The headline
src/tools/ — 820 analyser modules, the bulk of the codebase — had no tests at all, while being the source of every parsing defect found so far.
It now has a sweep that drives all of them across five situations: a realistic Symfony application, one doing everything the tools exist to flag, a project containing nothing, an empty directory, and a path that does not exist. Each must return something the server can serialise, without throwing and without hanging.
Statement coverage 2.8% → 78.9%. Lines 80.7%. Functions 85.2%. 6,760 tests.
Writing those tests found six real defects
Five analysers could not see a method that declares a return type. The matcher went straight from the closing parenthesis to the brace:
/function\s+buildForm\s*\([^)]+\)\s*\{/
That matches buildForm($builder, $options) { and misses buildForm(FormBuilderInterface $builder, array $options): void { — which is exactly what Symfony's own maker generates. Every form written that way was invisible: no fields, no constraints, no findings.
Three of the five are worse: getGroupSequence(): array and guessType(): ?TypeGuess are the signatures the Symfony interfaces oblige you to write. Those analysers could never report on a correct implementation.
Fixed in forms, symfony-form-data-mapper, symfony-form-type-guesser, symfony-validator-group-sequence, symfony-validator-sequence-provider.
The error sanitiser redacted a bare drive root and grew the message doing it. Its Windows-path pattern ended in *, so A:\ became [PATH] — six characters for three. A drive root names no file and reveals nothing. Found by the property-based suite, not by reading the code.
Supply chain and governance
- SPDX headers on all 921 source files, checked in CI
- Verified reproducible build — two clean builds compared byte for byte across 3,432 files, re-checked on every push
- OpenVEX document, generated from
pnpm auditrather than written by hand, shipped with the SBOM - Developer Certificate of Origin, with a CI check that every commit in a pull request is signed off by its author
- MCPB bundle for local installs, and a GitHub Packages mirror
- Branch protection with six required checks, and the governance documents the project was missing
OpenSSF Baseline levels 1, 2 and 3, and the OpenSSF Best Practices passing badge.
Full changelog: https://github.com/shakaran/symfony-agent-mcp/blob/main/CHANGELOG.md