{"slug": "put-code-review-graph-behind-a-read-only-mcp-boundary-before-connecting-your", "title": "Put code-review-graph Behind a Read-Only MCP Boundary Before Connecting Your Repository", "summary": "A developer warns that before connecting any code-intelligence MCP server like code-review-graph to an agent, the first integration should be read-only and proven with a canary. The developer recommends running the server as a separate OS user against a disposable checkout, denying network egress, and creating files that must and must not be visible to test the boundary. The acceptance rule is strict: the tool must index public canaries but not private ones, and must not modify files.", "body_md": "[ code-review-graph](https://github.com/tirth8205/code-review-graph) is trending because it promises a useful trade: build a persistent local map of a codebase so an AI reviewer reads relevant context instead of ingesting the whole repository. The repository is MIT-licensed and exposes MCP and CLI interfaces.\n\nThat can reduce context. It can also create a high-value index of your source tree.\n\nBefore connecting any code-intelligence MCP server to an agent, I would make the first integration read-only and prove the boundary with a canary.\n\nThe assets are not only source files. The graph may reveal:\n\nThe primary failure is authority creep: a context tool gains write, shell, or unrestricted filesystem access because the agent runtime grants every server the same permissions.\n\nRun the server as a separate OS user against a disposable checkout:\n\n```\nuseradd --system codegraph\ninstall -d -o codegraph -g codegraph /srv/codegraph/repo\nsudo -u codegraph git clone --depth=1 \"$REPO_URL\" /srv/codegraph/repo\nchmod -R a-w /srv/codegraph/repo\n```\n\nThen deny network egress and mount only the checkout plus a dedicated graph-data directory. Do not mount `$HOME`\n\n, SSH configuration, cloud credentials, or the Docker socket.\n\nCreate files that must and must not be visible:\n\n```\nsrc/public_canary.ts          SHOULD_INDEX\nsecrets/private_canary.txt    MUST_NOT_INDEX\n.git/config                   MUST_NOT_RETURN\n```\n\nAdd `secrets/`\n\nto the tool's exclusion configuration. Ask the MCP client three questions:\n\n`SHOULD_INDEX`\n\n.`MUST_NOT_INDEX`\n\n.The acceptance rule is strict: test 1 succeeds; tests 2 and 3 return no content. Also verify the server process cannot modify `src/public_canary.ts`\n\n.\n\nRecord tool name, requested path, decision, duration, and result size. Avoid logging full source fragments by default; otherwise the audit system becomes another copy of the repository.\n\n```\n{\"tool\":\"graph.query\",\"scope\":\"src/**\",\"decision\":\"allow\",\"bytes\":1842}\n```\n\nI have not audited the project's implementation or reproduced its published context-reduction examples. This is a deployment gate for any repository-indexing MCP server, not a vulnerability claim about `code-review-graph`\n\n.\n\nThe useful decision rule is simple: a context tool should prove that it can answer approved repository questions without acquiring mutation, credential, or unrelated-filesystem authority.", "url": "https://wpnews.pro/news/put-code-review-graph-behind-a-read-only-mcp-boundary-before-connecting-your", "canonical_source": "https://dev.to/jaryn_123/put-code-review-graph-behind-a-read-only-mcp-boundary-before-connecting-your-repository-1h2g", "published_at": "2026-07-22 04:25:57+00:00", "updated_at": "2026-07-22 04:33:56.627628+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools"], "entities": ["code-review-graph"], "alternates": {"html": "https://wpnews.pro/news/put-code-review-graph-behind-a-read-only-mcp-boundary-before-connecting-your", "markdown": "https://wpnews.pro/news/put-code-review-graph-behind-a-read-only-mcp-boundary-before-connecting-your.md", "text": "https://wpnews.pro/news/put-code-review-graph-behind-a-read-only-mcp-boundary-before-connecting-your.txt", "jsonld": "https://wpnews.pro/news/put-code-review-graph-behind-a-read-only-mcp-boundary-before-connecting-your.jsonld"}}