Release 0.8.7 - #168
Merged
Merged
Conversation
…ble-bjl) Adds a 7th MCP tool, `suppress_finding`, so agents/clients can triage a false positive directly through the MCP instead of hand-editing config. It persists an `ignore` rule (path glob, optional rule names, reason) into the project `.rafter.yml`, mirroring the loader's resolution precedence and creating a canonical dotfile at the git root when none exists. Merge is idempotent: re-suppressing the same path+rules scope updates the reason in place rather than appending a duplicate (order-insensitive). Suppressed findings still surface under `_suppressed` in scan output, so the decision stays reviewable and version-controlled. Also removes the documented-but-unimplemented inline `// rafter-ignore:` directive from finding-triage docs (product decision: not building it) and points to `.rafter.yml` + the new MCP tool + docs.rafter.so/suppression. Node + Python parity. CLI_SPEC updated (6→7 tools). New unit tests for the writer (create/append/update-in-place/dedup/empty-guard) plus MCP tool registration assertions in both suites. Security (rafter-code-review, CWE Top 25): write target derives only from policy-file resolution, never user input (no CWE-22); YAML read via safe_load / js-yaml safe schema (no CWE-502); output via dump on structured objects (no YAML injection); existing entries + top-level keys preserved. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…nding feat(mcp): add suppress_finding tool for triaging false positives (sable-bjl)
Bump Node + Python packages and both rafter-security-skill.md frontmatter versions to 0.8.7 (validate-release parity). Headline change since 0.8.6: the MCP `suppress_finding` tool (sable-bjl) for triaging false positives. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
chore(release): 0.8.7
…mote parity (sable-eltr) The backend (rafter-backend ra-a8j, responding to rafter-cli#166) now honors .rafter.yml ignore rules and adopted the CLI's exact matcher, so local and remote rafter run suppress identically. Pin that shared contract: - CLI_SPEC.md: specify glob semantics exactly (* within a path segment, ** crosses segments, bare = basename, relative globs auto-anchored) — replacing the vague, slightly-wrong "minimatch (Node)/fnmatch (Python)" wording (Python uses _glob_in_path, not raw fnmatch). Document `rules` as matching a finding's rule name OR rule id (case-insensitive), honored locally and remotely. - suppress_finding tool descriptions (Node + Python): `rules` accepts a rule name or rule id; honored by local scans and remote `rafter run`. - finding-triage.md (both copies): corrected the now-false "match rule name, not a hashed R-… id" line — it's name OR id now. - CHANGELOG [Unreleased] entry. Docs/description only; no behavior change (the CLI matcher was already the agreed standard — the backend aligned to it). Affected Node + Python suites green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…shape (ra-nrr) Backend (rafter-backend ra-a8j/ra-nrr) now emits a suppressed.json artifact in the CLI's exact _suppressed per-entry shape, so hidden findings are recoverable on remote rafter run too. Cross-reference it from the suppression section. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
docs(suppression): pin .rafter.yml ignore glob+rule contract; note remote parity (sable-eltr)
Raftersecurity
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promote
main→prodfor the 0.8.7 release.Headline (new since 0.8.6)
suppress_findingtool (sable-bjl, feat(mcp): add suppress_finding tool for triaging false positives (sable-bjl) #165) — triage/suppress false positives directly through the MCP; writes an idempotentignorerule into.rafter.yml. Node + Python parity, security-reviewed..rafter.yml+ the MCP tool; the unimplemented inline// rafter-ignore:directive was removed.Also catching
produp (it was at 0.8.1)This promotion carries the accumulated 0.8.2 → 0.8.7 work, including:
CONFIG.mdreference (0.8.6)autoscan mode runs both engines and unions findings; stale-betterleaks auto-update (0.8.5)hook pretoolhonors.rafter.yml(0.8.5).rafter.yml scan.exclude_pathshonored on both engines; backend.rafter/config.ymlcompat (0.8.4)See
CHANGELOG.mdfor the full per-version detail.Release checklist
[0.8.7]entrysuppress_findingfeature (feat(mcp): add suppress_finding tool for triaging false positives (sable-bjl) #165) merged to main and included🤖 Generated with Claude Code