16 Commits

Author SHA1 Message Date
70c4a4a39a test: comprehensive test suite for mcilspy MCP server
Add complete test coverage for the mcilspy package:

- T7: Create TestAssembly.dll fixture with known types/members
- T1: Integration tests using real assembly (metadata reader + ILSpy wrapper)
- T2: MCP tool tests with mocked wrapper for each @mcp.tool()
- T3: Error path tests for regex, file not found, invalid assemblies
- T4: Concurrency tests with asyncio.gather() for parallel operations
- T5: Docstring coverage tests using AST introspection
- T6: Timeout behavior tests for 5-minute subprocess timeout

Test summary:
- 147 tests passing
- 14 skipped (ilspycmd-dependent integration tests)
- 73% code coverage
- All ruff linting checks pass
2026-02-08 11:40:57 -07:00
3d7a561f20 Merge fix/performance: string heap search, pagination, PE validation 2026-02-08 11:40:49 -07:00
8f119b72c2 chore: mark performance domain as ready 2026-02-08 11:40:42 -07:00
20d0cd2e3a perf: major performance improvements and code quality fixes
- P1: search_strings now uses dnfile's #US heap directly instead of
  decompiling entire assembly, providing 10-100x speedup
- P2: add pagination (max_results/offset) to all list/search tools
- P5: add proper logging for platform detection failures
- P6: replace generic exception catches with specific exceptions
- P7: fix MetadataReader.__exit__ return type
- P8: add PE signature (MZ header) validation before invoking ilspycmd

All 35 tests pass, ruff check clean.
2026-02-08 11:40:25 -07:00
4bd9ce19af refactor: consolidate utils, constants, models (A1-A8) 2026-02-08 11:34:07 -07:00
3b6afd0646 security: path validation, temp cleanup, output limits (S1-S4) 2026-02-08 11:31:00 -07:00
fa71150ed5 docs: add taskmaster coordination files 2026-02-08 11:30:49 -07:00
16854b77ee security: implement path validation, temp dir safety, and size limits (S1-S4)
S1 - Path Traversal Prevention:
- Add _validate_assembly_path() helper in server.py
- Validates: non-empty path, file exists, is regular file, .dll/.exe extension
- Resolves to absolute path to prevent path traversal attacks
- Applied to all 12 tools that accept assembly_path

S2 - Temp Directory Race Condition Fix:
- Replace tempfile.mkdtemp() with TemporaryDirectory context manager
- Guarantees cleanup even on exceptions
- Refactor decompile() to use _decompile_to_dir() helper

S3 - Subprocess Output Size Limits:
- Add MAX_OUTPUT_BYTES constant (50MB)
- Truncate stdout/stderr if exceeded to prevent memory exhaustion
- Add truncation warning to output when limit is hit

S4 - Assembly File Size Limits:
- Add MAX_ASSEMBLY_SIZE_MB constant (500MB) in metadata_reader.py
- Check file size before loading with dnfile
- Add AssemblySizeError exception for clear error messages

Tests:
- Add tests/test_security.py with 18 unit tests covering all validations
- All 53 tests pass (security tests + existing tests)
2026-02-08 11:28:39 -07:00
8901752ae3 refactor: consolidate architecture across 8 issues (A1-A8)
- A1: Extract duplicated PATH discovery to utils.py (single source of truth)
- A2: Convert metadata_reader dataclasses to Pydantic models in models.py
- A3: Simplify get_wrapper() with module-level caching (removed fragile lifespan context)
- A4: Document ILSpyWrapper design rationale (why class exists despite being stateless)
- A5: Document MetadataReader as CPU-bound sync code with thread pool suggestion
- A6: Create constants.py for all timeouts/limits (DECOMPILE_TIMEOUT_SECONDS, etc.)
- A7: Add _compile_search_pattern() helper to deduplicate regex compilation
- A8: Add LanguageVersion validation with helpful error listing valid options

Tests pass, ruff clean.
2026-02-08 11:25:43 -07:00
7d784af17c refactor: address major code review findings
- Use importlib.metadata for dynamic version (single source in pyproject.toml)
- Clean up duplicate `import re` statements across modules
- Add missing type hints to all public methods
- Fix PATH auto-discovery for ilspycmd (~/.dotnet/tools)
- Add pytest test suite with 35 tests covering models, metadata reader, wrapper
- Bump version to 0.2.0, add CHANGELOG.md
2026-02-07 02:05:57 -07:00
157d671d28 refactor: address major code review findings
- Replace global mutable state with FastMCP lifespan pattern
  - Add AppState dataclass for dependency management
  - Use lifespan context for ILSpyWrapper caching
  - get_wrapper() now accepts optional Context parameter

- Improve type parsing robustness in ilspy_wrapper
  - Compile regex pattern for better performance
  - Add _split_type_name() to handle nested types (Outer+Nested)
  - Add logging for unparsed lines (helps debug edge cases)

- Standardize error handling across all tools
  - Add _format_error() helper for consistent formatting
  - All tools now return "**Error**: message" format
2026-02-05 12:33:19 -07:00
f52790cec0 security: fix shell injection and add subprocess timeout
- Replace create_subprocess_shell with create_subprocess_exec
  in _try_install_dotnet_sdk() to prevent shell injection
- Add install_commands list to _detect_platform() returning
  safe argument lists for each platform
- Add 5-minute timeout to ilspy_wrapper._run_command() to
  prevent hanging on malicious/corrupted assemblies
2026-02-05 10:39:52 -07:00
80a0a15cfc docs: revamp README with compelling structure and modern formatting
- Add badges (PyPI, Python version, License, MCP)
- Hero section with clear value proposition
- Quick Start in 30 seconds at the top
- "What Can You Do?" section with real-world use cases
- Features at a Glance table showing tool/dependency matrix
- Collapsible <details> sections for tool reference (cleaner UX)
- Table of contents for navigation
- Streamlined troubleshooting section
- Centered footer tagline for security researchers
2026-02-05 09:15:13 -07:00
4354408588 feat: add dnfile-based metadata tools and platform-aware installation
Major update with new capabilities:

- Rename package from ilspy_mcp_server to mcilspy
- Add 6 new dnfile-based tools that work without ilspycmd:
  - search_methods, search_fields, search_properties
  - list_events, list_resources, get_metadata_summary
- Add installation/diagnostic tools:
  - check_ilspy_installation: verify toolchain status
  - install_ilspy: platform-aware installer with auto-detection
    for pacman, apt, dnf, zypper, homebrew, winget, chocolatey
- Fix metadata_reader bugs:
  - Use _get_row_index helper consistently for dnfile compatibility
  - Handle HeapItemBinary conversion for public key tokens
- Update documentation with all 14 tools
2026-02-05 08:55:26 -07:00
Borealin
57472070e2 version: 0.1.1 use fastmcp 2025-08-04 11:09:26 +08:00
Borealin
b6a09eabfe init: init version 2025-08-03 23:31:39 +08:00