mirror of https://github.com/penpot/penpot.git synced 2026-08-31 09:09:00 +00:00

History

Andrey Antukh eb21d4e899 🐛 Gate MCP REPL server behind isDevEnv check

The ReplServer was starting unconditionally on every MCP server
instance, regardless of configuration. This exposed an
unauthenticated POST /execute endpoint that forwarded arbitrary
JavaScript to connected Penpot plugins.

Gate ReplServer creation, startup, and shutdown behind isDevEnv(),
consistent with how CljsReplTool and other dev tools are already
protected. Log an info message when the REPL server is disabled.

Consolidate the dev-env check into a single static isDevEnvEnabled()
method that isDevEnv() delegates to, avoiding duplicate logic. Add
PluginBridge.close() for proper WebSocket server cleanup on shutdown.

Add regression tests that construct PenpotMcpServer and verify
hasReplServer() returns the correct value based on the dev-env flag.

AI-assisted-by: mimo-v2.5-pro

2026-08-19 11:08:23 +00:00

data

Merge remote-tracking branch 'origin/staging' into develop

2026-07-08 15:44:37 +02:00

scripts

⏪ Backport mcp package changes from develop

2026-06-08 09:59:33 +02:00

src

🐛 Gate MCP REPL server behind isDevEnv check

2026-08-19 11:08:23 +00:00

.gitignore

⏪ Backport MCP from staging (part 1)