Skip to content

Commit 55ee145

Browse files
data-douserdata-douser
committed
Init advanced-security/codeql-development-mcp-server repo
0 parents  commit 55ee145

File tree

660 files changed

+70579
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

660 files changed

+70579
-0
lines changed

‎.codeql-version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
v2.23.9

‎.devcontainer/devcontainer.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"image": "mcr.microsoft.com/devcontainers/typescript-node:22",
3+
"customizations": {
4+
"vscode": {
5+
"extensions": [
6+
"github.vscode-github-actions",
7+
"github.vscode-codeql",
8+
"ms-vscode.cpptools"
9+
],
10+
"settings": {
11+
"codeQL.runningQueries.memory": 2048,
12+
"terminal.integrated.defaultProfile.linux": "bash"
13+
}
14+
}
15+
},
16+
"postCreateCommand": "npm install"
17+
}

‎.github/ISSUE_TEMPLATE/codeql-workshop-request.yml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
name: CodeQL Workshop Request
2+
description: Request creation of a custom CodeQL query development workshop from a production query
3+
title: '[Workshop] Create workshop for: '
4+
labels: ['workshop', 'learning']
5+
assignees:
6+
- ''
7+
8+
body:
9+
- type: markdown
10+
attributes:
11+
value: |
12+
## CodeQL Workshop Request
13+
14+
Request a custom CodeQL query development workshop to be created from an existing production-grade query.
15+
The workshop will teach developers how to build the query incrementally using test-driven development.
16+
17+
- type: input
18+
id: workshop-name
19+
attributes:
20+
label: Workshop Name
21+
description: Short name for the workshop (e.g., "dataflow-analysis-cpp", "find-sql-injection-java")
22+
placeholder: 'dataflow-analysis-cpp'
23+
validations:
24+
required: true
25+
26+
- type: textarea
27+
id: source-query
28+
attributes:
29+
label: Source Query
30+
description: |
31+
Provide either:
32+
- The full content of the production-ready CodeQL query (.ql file)
33+
- A public URL to the query file (e.g., GitHub raw URL)
34+
35+
This should be a complete, tested query that you want to teach developers how to build.
36+
placeholder: |
37+
/**
38+
* @name Find unsafe pointer dereference
39+
* @description Detects pointer dereferences that may be null
40+
* @kind problem
41+
* @id cpp/null-pointer-dereference
42+
*/
43+
44+
import cpp
45+
46+
from PointerDereferenceExpr deref
47+
where ...
48+
select deref, "Potential null pointer dereference"
49+
validations:
50+
required: true
51+
52+
- type: textarea
53+
id: source-query-tests
54+
attributes:
55+
label: Source Query Unit Tests
56+
description: |
57+
Provide either:
58+
- The full content of test files (.qlref, .expected, test source code)
59+
- A public URL to the test directory
60+
- A description of test cases if tests don't exist yet
61+
62+
Tests are essential for validating the workshop exercises and solutions.
63+
placeholder: |
64+
test.cpp:
65+
```cpp
66+
void unsafe() {
67+
int* ptr = nullptr;
68+
*ptr = 42; // Should detect
69+
}
70+
```
71+
72+
test.expected:
73+
```
74+
| file | line | col | endLine | endCol | message |
75+
| test.cpp | 3 | 3 | 3 | 6 | Potential null pointer dereference |
76+
```
77+
validations:
78+
required: true
79+
80+
- type: dropdown
81+
id: target-language
82+
attributes:
83+
label: Target Language
84+
description: What programming language does this query analyze?
85+
options:
86+
- C/C++
87+
- C#
88+
- Go
89+
- Java
90+
- JavaScript/TypeScript
91+
- Python
92+
- Ruby
93+
validations:
94+
required: true
95+
96+
- type: dropdown
97+
id: complexity
98+
attributes:
99+
label: Query Complexity
100+
description: How complex is the source query?
101+
options:
102+
- Simple (syntactic analysis only)
103+
- Moderate (includes control/data flow)
104+
- Complex (advanced dataflow, multiple stages)
105+
validations:
106+
required: true
107+
108+
- type: textarea
109+
id: learning-goals
110+
attributes:
111+
label: Learning Goals
112+
description: What should developers learn from this workshop?
113+
placeholder: |
114+
- How to identify pointer dereferences using AST analysis
115+
- How to track null values through control flow
116+
- How to use data flow to connect null assignments to dereferences
117+
- How to eliminate false positives with proper guards
118+
validations:
119+
required: true
120+
121+
- type: input
122+
id: expected-stages
123+
attributes:
124+
label: Expected Number of Stages
125+
description: How many incremental stages should the workshop have? (4-8 recommended)
126+
placeholder: '5'
127+
validations:
128+
required: false
129+
130+
- type: textarea
131+
id: target-audience
132+
attributes:
133+
label: Target Audience
134+
description: Who is this workshop for? What's their current CodeQL experience level?
135+
placeholder: 'Software engineers with basic C++ knowledge but new to CodeQL. Need to learn dataflow analysis.'
136+
validations:
137+
required: false
138+
139+
- type: textarea
140+
id: additional-context
141+
attributes:
142+
label: Additional Context
143+
description: Any other information that would help create an effective workshop?
144+
placeholder: 'This query is based on a real vulnerability we found in production. We want the workshop to focus on practical detection techniques.'
145+
validations:
146+
required: false

‎.github/ISSUE_TEMPLATE/mcp-integration-testing-improvement.yml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
name: Integration Testing Improvement for MCP Server Primitives
2+
3+
description: Request improvements to integration testing for MCP server primitives (tools/resources)
4+
5+
title: '[Integration Testing]: '
6+
labels: ['enhancement', 'mcp-server', 'testing']
7+
assignees: []
8+
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
> **🧪 Created from issue template:** `.github/ISSUE_TEMPLATE/mcp-integration-testing-improvement.yml`
14+
15+
This template helps you request improvements to integration testing for MCP server primitives (especially tool primitives).
16+
17+
Please provide examples of file contents expected (1) before and (2) after calling a given MCP server primitive, and any links or references to relevant files or test cases.
18+
19+
Once this issue is accepted and assigned, open a pull request using the PR template: `mcp-integration-testing-improvement`.
20+
21+
✅ Scope Limitation: The corresponding PR MUST only modify files under `client/integration-tests/**` (plus this issue template or the PR template only if absolutely required). Changes outside that path will be asked to split into another PR.
22+
23+
- type: input
24+
id: primitive-name
25+
attributes:
26+
label: Primitive Name
27+
description: Name of the MCP server primitive (tool/resource) needing improved integration testing
28+
placeholder: 'e.g., validate_codeql_query, update_resource_file'
29+
validations:
30+
required: true
31+
32+
- type: dropdown
33+
id: primitive-type
34+
attributes:
35+
label: Primitive Type
36+
description: What type of primitive is this?
37+
options:
38+
- Tool (Interactive function)
39+
- Resource (Static content)
40+
- Prompt (Dynamic prompt content)
41+
- Combination (Multiple types together)
42+
default: 0
43+
validations:
44+
required: true
45+
46+
- type: textarea
47+
id: integration-test-gaps
48+
attributes:
49+
label: Integration Test Gaps
50+
description: Describe the current gaps or limitations in integration testing for this primitive
51+
placeholder: 'Current integration tests do not cover X, or fail to check Y...'
52+
validations:
53+
required: true
54+
55+
- type: textarea
56+
id: improvement-suggestion
57+
attributes:
58+
label: Improvement Suggestion
59+
description: Describe the desired improvement to integration testing
60+
placeholder: 'Integration tests should be updated to cover Z, or include checks for W...'
61+
validations:
62+
required: true
63+
64+
- type: textarea
65+
id: before-content
66+
attributes:
67+
label: Example File Content(s) Before (One or Many Files)
68+
description: Provide one or more file states BEFORE invoking the primitive. You can supply links and/or inline snippets. For multiple files, list each as a fenced block preceded by a header line.
69+
placeholder: |
70+
You may list multiple files. Suggested structure:
71+
72+
file: path/to/fileA.ext (optional link)
73+
```lang
74+
<contents before>
75+
```
76+
77+
file: path/to/fileB.ext
78+
```
79+
<contents before>
80+
```
81+
82+
Or just provide links:
83+
- https://github.com/org/repo/blob/sha/path/to/fileA.ext
84+
- https://github.com/org/repo/blob/sha/path/to/fileB.ext
85+
validations:
86+
required: false
87+
88+
- type: textarea
89+
id: after-content
90+
attributes:
91+
label: Example File Content(s) After (Match Each Before)
92+
description: Provide corresponding AFTER states. Keep ordering aligned with the before list for clarity.
93+
placeholder: |
94+
Match each BEFORE entry:
95+
96+
file: path/to/fileA.ext (after)
97+
```lang
98+
<contents after>
99+
```
100+
101+
file: path/to/fileB.ext (after)
102+
```
103+
<contents after>
104+
```
105+
106+
If unchanged, note: (no change)
107+
validations:
108+
required: false
109+
110+
- type: textarea
111+
id: test-scenarios
112+
attributes:
113+
label: Test Scenarios
114+
description: Specific scenarios that should be tested to validate the integration improvement
115+
placeholder: |
116+
List scenarios or cases that should be covered by improved integration tests.
117+
validations:
118+
required: false
119+
120+
- type: textarea
121+
id: references
122+
attributes:
123+
label: References
124+
description: Links to related issues, documentation, or examples
125+
placeholder: 'e.g., GitHub issue #123, MCP docs, CodeQL examples'
126+
validations:
127+
required: false
128+
129+
- type: dropdown
130+
id: priority-level
131+
attributes:
132+
label: Priority Level
133+
description: How urgent is this improvement?
134+
options:
135+
- Critical (Blocking key functionality)
136+
- High (Major workflow improvement)
137+
- Medium (Important but not urgent)
138+
- Low (Minor enhancement)
139+
default: 2
140+
validations:
141+
required: true
142+
143+
- type: checkboxes
144+
id: terms
145+
attributes:
146+
label: Code of Conduct
147+
description: By submitting this issue, you agree to follow our Code of Conduct
148+
options:
149+
- label: I agree to follow this project's Code of Conduct
150+
151+
- type: checkboxes
152+
id: integration-tests-requirements
153+
attributes:
154+
label: Integration Test Requirements Acknowledgement
155+
description: Confirm you have reviewed and will follow the integration test requirements (structure, before/after, determinism, no binaries).
156+
options:
157+
- label: I reviewed client/integration-tests/README.md
158+
- label: I will follow directory structure under client/integration-tests/primitives/tools/
159+
- label: Each test will have clear before/after matching files
160+
- label: No binary or non-diffable files will be added
161+
- label: Tests will be deterministic and focused on a single primitive
162+
- label: I will run npm run lint:fix and npm run build-and-test before requesting review

0 commit comments

Comments
 (0)