Cairn
NousResearch/hermes-agent

MCP OSV malware check: response size and npm tag handling

Cluster 54828 · agent. Data as of

3 open items. Fix attempted, not merged.

The short answer

1open issue
2open PRs
3items grouped
Known?
Yes. 3 related items grouped here, 0 issues already closed.
Fix event
No fix has been merged to main. see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 2 PRs.

Members concern the MCP OSV malware preflight check: one issue reports response bodies being read without a size cap, and a related PR proposes bounding those reads. A third PR addresses a separate aspect, ignoring the latest tag for scoped npm packages, so the group spans two adjacent themes within the same component.

Open issues1

  • Issue#54828MCP OSV malware preflight reads response bodies without a cap

Open PRs2

  • PR#17716fix(osv_check): ignore latest tag for scoped npm packages
  • PR#54829fix(security): bound MCP OSV response reads
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
0
Attempts
0 PRs closed without merging

For your agent

The same facts, typed.

cluster/54828.json
cluster/54828.md