are no longer supported by design; use the dedicated analyzers for structural introspection. Users who still want free-form execution can pin to the 1.6.x line, which retains the hardened execute_ruby.

Security

Thanks to Pluto Security for responsibly disclosing the execute_ruby command-execution vulnerability that motivated this work (addressed by hardening in 1.6.1 and by the removal here).

Full changelog: https://github.com/maquina-app/rails-mcp-server/blob/v2.0.0/CHANGELOG.md

Assets 2
Loading