27add4d05d
## 🚀 Major Improvements ### Docker Environment Simplification - **BREAKING**: Simplified Docker configuration by auto-detecting sandbox from WORKSPACE_ROOT - Removed redundant MCP_PROJECT_ROOT requirement for Docker setups - Updated all Docker config examples and setup scripts - Added security validation for dangerous WORKSPACE_ROOT paths ### Security Enhancements - **CRITICAL**: Fixed insecure PROJECT_ROOT fallback to use current directory instead of home - Enhanced path validation with proper Docker environment detection - Removed information disclosure in error messages - Strengthened symlink and path traversal protection ### File Handling Optimization - **PERFORMANCE**: Optimized read_files() to return content only (removed summary) - Unified file reading across all tools using standardized file_utils routines - Fixed review_changes tool to use consistent file loading patterns - Improved token management and reduced unnecessary processing ### Tool Improvements - **UX**: Enhanced ReviewCodeTool to require user context for targeted reviews - Removed deprecated _get_secure_container_path function and _sanitize_filename - Standardized file access patterns across analyze, review_changes, and other tools - Added contextual prompting to align reviews with user expectations ### Code Quality & Testing - Updated all tests for new function signatures and requirements - Added comprehensive Docker path integration tests - Achieved 100% test coverage (95 tests passing) - Full compliance with ruff, black, and isort linting standards ### Configuration & Deployment - Added pyproject.toml for modern Python packaging - Streamlined Docker setup removing redundant environment variables - Updated setup scripts across all platforms (Windows, macOS, Linux) - Improved error handling and validation throughout ## 🔧 Technical Changes - **Removed**: `_get_secure_container_path()`, `_sanitize_filename()`, unused SANDBOX_MODE - **Enhanced**: Path translation, security validation, token management - **Standardized**: File reading patterns, error handling, Docker detection - **Updated**: All tool prompts for better context alignment ## 🛡️ Security Notes This release significantly improves the security posture by: - Eliminating broad filesystem access defaults - Adding validation for Docker environment variables - Removing information disclosure in error paths - Strengthening path traversal and symlink protections 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
86 lines
2.8 KiB
PowerShell
86 lines
2.8 KiB
PowerShell
# PowerShell script to set up .env file for Docker usage on Windows
|
|
|
|
Write-Host "Setting up .env file for Gemini MCP Server Docker..."
|
|
|
|
# Get the current working directory (absolute path)
|
|
$CurrentDir = Get-Location
|
|
|
|
# Check if .env already exists
|
|
if (Test-Path .env) {
|
|
Write-Host "Warning: .env file already exists! Skipping creation." -ForegroundColor Yellow
|
|
Write-Host ""
|
|
} else {
|
|
# Check if GEMINI_API_KEY is already set in environment
|
|
if ($env:GEMINI_API_KEY) {
|
|
$ApiKeyValue = $env:GEMINI_API_KEY
|
|
Write-Host "Found existing GEMINI_API_KEY in environment" -ForegroundColor Green
|
|
} else {
|
|
$ApiKeyValue = "your-gemini-api-key-here"
|
|
}
|
|
|
|
# Create the .env file
|
|
@"
|
|
# Gemini MCP Server Docker Environment Configuration
|
|
# Generated on $(Get-Date)
|
|
|
|
# Your Gemini API key (get one from https://makersuite.google.com/app/apikey)
|
|
# IMPORTANT: Replace this with your actual API key
|
|
GEMINI_API_KEY=$ApiKeyValue
|
|
"@ | Out-File -FilePath .env -Encoding utf8
|
|
|
|
Write-Host "Created .env file" -ForegroundColor Green
|
|
Write-Host ""
|
|
}
|
|
|
|
Write-Host "Next steps:"
|
|
if ($ApiKeyValue -eq "your-gemini-api-key-here") {
|
|
Write-Host "1. Edit .env and replace 'your-gemini-api-key-here' with your actual Gemini API key"
|
|
Write-Host "2. Run 'docker build -t gemini-mcp-server .' to build the Docker image"
|
|
Write-Host "3. Copy this configuration to your Claude Desktop config:"
|
|
} else {
|
|
Write-Host "1. Run 'docker build -t gemini-mcp-server .' to build the Docker image"
|
|
Write-Host "2. Copy this configuration to your Claude Desktop config:"
|
|
}
|
|
Write-Host ""
|
|
Write-Host "===== COPY BELOW THIS LINE =====" -ForegroundColor Cyan
|
|
Write-Host @"
|
|
{
|
|
"mcpServers": {
|
|
"gemini": {
|
|
"command": "$CurrentDir\gemini-mcp-docker.ps1"
|
|
}
|
|
}
|
|
}
|
|
"@
|
|
Write-Host "===== COPY ABOVE THIS LINE =====" -ForegroundColor Cyan
|
|
Write-Host ""
|
|
Write-Host "Alternative: If you prefer the direct Docker command:"
|
|
Write-Host @"
|
|
{
|
|
"mcpServers": {
|
|
"gemini": {
|
|
"command": "docker",
|
|
"args": [
|
|
"run",
|
|
"--rm",
|
|
"-i",
|
|
"--env-file", "$CurrentDir\.env",
|
|
"-e", "WORKSPACE_ROOT=$env:USERPROFILE",
|
|
"-v", "${env:USERPROFILE}:/workspace:ro",
|
|
"gemini-mcp-server:latest"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
"@
|
|
Write-Host ""
|
|
Write-Host "Config file location:"
|
|
Write-Host " Windows: %APPDATA%\Claude\claude_desktop_config.json"
|
|
Write-Host ""
|
|
Write-Host "Note: This configuration mounts your user directory ($env:USERPROFILE)."
|
|
Write-Host "Docker can access any file within your user directory."
|
|
Write-Host ""
|
|
Write-Host "If you want to restrict access to a specific directory:"
|
|
Write-Host "Change both the mount (-v) and WORKSPACE_ROOT to match:"
|
|
Write-Host "Example: -v `"$CurrentDir:/workspace:ro`" and WORKSPACE_ROOT=$CurrentDir"
|
|
Write-Host "The container will automatically use /workspace as the sandbox boundary." |