mirror of https://github.com/penpot/penpot.git synced 2026-09-02 01:59:17 +00:00

History

🐛 Gate MCP REPL server behind isDevEnv check (#11282 )

* 🐛 Gate MCP REPL server behind isDevEnv check

The ReplServer was starting unconditionally on every MCP server
instance, regardless of configuration. This exposed an
unauthenticated POST /execute endpoint that forwarded arbitrary
JavaScript to connected Penpot plugins.

Gate ReplServer creation, startup, and shutdown behind isDevEnv(),
consistent with how CljsReplTool and other dev tools are already
protected. Log an info message when the REPL server is disabled.

Consolidate the dev-env check into a single static isDevEnvEnabled()
method that isDevEnv() delegates to, avoiding duplicate logic. Add
PluginBridge.close() for proper WebSocket server cleanup on shutdown.

Add regression tests that construct PenpotMcpServer and verify
hasReplServer() returns the correct value based on the dev-env flag.

AI-assisted-by: mimo-v2.5-pro

* ✨ Add PENPOT_MCP_REPL_ENABLE env var for explicit REPL control

Allow the REPL server to be enabled independently of the devenv
setting via a new PENPOT_MCP_REPL_ENABLE environment variable.
When set to "true", the REPL server starts regardless of
PENPOT_MCP_DEVENV; when set to any other value, it is disabled.
When unset, the previous isDevEnv fallback applies.

Addresses review feedback on PR #11282.

AI-assisted-by: mimo-v2.5-pro

2026-09-01 08:50:05 +02:00

data

Merge remote-tracking branch 'origin/staging' into develop

2026-07-08 15:44:37 +02:00

scripts

⏪ Backport mcp package changes from develop

2026-06-08 09:59:33 +02:00

src

🐛 Gate MCP REPL server behind isDevEnv check (#11282 )

2026-09-01 08:50:05 +02:00

.gitignore

⏪ Backport MCP from staging (part 1)