Repository navigation
Conversation
ARCHITECTURE.md described bawbel-mcp as read-only, trifecta-minimal, with no egress tools, using the scanner as a library, and shipping a capability manifest. Its server.py shows outbound HTTP (scan_server_card fetches a caller-supplied URL; AVE tools call the AVE API), local reads, a file write (accept_finding), and the scanner as a CLI subprocess; the repository has no manifest. State what it does. Closes #77 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: chaksaray <chaksaray@gmail.com>
This was referenced Oct 20, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #77
What and why
The bawbel-mcp entry in ARCHITECTURE.md said "Deliberately read-only and trifecta-minimal: no private-data tools, no egress tools", "scanner as a library", and "ships its own capability manifest". From bawbel/bawbel-mcp origin/develop
bawbel_mcp/server.py:scan_server_cardfetches a URL the caller supplies (_fetch_url); AVE tools call the AVE APIaccept_findingwrites a suppression into a file throughbawbel accept_run_bawbelruns thebawbelCLI withsubprocess.rungit ls-tree)The entry now states those facts. It also points at bawbel/bawbel-mcp#21 for the AVE API with the published-corpus fallback, since PiranhaDB is offline. I added no recommendation; whether bawbel-mcp should ship a manifest, or narrow its tools, is a decision for you.
Governing spec
DESIGN.md section(s): none. ARCHITECTURE.md only.
Output contract
Verification
Checklist
git commit -s)🤖 Generated with Claude Code