Skip to content

@polygraphso/litmus 0.31.0

Choose a tag to compare

View all tags
@RubenSousaDinis RubenSousaDinis released this 08 Jul 11:23
· 14 commits to main since this release
litmus-v0.31.0
641b95a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adds three composable, backward-compatible launch knobs (#107) so the harness can grade honestly-built MCP servers that do not boot from a bare declared entry:

  • serverArgs (--server-arg / server_args) — arguments appended to the server command, e.g. a mcp serve subcommand. Recorded in the evidence.
  • serverEnv (--server-env KEY=VALUE / server_env) — startup env the server needs to boot, e.g. an API key. Injected privately like the planted canaries and redacted from the recorded command.
  • entrySubpath (--entry / entry) — a package-relative entry file instead of a declared bin. Resolved inside the staged package root and rejected on traversal. Docker isolation only (npm/github).

Setting serverArgs or entrySubpath bypasses bin probing and does a single named launch; the C-02 egress target launches the same way, so it grades the same process. All three are optional and default off (semver-minor).

No methodology-version change — stays litmus-v14. The knobs change how a server is launched, not the pass/fail semantics, so existing attestations are unaffected. server.json bumped in lockstep.

Assets 3
Loading