Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
52 lines (36 loc) · 2.38 KB

CONTRIBUTING.md

File metadata and controls

52 lines (36 loc) · 2.38 KB
Raw

Contributing to MCP Shark Security Lab

Thanks for helping improve this reference lab.

Principles

  • Keep the repo safe by documentation: fake secrets must stay obviously fake, behavior must stay appropriate for isolated lab use, and the README must warn newcomers clearly.
  • When you add or change a detection pattern (tool text, harness server, YARA rule), update the README coverage tables or the section that describes that workflow so GitHub and scanners stay in sync.

Local setup

git clone https://github.com/mcp-shark/mcp-shark-security-lab.git
cd mcp-shark-security-lab
npm install
npm start

Use npm run without arguments (or read the README script table) for other entry points.

Pull requests

Open PRs against main with a short, factual description of behavior changes. Link MCPShark issues, OWASP references, or scanner discussions when they help reviewers.

CI

Pushes and PRs run .github/workflows/ci.yml: npm ci plus node --check on servers/*.js and scripts/*.js.

GitHub About

Description, website URL, and topic tags for the repo About sidebar are not stored in git. Keep it aligned with the product story when you ship big positioning changes.

Current settings (update these commands when you change them):

# Short description + companion website (shown under the repo title)
gh repo edit mcp-shark/mcp-shark-security-lab \
  --description "Reference MCP security lab: toxic tool metadata, multi-server mcp.json harness for static scan, localhost AAuth fixtures, YARA (OWASP Agentic ASI01–ASI10). Stress-test MCPShark and similar tools—not for production. Licensed under MIT." \
  --homepage "https://github.com/mcp-shark/mcp-shark"

# Topic tags (GitHub allows at most 20). Replace the whole list:
jq -n '{"names":[
  "mcp","mcp-shark","model-context-protocol","mcp-server","security","owasp",
  "yara","cursor","static-analysis","authorization","llm-security","agentic-ai",
  "aauth","nodejs","javascript","testing","threat-detection",
  "developer-tools","code-analysis","vulnerability-scanner"
]}' | gh api --method PUT "repos/mcp-shark/mcp-shark-security-lab/topics" \
  -H "Accept: application/vnd.github+json" \
  --input -

Optional (web UI only): Social preview image, default branch protection, and “Security” policy files are under Settings on GitHub.