Repository navigation
docs(readme): drop env from Claude Desktop config so the listing sandbox can run it - #348
Merged
Merged
Conversation
…box can run it The aiagentslisting.com scanner stores README env values blanked (BOJ_URL: "") and has never sandboxed boj-server; the one stdio npx server it did sandbox (playwright-mcp) declares no env. BOJ_URL already defaults to http://localhost:7700, so the block was redundant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P56iYjCwHmbRyfFrpyJzTC
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (2)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (32)
|
| Layer / File(s) | Summary |
|---|---|
Update configuration examples README.md, README.adoc |
The examples remove the explicit BOJ_URL setting. The instructions describe its default value and when to set it under env. |
Priority: ⬇️ Low
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Merge Risk: ⚪ Minimal · up to e1aa8
The examples rely on the bridge’s existing localhost default and explain when to override it. No merge-blocking risk is evident.
Architecture Summary
Architecture risk: 🔵 Low · up to e1aa8
The change affects 2 systems.
Changed systems: README.adoc, README.md
Architecture concerns
No architecture-level concerns identified.
Review details
Systems and components
- observed — README.adoc (service) was modified; 1 changed file maps to changed impact.
- observed — README.md (service) was modified; 1 changed file maps to changed impact.
Before / after behavior
- observed — Modified behavior in README.adoc: The Claude Desktop configuration example removes the explicit
BOJ_URLenvironment setting and updates the instructions to say the variable defaults tohttp://localhost:7700and should be set underenvonly when the backend uses a different URL. - observed — Modified behavior in README.md: The Claude Desktop example removes its
envblock settingBOJ_URLtohttp://localhost:7700; theargsentry remains. - observed — Modified behavior in README.md: The restart instruction now states that
BOJ_URLdefaults tohttp://localhost:7700and should be set underenvonly when the backend listens elsewhere.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly identifies the README change: removing the Claude Desktop configuration's env block so the listing sandbox can run it. |
| Description check | ✅ Passed | The description covers the summary, changes, quality checklist and testing. It also explains the sandbox hypothesis and states how to verify it after merge. Screenshots are not applicable to this docu… |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit reads the setup page,
And finds the default URL in place.
No extra env is needed here,
Unless the backend moves elsewhere.
The example now makes that quite clear.
Comment @coderabbitai help to get the list of available commands.
🔍 Hypatia Security ScanFindings: 113 issues detected
View findings[
{
"reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sonarqube"
},
{
"reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/label-triage.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "triage"
},
{
"reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/labels.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sync"
},
{
"reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "deploy"
},
{
"reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high",
"fix_recipe": "add_secret_presence_gate"
},
{
"reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
"type": "codeql_missing_actions_language",
"file": ".github/workflows/codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"fix_recipe": "add_codeql_actions_language"
},
{
"line": 39,
"reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/labels.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 46,
"reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/push-email-notify.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 32,
"reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/build.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 44,
"reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/container-publish.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the
envblock from the Claude DesktopmcpServersexample in the README. The goal is to let aiagentslisting.com's sandbox run the npx package, so the listing's four remaining checks can be credited: Exposes tools (required), Verified live, Ships prompts and Ships resources. The score is currently 49/100, grade F, with 2 of 3 required checks passed.Why this is thought to be the blocker:
installConfig.mcpServers.boj-server.env = {"BOJ_URL": ""}. The scanner blanks env values, the way it would for a credential the user must supply.serverTools: []and noserverToolsCheckedAt, so the sandbox has never run against boj-server.discoverpages 1–4) that the sandbox did verify isplaywright-mcp, withserverToolsSource: "sandbox"and a score of 80. Its config declares noenv.This is a hypothesis. It's confirmed only once a rescan shows
serverToolsSource: "sandbox".BOJ_URLalready defaults tohttp://localhost:7700(mcp-bridge/lib/api-clients.js:14), so the example behaves exactly as before, and the README still says how to set the variable.Follows #341, which fixed Installation method and Easy install; both now score full marks.
Type of change
Documentation only.
📌 New pins
Head SHA:
e1aa8d3c998c72e5fb728859ff589bd291806696. This PR adds or changes no pins: no actionuses:,actions.lock, lockfile or container digest changes.Changes
README.adoc: dropped the"env": { "BOJ_URL": … }line from the Claude Desktop JSON fence, and added one sentence sayingBOJ_URLdefaults tohttp://localhost:7700and should be set underenvonly if the backend listens elsewhere.README.md: re-derived from README.adoc (ADR-004). The only differences are those two changes.RSR Quality Checklist
Required
unsafeblocks without// SAFETY:comments. N/A: no code changed..envfiles included. The removed line was a localhost default, not a secret.As Applicable
.machine_readable/*updated. N/A: project state didn't change, and A2ML is retired estate-wide (D308).TOPOLOGY.mdupdated. N/A: architecture didn't change.CHANGELOGupdated. N/A: README example only, no release.Testing
npx -y @hyperpolymath/boj-server@latest(0.4.7) twice, once withBOJ_URLunset and once withBOJ_URL="", sending initialize,tools/list,prompts/listandresources/list. Both runs completed a clean handshake and returned 65 tools, 6 prompts and 6 resources, with nothing but JSON-RPC on stdout.norm+diff -qfreshness step reports up to date.get_listing boj-servershould showserverToolsSource: "sandbox"andquality.requiredPassed: true.Deferred non-required reds that are also red on main@9180ee6b:
governance / UUID v7 conformance→ #338 (CLADE.a2ml v5 literal, added in a #338 comment) andSonarQube→ #338.🤖 Generated with Claude Code
https://claude.ai/code/session_01P56iYjCwHmbRyfFrpyJzTC