doobidoo/mcp-memory-service

critical Security checks security Injection conf 0.85 6 occurrences SQL Injection — string-concat or f-string into execute()

cursor.execute(f"... {user_input} ...") — SQL injection.

4 files, 6 locations

src/mcp_memory_service/storage/sqlite_vec.py:553, 638, 2202 (3 hits)

scripts/maintenance/fast_cleanup_duplicates_with_tracking.sh:102

scripts/migration/migrate_timestamps.py:112

src/mcp_memory_service/utils/db_utils.py:183

sql-string-concat · CWE-89 · A03:2021

high Security checks security auth conf 0.70 [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /clients/{client_id}.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /clients/{client_id}.

src/mcp_memory_service/web/oauth/registration.py:329

high Security checks security Injection conf 0.85 3 occurrences [SEC004] SQL Injection Risk: String interpolation in SQL execution. Allows SQL injection.

Use parameterized queries: cursor.execute('SELECT * FROM t WHERE id = %s', [id]). For dynamic table or column names, choose identifiers from a hard-coded allowlist and keep values in parameters.

3 files, 3 locations

src/mcp_memory_service/storage/cloudflare.py:1396

src/mcp_memory_service/storage/sqlite_vec.py:2607

src/mcp_memory_service/web/api/manage.py:120

high Security checks quality Error handling conf 0.85 14 occurrences Bare except: pass — silent failure

except: pass or except Exception: pass — silently swallows everything including KeyboardInterrupt and bugs.

12 files, 14 locations

examples/setup/setup_multi_client_complete.py:127, 129 (2 hits)

scripts/server/run_http_server.py:60, 81 (2 hits)

claude-hooks/install_hooks.py:40

scripts/installation/install_uv.py:54

scripts/maintenance/cleanup_corrupted_encoding.py:118

scripts/maintenance/delete_tombstoned_records.py:215

scripts/maintenance/find_duplicates.py:288

scripts/maintenance/restore_deleted_memories.py:198

bare-except-pass · CWE-755

high Security checks security Crypto conf 0.85 10 occurrences Crypto — TLS verification disabled

verify=False in requests, rejectUnauthorized:false in node, InsecureSkipVerify:true in Go.

8 files, 10 locations

claude-hooks/utilities/memory-client.js:174, 262 (2 hits)

scripts/maintenance/cleanup_memories.py:28, 123 (2 hits)

claude-hooks/core/memory-retrieval.js:64

claude-hooks/core/topic-change.js:87

claude-hooks/tests/integration-test.js:634

claude-hooks/utilities/dynamic-context-updater.js:324

examples/http-mcp-bridge.js:318

scripts/maintenance/improve_memory_ontology.py:35

disabled-tls-verify · CWE-295 · A02:2021

high Security checks security Crypto conf 0.85 3 occurrences Crypto — weak hash or cipher (MD5, SHA1, DES, RC4)

MD5/SHA1/DES/RC4 used for security context (not just checksums).

3 files, 3 locations

scripts/maintenance/fast_cleanup_duplicates_with_tracking.sh:50

scripts/maintenance/find_all_duplicates.py:31

scripts/maintenance/find_cloudflare_duplicates.py:37

weak-crypto · CWE-327 · A02:2021

high Security checks quality Error handling conf 0.85 26 occurrences except BaseException — catches SystemExit/KeyboardInterrupt

except BaseException: ... — prevents Ctrl+C and SystemExit from working.

12 files, 14 locations

claude-hooks/install_hooks.py:1593, 1730 (2 hits)

scripts/installation/install.py:745, 800 (2 hits)

install.py:89

scripts/maintenance/apply_quality_boost_retroactively.py:179

scripts/maintenance/auto_retag_memory.py:213

scripts/maintenance/auto_retag_memory_merge.py:253

scripts/maintenance/cleanup_memories.py:275

scripts/maintenance/delete_test_memories.py:152

overcatch-baseexception · CWE-705

high Security checks quality Quality conf 0.85 3 occurrences Imported but never used

AST detector: dead-imports

2 files, 3 locations

/tank0/claude-archive/community/doobidoo__mcp-memory-service/scripts/installation/install_linux_service.py:8, 19 (2 hits)

/tank0/claude-archive/community/doobidoo__mcp-memory-service/scripts/maintenance/selective_timestamp_recovery.py:13

dead-imports

high Security checks software Test quality conf 0.85 20 occurrences Phantom test coverage — test files without real assertions

Test function that runs code but contains no assert/expect/should — passes regardless of behaviour.

11 files, 20 locations

scripts/database/db_health_check.py:50, 62, 91, 145, 195, 209, 227 (7 hits)

scripts/validation/diagnose_backend_config.py:118, 149, 252 (3 hits)

scripts/development/debug_server_initialization.py:36, 122 (2 hits)

examples/setup/setup_multi_client_complete.py:31

scripts/installation/install.py:841

scripts/service/service_utils.py:159

scripts/testing/test-connection.py:17

scripts/utils/claude_commands_utils.py:419

phantom-test-coverage · CWE-1126

high Security checks software Supply chain conf 0.85 Supply chain — curl | bash anti-pattern

curl ... | sh / bash — runs unverified network code.

scripts/run/memory_wrapper_cleanup.sh:62 curl-pipe-bash · CWE-494 · A08:2021

high Security checks software Supply chain conf 0.85 Supply chain — curl | bash anti-pattern

curl ... | sh / bash — runs unverified network code.

scripts/setup-lightweight.sh:5 curl-pipe-bash · CWE-494 · A08:2021

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 28.4% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

Only 28.4% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /.well-known/oauth-authorization-server/mcp.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /.well-known/oauth-authorization-server/mcp.

src/mcp_memory_service/web/oauth/discovery.py:51

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /admin.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /admin.

src/mcp_memory_service/web/oauth/middleware.py:417

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /credentials.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /credentials.

src/mcp_memory_service/web/api/configuration.py:610

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /version/check.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /version/check.

src/mcp_memory_service/web/api/server.py:246

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /credentials.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /credentials.

src/mcp_memory_service/web/api/configuration.py:681

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /credentials/test.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /credentials/test.

src/mcp_memory_service/web/api/configuration.py:639

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /restart.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /restart.

src/mcp_memory_service/web/api/server.py:310

high Security checks security auth conf 0.66 [AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /update.

An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: POST /update.

src/mcp_memory_service/web/api/server.py:351

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /memories/{content_hash}.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /memories/{content_hash}.

src/mcp_memory_service/web/api/memories.py:320

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /.well-known/oauth-protected-resource.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /.well-known/oauth-protected-resource.

src/mcp_memory_service/web/oauth/discovery.py:32

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /backup/list.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /backup/list.

src/mcp_memory_service/web/api/backup.py:138

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /tags/stats.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /tags/stats.

src/mcp_memory_service/web/api/manage.py:332

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /backup/now.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /backup/now.

src/mcp_memory_service/web/api/backup.py:106

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /bulk-delete.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /bulk-delete.

src/mcp_memory_service/web/api/manage.py:88

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /cleanup-duplicates.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /cleanup-duplicates.

src/mcp_memory_service/web/api/manage.py:184

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /delete-untagged.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /delete-untagged.

src/mcp_memory_service/web/api/manage.py:250

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /token.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /token.

src/mcp_memory_service/web/oauth/authorization.py:827

high Security checks security auth conf 0.68 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /memories/{content_hash}.

A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: PUT /memories/{content_hash}.

src/mcp_memory_service/web/api/memories.py:353

medium Security checks security auth conf 0.72 [AUC012] FastAPI interactive docs may be exposed by framework defaults: FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.

FastAPI exposes /docs, /redoc, and /openapi.json by default. Public production APIs should explicitly disable those defaults, protect them behind admin authentication, or publish a reviewed OpenAPI spec with declared security requirements.

low Security checks quality Error handling conf 1.00 3 occurrences [ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level.

Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types.

3 files, 3 locations

claude-hooks/install_hooks.py:40

scripts/installation/install_uv.py:54

scripts/server/run_http_server.py:60

medium Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

claude-hooks/scripts/ensure-server.js:134

medium Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

opencode/memory-plugin.js:365

low Security checks security Injection conf 0.50 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.

Use subprocess with shell=False and a list of args. Never eval user input.

scripts/maintenance/cleanup_organize.py:34

medium Security checks security Crypto conf 1.00 3 occurrences [SEC014] SSL Verification Disabled: SSL certificate verification is disabled, allowing man-in-the-middle attacks.

Enable SSL verification. Use verify=True (default) for requests. Pin certificates if needed.

3 files, 3 locations

scripts/maintenance/cleanup_memories.py:28

scripts/maintenance/find_duplicates.py:35

scripts/server/check_http_server.py:41

medium Security checks cicd CI/CD security conf 0.68 6 occurrences Agent auto-approve or skip-permissions mode is easy to enable

Codex/agent auto-approve, YOLO, or skip-permissions modes can be useful in isolated automation, but they remove the human checkpoint before command execution, network access, and file edits.

6 files, 6 locations

claude-hooks/CONFIGURATION.md:631

claude-hooks/README-PERMISSION-REQUEST.md:9

claude-hooks/config.json:217

claude-hooks/config.template.json:93

claude-hooks/core/permission-request.js:5

docs/plans/2026-02-23-permission-hook-opt-in.md:165

CI/CD securityagent runtimepermissions

high Security checks quality Quality conf 0.72 6 occurrences Agent control bridge may listen on a network interface without visible auth

Agent, MCP, sidecar, and command bridge servers often start as local helpers. Binding them to 0.0.0.0 or a default all-interface listener without an authorization guard can expose tool execution or session data to the LAN.

6 files, 6 locations

archive/deployment/deploy_http_with_mcp.sh:26

docs/blog/remote-mcp-tutorial.html:218

scripts/server/run_http_server.py:12

src/mcp_memory_service/cli/lifecycle.py:272

src/mcp_memory_service/cli/main.py:11

src/mcp_memory_service/storage/http_client.py:11

medium Security checks quality Error handling conf 0.85 2 occurrences Bare except — overly broad

AST detector: bare-except-without-pass

lines 90, 137

/tank0/claude-archive/community/doobidoo__mcp-memory-service/scripts/maintenance/selective_timestamp_recovery.py:90, 137 (2 hits)

bare-except-without-pass

high Security checks security auth conf 0.82 Browser storage is used for session token material

localStorage and sessionStorage are readable by injected JavaScript. For sensitive sessions, this turns XSS into account compromise.

src/mcp_memory_service/web/static/app.js:93

high Security checks security Crypto conf 0.85 194 occurrences Crypto — plaintext HTTP for sensitive endpoint

Hardcoded http:// (not localhost) for endpoints that handle credentials or data.

12 files, 33 locations

tests/test_external_embeddings.py:29, 34, 44, 69, 103, 123, 140, 151, +2 more (10 hits)

src/mcp_memory_service/config.py:7, 835, 836, 882 (4 hits)

scripts/service/deploy_dual_services.sh:64, 65, 66 (3 hits)

src/mcp_memory_service/cli/main.py:7, 98, 99 (3 hits)

tests/test_quality_system.py:657, 719, 777 (3 hits)

src/mcp_memory_service/storage/http_client.py:7, 60 (2 hits)

src/mcp_memory_service/sync/litestream_config.py:7, 249 (2 hits)

src/mcp_memory_service/utils/port_detection.py:7, 68 (2 hits)

http-not-https · CWE-319 · A02:2021

high Security checks cicd CI/CD security conf 0.82 4 occurrences Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

4 files, 4 locations

tools/docker/Dockerfile:3

tools/docker/Dockerfile.glama:3

tools/docker/Dockerfile.quality-cpu:82

tools/docker/Dockerfile.slim:3

CI/CD securitycontainers

low Security checks quality Quality conf 0.60 12 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

11 files, 12 locations

scripts/maintenance/retag_valuable_memories.py:12, 50 (2 hits)

claude-hooks/utilities/dynamic-context-updater.js:210

scripts/installation/install_macos_service.py:294

scripts/installation/install_windows_service.py:11

scripts/maintenance/auto_retag_memory_merge.py:28

scripts/maintenance/cleanup_association_memories.py:30

scripts/maintenance/consolidate_memory_types.py:296

scripts/maintenance/find_cloudflare_duplicates.py:75

duplicationquality

high Security checks quality Quality conf 0.74 5 occurrences Frontend API reference is not matched by discovered backend routes

A frontend string references a same-origin API path that Repobility could not match to backend route inventory. This often causes live 404s in user journeys.

3 files, 5 locations

src/mcp_memory_service/web/static/index.html:1021, 1027, 1158 (3 hits)

claude-hooks/core/session-end-harvest.js:90

claude-hooks/core/session-end.js:218

high Security checks software Test quality conf 0.85 7 occurrences Function is stub-only (pass/raise NotImplementedError)

Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment.

lines 39, 40, 43, 44, 45, 46, 47

src/mcp_memory_service/consolidation/consolidator.py:39, 40, 43, 44, 45, 46, 47 (7 hits)

stub-only-function · CWE-1188

high Security checks quality Quality conf 0.85 23 occurrences Magic number used as default arg

Using hardcoded default values for complex configuration objects makes the code brittle and difficult to manage. Consider using a dedicated factory or builder pattern. Auto-promoted from proposal 444 on 2026-05-12. Synth confidence: 0.85. FP estimate: 0.00.

9 files, 23 locations

src/mcp_memory_service/config.py:631, 634, 970, 1002, 1006, 1040, 1048 (7 hits)

scripts/utils/ai-optimized-tool-descriptions.py:338, 344, 345 (3 hits)

src/mcp_memory_service/mcp_server.py:636, 642, 643 (3 hits)

claude-hooks/install_hooks.py:489, 491 (2 hits)

claude-hooks/utilities/memory-scorer.js:635, 636 (2 hits)

src/mcp_memory_service/server/utils/response_limiter.py:34, 41 (2 hits)

src/mcp_memory_service/storage/base.py:136, 297 (2 hits)

claude-hooks/core/session-start.js:1176

magic-number-default

high Security checks software Logging conf 0.85 28 occurrences PII printed to stdout/stderr

Logging password/token/email/ssn directly to stdout.

9 files, 28 locations

scripts/benchmarks/benchmark_code_execution_api.py:59, 60, 84, 85, 110, 111, 130, 131, +1 more (9 hits)

scripts/validation/diagnose_backend_config.py:219, 290, 291, 293, 294, 296, 331, 351 (8 hits)

scripts/installation/install_linux_service.py:229, 451 (2 hits)

scripts/installation/install_macos_service.py:170, 369 (2 hits)

scripts/installation/install_windows_service.py:253, 425 (2 hits)

scripts/installation/setup_cloudflare_resources.py:165, 203 (2 hits)

claude-hooks/core/session-start.js:442

scripts/migration/add_relationship_type_column_cloudflare.py:167

print-pii · CWE-532 · A09:2021

medium Security checks quality Quality conf 0.78 Public web service has no security.txt

security.txt gives researchers and customers a safe disclosure channel. Public web apps and APIs should publish it under /.well-known/security.txt.

.well-known/security.txt

medium Security checks quality Quality conf 0.85 Python mutable default argument

def f(x=[]) — Python gotcha; mutates across calls.

scripts/benchmarks/benchmark_filter_performance.py:151 mutable-default-arg · CWE-1023

medium Security checks quality Quality conf 0.85 Python mutable default argument

def f(x=[]) — Python gotcha; mutates across calls.

scripts/benchmarks/benchmark_memory_usage.py:97 mutable-default-arg · CWE-1023

high Security checks software dependencies conf 0.70 6 occurrences Remote install command pipes network code directly to a shell

Agent helper projects often publish one-line installers. `curl | sh` style commands are convenient, but they bypass review unless the script is pinned, signed, or checksum-verified.

6 files, 6 locations

.github/workflows/publish-and-test.yml:25

archive/docs-removed-2025-08-23/development/hybrid-slm-memory-consolidation.md:443

docs/tutorials/demo-session-walkthrough.md:49

scripts/run/README_CLEANUP_WRAPPER.md:198

scripts/run/memory_wrapper_cleanup.sh:62

scripts/setup-lightweight.sh:5

high Security checks software Supply chain conf 0.85 Supply chain — npm install without lockfile

Production image runs npm install (resolves new versions on every build) instead of npm ci.

scripts/pr/pre_pr_check.sh:80 npm-install-no-lockfile · CWE-1357 · A06:2021

medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced

A file created as a fixed/new/final/copy variant is not referenced by imports or path-like strings in the rest of the repository. This is a strong sign that an agent produced code beside the active application path.

scripts/verification/verify_knowledge_graph_v9.py:1

medium Security checks quality Quality conf 0.78 Suspicious implementation file appears unreferenced

A file created as a fixed/new/final/copy variant is not referenced by imports or path-like strings in the rest of the repository. This is a strong sign that an agent produced code beside the active application path.

scripts/maintenance/delete_orphaned_vectors_fixed.py:1

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

.dockerignore exists but does not cover common secret or VCS patterns.

.dockerignore CI/CD securitycontainers

low Security checks quality Quality conf 0.68 Archive or legacy directory is mixed into the active repository root

Archive, old, backup, or legacy directories at the root often hide obsolete implementations that AI agents can copy from or accidentally rewire.

archive:1

low Security checks quality Quality conf 0.85 Cluster of TODOs in one file

Code path with a TODO/FIXME/HACK comment that gates correctness — left for later but never resolved.

src/mcp_memory_service/web/api/manage.py:348 todo-bomb

low Security checks quality Quality conf 0.85 Cluster of TODOs in one file

Code path with a TODO/FIXME/HACK comment that gates correctness — left for later but never resolved.

src/mcp_memory_service/storage/cloudflare.py:266 todo-bomb

high Security checks cicd CI/CD security conf 0.56 Compose service does not declare a runtime user

If the image does not define USER internally, this service may run as root.

tools/docker/docker-compose.yml:7 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 Compose service lacks no-new-privileges hardening

no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.

tools/docker/docker-compose.yml:7 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.72 6 occurrences Dockerfile keeps pip download cache

Pip's package cache increases image size and can preserve unnecessary artifacts.

4 files, 6 locations

tools/docker/Dockerfile.glama:32, 44 (2 hits)

tools/docker/Dockerfile.quality-cpu:48, 139 (2 hits)

tools/docker/Dockerfile:59

tools/docker/Dockerfile.slim:56

CI/CD securitycontainers

high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact

Files named as final, fixed, copy, new, or backup are often temporary patch artifacts. They may be legitimate, but they deserve review before becoming production surface area.

scripts/verification/verify_knowledge_graph_v9.py:1

high Security checks quality Quality conf 0.62 Source file name looks like an AI patch artifact

Files named as final, fixed, copy, new, or backup are often temporary patch artifacts. They may be legitimate, but they deserve review before becoming production surface area.

scripts/maintenance/delete_orphaned_vectors_fixed.py:1

Complete repo analysis