From 9d7c4c103d8b4f1c17668a42845b997dda6dde3e Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Mon, 19 Oct 2026 15:21:41 -0400
Subject: [PATCH] fix(detection): drop registry paths from search_code_patterns
 output

search_code_patterns returned raw source registry entries, including
`path` values such as source_codes/mcp_servers_1/..., so the reasoning
agent could read the benign/vulnerable/environment dataset split from
the directory name. list_mcp_servers and get_source_code already strip
these hints. Return the same name/category/description/capabilities
metadata as list_mcp_servers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../source_code_analyzer_server.py            | 14 +++++++-
 .../tests/test_source_code_analyzer_server.py | 32 +++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/Detection/context_providers/source_code_analyzer_server.py b/Detection/context_providers/source_code_analyzer_server.py
index 033b1cc8..21989875 100644
--- a/Detection/context_providers/source_code_analyzer_server.py
+++ b/Detection/context_providers/source_code_analyzer_server.py
@@ -546,10 +546,22 @@ def search_code_patterns(pattern_description: str, server_categories: List[str]
     else:
         filtered_servers = servers
 
+    # Provide clean metadata without cheating indicators: registry paths
+    # name the dataset directory (benign/vulnerable/environment split).
+    available_servers = [
+        {
+            "name": server.get("name"),
+            "category": server.get("category"),
+            "description": server.get("description"),
+            "capabilities": server.get("capabilities", []),
+        }
+        for server in filtered_servers
+    ]
+
     return {
         "search_pattern": pattern_description,
         "server_categories": server_categories or "all",
-        "available_servers": filtered_servers,
+        "available_servers": available_servers,
         "analysis_guidance": f"Search for the pattern '{pattern_description}' in the source code of the listed servers"
     }
 
diff --git a/Detection/tests/test_source_code_analyzer_server.py b/Detection/tests/test_source_code_analyzer_server.py
index a207ba0d..a5e56fde 100644
--- a/Detection/tests/test_source_code_analyzer_server.py
+++ b/Detection/tests/test_source_code_analyzer_server.py
@@ -393,3 +393,35 @@ def test_non_text_codec_preserves_entrypoint_and_other_dependencies(
     assert [item["path"] for item in row["source_files"]] == ["server.py", "good.py"]
     assert row["source_files"][1]["source_code"] == "VALUE = 2\n"
     assert row["source_bundle_complete"] is False
+
+
+def test_search_code_patterns_omits_registry_paths(monkeypatch):
+    """Registry paths name the dataset split (e.g. mcp_servers_1) and must not
+    reach the reasoning agent; list_mcp_servers already strips them."""
+    monkeypatch.setattr(
+        analyzer,
+        "source_registry",
+        {
+            "mcp_servers": [
+                {
+                    "name": "example",
+                    "path": "source_codes/mcp_servers_1/example/example.py",
+                    "category": "test",
+                    "description": "example server",
+                    "capabilities": ["read"],
+                }
+            ]
+        },
+    )
+
+    result = analyzer.search_code_patterns("network calls", ["test"])
+
+    assert result["available_servers"] == [
+        {
+            "name": "example",
+            "category": "test",
+            "description": "example server",
+            "capabilities": ["read"],
+        }
+    ]
+    assert "mcp_servers_1" not in repr(result)