510e9796f9
The Python MCP server + hardware test harness that lived under mcp-server/ now has its own home at https://github.com/meshtastic/meshtastic-mcp (published, versioned independently). Remove the in-tree copy and wire the firmware repo to the standalone server externally. - Delete mcp-server/ (96 files) and the 8 harness-coupled AI workflow files under .claude/commands/ and .github/prompts/ that drove ./mcp-server/ run-tests.sh — those workflows now ship with meshtastic-mcp as skills. - .mcp.json: register the server via `uvx --from git+https://github.com/meshtastic/meshtastic-mcp meshtastic-mcp` instead of a local ./mcp-server/.venv, keeping MESHTASTIC_FIRMWARE_ROOT="." so the MCP tools still work from this checkout with no local build. - Repoint the remaining references (AGENTS.md, CLAUDE.md, .github/copilot-instructions.md, bin/regen-*.sh, docs, Screen.h, userPrefs.jsonc, test/fixtures/nodedb/README.md, .trunk/configs/.bandit) at the standalone repo. The MCP tool surface is unchanged — only the pytest harness moves out; run it from a meshtastic-mcp checkout with MESHTASTIC_FIRMWARE_ROOT pointed here. No build/CI/platformio coupling existed, so nothing in the firmware build changes. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.4 KiB
Plaintext
28 lines
1.4 KiB
Plaintext
[bandit]
|
|
# Rule IDs: https://bandit.readthedocs.io/en/latest/plugins/index.html
|
|
#
|
|
# B101 assert_used
|
|
# pytest assertions + internal invariants; required for pytest.
|
|
# B110 try_except_pass
|
|
# best-effort cleanup paths (atexit handlers, pubsub unsubscribe,
|
|
# session-end file close, socket shutdown). Logging inside the
|
|
# except block would be worse than the silent pass — teardown is
|
|
# already at end-of-session and the surrounding caller has context.
|
|
# B112 try_except_continue
|
|
# defensive loops over flaky sources (pubsub handlers, device
|
|
# re-enumeration polls). One failed iteration shouldn't abort the loop.
|
|
# B404 import_subprocess
|
|
# the bin/ proto + fixture tooling (regen-py-protos, gen-fake-nodedb-seed,
|
|
# seed-json-to-proto) shells out to protoc and helper scripts — subprocess
|
|
# is a load-bearing import here, not a smell. The "consider possible security
|
|
# implications" advisory is redundant given the file-level review already applied.
|
|
# B603 subprocess_without_shell_equals_true
|
|
# all subprocess calls use a static argv list; `shell=False` is the
|
|
# default and we never string-interpolate user input into the command.
|
|
# B606 start_process_with_no_shell
|
|
# same invariant as B603 — running a binary via argv list (not
|
|
# `shell=True`) is the safe pattern bandit is asking for.
|
|
#
|
|
# Higher-severity checks (B102 exec_used, B301 pickle, B307 eval,
|
|
# B602 shell=True, etc.) remain enabled.
|
|
skips = B101,B110,B112,B404,B603,B606 |