[PSC-711] feat: add install copilot command for MCP server#146
Open
[PSC-711] feat: add install copilot command for MCP server#146
Conversation
Extract shared plugin download/setup logic into PluginInstaller and add a new `install copilot` subcommand that registers the Armis AppSec MCP server in VS Code's user-level mcp.json for GitHub Copilot. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
| Severity | Count |
|---|---|
| 🟠 HIGH | 1 |
| 🟡 MEDIUM | 1 |
Total: 2
View all 2 findings
🟠 HIGH (1)
CWE-522_armis-cli_38295677_internal/install/plugin.go_347_2_347_150 - Insecure Design (CWE-522
Location: internal/install/plugin.go:347
Insufficiently Protected Credentials): The function reads two values from the process environment – the client ID and client secret – and then writes them directly into a file on disk. Because the file is stored in plain text, anyone who can read that file on the system (for example, another user or a process with file‑system access) could see the credentials. Even though the file is created with restrictive permissions (read/write for the owner only), the credentials are still not protected by encryption or other stronger safeguards. This means an attacker who gains access to the host could obtain the sensitive information, which is exactly what CWE‑522 warns about.
Code snippet is redacted as it contains secrets.
CWEs: CWE-522: Insufficiently Protected Credentials
🟡 MEDIUM (1)
CWE-253_armis-cli_38295677_internal/install/claude.go_24_2_24_28 - The code calls `os.UserHomeDir()` to find the user's home directory, but it completely ignores the error value that the function can return
Location: internal/install/claude.go:24
The code calls os.UserHomeDir() to find the user's home directory, but it completely ignores the error value that the function can return. If the function fails (for example, because the required environment variables are missing or malformed), the variable home will be an empty string. The next line builds a path with filepath.Join(home, ".claude"). When home is empty, this creates a relative path like ".claude" instead of a location inside the real home directory. An attacker who can influence the environment variables that os.UserHomeDir() relies on could cause this failure. The program would then write files in an unexpected place, potentially overwriting or exposing data that should stay inside the user's home directory. Because the error is ignored, the program has no way to detect the problem and stop or correct the path. Adding a proper check for the error and handling it (for example, returning an error or using a safe default) would prevent the unintended file operations.
CWEs: CWE-253: Incorrect Check of Function Return Value
Test Coverage Reporttotal: (statements) 77.7% Coverage by function |
Replace separate install claude/copilot commands with a unified `armis-cli install [editor...]` that downloads the plugin once and registers it across all detected editors. Supported editors: VS Code, Cursor, Windsurf, Zed, Cline, Amazon Q, Continue, Claude Code. JetBrains requires per-project .jb-mcp.json. Also auto-configures credentials from ARMIS_CLIENT_ID/ARMIS_CLIENT_SECRET environment variables into the shared .env file (0600 permissions). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…nfig paths Add Antigravity editor (~/.gemini/antigravity/mcp_config.json) with standard mcpServers format. Update Amazon Q path from Application Support to ~/.aws/amazonq/mcp.json to match current CLI. Migrate Continue from deprecated config.json to ~/.continue/mcpServers/ directory-based discovery, which works with both config.yaml and legacy config.json. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Run gofmt to fix const block alignment. Skip Unix file permission assertion on Windows where 0600 is not enforced. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use 0750 directory permissions in test to satisfy gosec G301. Add nosec directive for G703 false positive on envPath which is internally constructed from pluginDir + ".env". Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ClaudeInstallerinto a reusablePluginInstallerininternal/install/plugin.goarmis-cli install copilotsubcommand that installs the Armis AppSec MCP server for GitHub Copilot in VS Codemcp.jsonwith stdio transport, pointing to the plugin's venv Python andserver.pyTest plan
internal/installtests pass (23 tests)CopilotInstaller: constructor, env detection, version tracking, MCP server registration, preserving existing MCP configPluginInstaller: release fetch, download/extract, version tracking, GitHub URL validationfindPythonPATH lookup) — mitigated by symlink resolution, absolute path check, and hardcoded name allowlist; same pattern shipped in [PPSC-648] feat: add install feature #143armis-cli install copilotcreates~/.armis/plugins/armis-appsec-mcp/and registers in VS Codemcp.jsonarmis-cli install copilot --versionreports installed versionarmis-cli install claudestill works after refactor🤖 Generated with Claude Code