Uh oh!
There was an error while loading. Please reload this page.
chore: enable aignostics/claude-plugins qms plugin project-wide [PYSDK-96]#582
Uh oh!
There was an error while loading. Please reload this page.
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,39 @@ | ||||||
| { | ||||||
| "permissions": { | ||||||
| "allow": [ | ||||||
| "mcp__claude_ai_Atlassian__getConfluencePage", | ||||||
| "mcp__claude_ai_Atlassian__getVisibleJiraProjects", | ||||||
| "mcp__claude_ai_Atlassian__getAccessibleAtlassianResources", | ||||||
| "mcp__claude_ai_Atlassian__getCompassComponent", | ||||||
| "mcp__claude_ai_Atlassian__getJiraIssue", | ||||||
| "mcp__claude_ai_Atlassian__searchJiraIssuesUsingJql", | ||||||
| "mcp__claude_ai_Atlassian__search", | ||||||
| "mcp__claude_ai_Atlassian__getConfluenceSpaces", | ||||||
| "mcp__claude_ai_Atlassian__getPagesInConfluenceSpace", | ||||||
| "mcp__claude-in-chrome__read_page", | ||||||
| "mcp__claude-in-chrome__get_page_text", | ||||||
| "mcp__claude-in-chrome__tabs_context_mcp", | ||||||
| "Bash(make lint)", | ||||||
| "Bash(make lint_fix)", | ||||||
| "Bash(make test_unit)", | ||||||
| "Bash(make test_integration)", | ||||||
| "Bash(make audit)", | ||||||
| "Bash(gh label list *)", | ||||||
| "Bash(gh search *)" | ||||||
| ] | ||||||
| }, | ||||||
| "enableAllProjectMcpServers": true, | ||||||
| "enabledMcpjsonServers": [], | ||||||
| "extraKnownMarketplaces": { | ||||||
| "aignostics-claude-plugins": { | ||||||
| "source": { | ||||||
| "source": "github", | ||||||
| "repo": "aignostics/claude-plugins" | ||||||
| }, | ||||||
| "autoUpdate": true | ||||||
There was a problem hiding this comment. "autoUpdate": true for the aignostics/claude-plugins marketplace means the repo will automatically pick up plugin changes on next startup without a PR in this repo. For QMS / change-control contexts this can undermine traceability and introduce unreviewed behavior; consider pinning to a specific version/commit or disabling autoUpdate and updating via controlled PRs.
Suggested change
ContributorAuthor There was a problem hiding this comment. Keeping | ||||||
| } | ||||||
| }, | ||||||
| "enabledPlugins": { | ||||||
| "qms@aignostics-claude-plugins": true | ||||||
| } | ||||||
| } | ||||||
Uh oh!
There was an error while loading. Please reload this page.
CopilotAIApr 24, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Setting "enableAllProjectMcpServers": true opts every Claude Code session into all MCP servers defined in the repo, including any added in future PRs. That expands the effective trust boundary and can unintentionally grant new capabilities without explicit review; prefer disabling this and explicitly enabling only the required servers for the QMS plugin workflow.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Keeping
true— intentional..mcp.jsonis the repo-level MCP manifest, and adding a server to it requires a PR that's visible in the diff. Auto-trusting servers already in that file doesn't expand the trust boundary beyond code review; it just removes the per-contributor approval prompt on first encounter. Flipping tofalsewould add friction without a security gain. Reasoning now in the PR description.