Skip to content

feat: add CHORUS_TOOL_MODE for readonly/all tool filtering AND fix: resolve 20 high severity vulnerabilities and relax node engine#2

Merged
Ompragash merged 2 commits intomainfrom
chorus-mcp-init
Feb 20, 2026
Merged

feat: add CHORUS_TOOL_MODE for readonly/all tool filtering AND fix: resolve 20 high severity vulnerabilities and relax node engine#2
Ompragash merged 2 commits intomainfrom
chorus-mcp-init

Conversation

@Ompragash
Copy link
Contributor

No description provided.

Split write tools (create_moment, delete_moment, upload_recording,
delete_recording) into separate registration functions. The server
reads CHORUS_TOOL_MODE env var at startup:

- "readonly" (default): registers 35 read-only tools only
- "all": registers all 39 tools including writes

Integration tests now verify both modes: readonly excludes write
tools, all mode includes them.
Override minimatch (>=10.2.1) and glob (>=11.0.0) in Jest's dependency
tree to patch the ReDoS vulnerability (GHSA-3ppc-4f35-3m26). These are
devDependencies only and do not affect the published package.

Relax the engines.node field from pinned LTS caret ranges to >=18 so
the server runs on any supported Node version including odd releases.
@Ompragash Ompragash merged commit 104c229 into main Feb 20, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant