Skip to content

v0.4.1-beta

Choose a tag to compare

View all tags
@Lekssays Lekssays released this 09 Jun 16:00
· 197 commits to main since this release
v0.4.1-beta
6e9db32

🚀 codebadger — v0.4.1-beta

🎯 Highlights

v0.4.1-beta turns the v0.4.0 scalability redesign into a production-ready, hardened deployment. The whole stack — including the MCP server itself — now comes up from a single docker compose; Postgres + Redis are required defaults (SQLite is gone); there's a real /health endpoint for orchestrators; idle codebases are evicted to survive long-running batches; you can analyze pasted code snippets, not just repos and paths; and every LLM-supplied input now passes a thorough validation + security layer backed by a documented threat model.

⚠️ Breaking Changes

  • Postgres + Redis are now required (and the default). SQLite and the in-process coordinator have been removed. This reverses the v0.4.0 "optional" note — the server now fails fast on a missing/unreachable Postgres or Redis. Stand the stack up with ./scripts/deploy.sh (or docker compose up -d).
  • pgdata relocated out of playground/ → now ./pgdata (override with POSTGRES_DATA_PATH) so Joern workers can't reach the database files. Migration: while stopped, mv playground/pgdata ./pgdata to preserve an existing catalog, or start fresh.
  • redis-py bumped to 8.x (from 5.x). All in-code usage is stable API; review any custom Redis integrations.

📦 What's New

One-Command Full-Stack Deployment (fixes #21)

  • New Dockerfile.mcp containerizes the MCP server; docker compose up -d now brings up MCP + Joern + Postgres + Redis together.
  • The MCP drives the host Docker daemon (Docker-out-of-Docker via the mounted socket) and uses host networking, so it builds CPGs and spawns per-CPG pool workers as sibling containers — no app code changes required.
  • New scripts/deploy.sh (up / down / restart / logs / status) builds, launches, exports an absolute playground path for pool mounts, and polls /health.

Production /health Endpoint (fixes #20)

  • Reports status (up / partial / down), an mcp: "codebadger" field, and a dependencies map (joern, postgres, redis, docker, cpg_queue) — returns 200 for up/partial and 503 for down, so it works directly as a liveness/readiness probe.

Idle CPG Eviction (memory safety on long runs)

  • Servers idle beyond JOERN_IDLE_TTL_SECONDS (default 600s) are offloaded by a background reaper and auto-wake on the next query — fixing the long-run idle-worker leak that could exhaust RAM/swap.
  • Explicit JOERN_MEMORY_BUDGET_MB budgeting plus per-run file logging (logs/codebadger-<ts>-<pid>.log + a codebadger-latest.log symlink).

Code Snippet Analysis (fixes #19)

  • generate_cpg(source_type="snippet", code=..., language=...) analyzes code pasted straight into the chat — no repo or path needed. Staged like any other source, with content-hash dedup so re-pasting the same code reuses the cached CPG.

Security: Threat Model + Hardening (see docs/security.md)

  • New docs/security.md: threat model, trust boundaries (Mermaid), the controls we provide, and a production hardening checklist.
  • Every LLM-supplied input is now validated: codebase_hash, language, branch & github_token (anti arg-/URL-injection, e.g. blocks --upload-pack), snippet code/filename/label, and regex filters (length + ReDoS-shape guard).
  • run_cpgql_query now enforces the CPGQL blocklist by default (process exec, file read/write, network, dynamic dependency load, reflection) — previously the blocklist was never wired in. Patterns expanded after an audit. (Defense-in-depth; the real boundary is the Joern worker sandbox.)
  • Resource caps at the executor: query timeout ≤ 300s, ≤ 10 000 rows, ≤ 5 MB output, ≤ 5 000-line snippet spans, and clamped take(n)/depth — with visible truncated flags (never silent).
  • Filesystem hardening: symlink-safe local copy (no dereferencing escapes), realpath/commonpath confinement, a deletion guard on remove_cpg, and host-path redaction in client-facing errors.

📚 Documentation

  • New docs/security.md (threat model + diagrams), linked from both READMEs.
  • docs/installation.md and docs/deployment.md rewritten as clear, step-by-step guides (full-stack and host-dev paths, day-2 ops).
  • New docs/available-tools.md cataloguing every MCP tool; snippet flow documented across usage/deployment.

🐳 Deployment & Infrastructure

  • Dockerfile.mcp (new) — python:3.13-slim + git + Docker CLI 29.5.3 (client only).
  • Dependency bumps: fastmcp>=3.4.2, mcp>=1.27.2, aiohttp>=3.14.1, uvicorn>=0.49.0, psycopg[binary]>=3.3.4, redis>=8.0.0.
  • Backing-service URLs now resolve from env — DATABASE_URL/REDIS_URL, or the component POSTGRES_*/REDIS_* vars compose uses — instead of hardcoded defaults, so a host-run MCP honors POSTGRES_PORT/REDIS_PORT overrides.
  • Postgres on 55432 / Redis on 56379 (overridable); updated .env.example, docker-compose.yml, .dockerignore, and cleanup.sh.

🛠️ Tooling

  • get_cpg_status description now explicitly documents it as the way to wait for generate_cpg — poll with the returned codebase_hash until ready/failed (fixes #22).

🧪 Testing

  • New/expanded suites for snippets, the security validators (CPGQL blocklist + bypasses, ReDoS guard, error redaction), executor resource caps & truncation, malformed-hash rejection, and QueryLoader numeric clamps. 426 passing / 24 skipped.

⚠️ Notes

  • This remains a beta release.
  • Dedicate the host to Codebadger — the MCP container mounts the Docker socket (root-equivalent on the host) and uses host networking. The MCP HTTP endpoint has no built-in auth; front it with a reverse proxy / network policy.
  • Pool-mode invariant still applies: build container mem_limit + memory_budget_mb ≤ total Joern budget. Run python scripts/recommend_config.py before launching on a new host.

Full Changelog: v0.4.0-beta...v0.4.1-beta

Assets 2
Loading