mcp-memory-service: Command for Claude Code

/triage — Security Alert Triage & Remediation

Scan, classify, and fix security alerts for mcp-memory-service.

Steps

1. Scan All Security Alerts

Run these in parallel to gather all alerts:

Dependabot alerts:

gh api repos/{owner}/{repo}/dependabot/alerts --jq '.[] | select(.state=="open") | {number, severity: .security_advisory.severity, package: .security_vulnerability.package.name, summary: .security_advisory.summary, cve: .security_advisory.cve_id}'

CodeQL alerts:

gh api repos/{owner}/{repo}/code-scanning/alerts --jq '.[] | select(.state=="open") | {number, severity: .rule.security_severity_level, rule: .rule.id, description: .rule.description, file: .most_recent_instance.location.path}'

Secret scanning alerts:

gh api repos/{owner}/{repo}/secret-scanning/alerts --jq '.[] | select(.state=="open") | {number, secret_type: .secret_type_display_name, created_at}'

2. Classify Each Alert

For each open alert, determine:

Factor	Assessment
Severity	critical / high / medium / low (from alert data)
Fix complexity	trivial (dep bump) / moderate (code change) / complex (architecture)
Exploitability	Is this reachable in our code? Check if the vulnerable code path is actually used
Priority	Severity × Exploitability → fix order

Present a summary table sorted by priority (critical first).

3. Create Fix Branches and Implement Fixes

For each alert to fix (starting with highest priority):

# Create fix branch
git checkout -b fix/security-<alert-type>-<number> main

# For Dependabot (dependency bumps):
# Update the dependency in pyproject.toml to the patched version
# Run: pip install -e . && pytest --tb=short -q

# For CodeQL (code fixes):
# Read the flagged file and line
# Implement the fix following the CodeQL recommendation
# Run: pytest --tb=short -q

# For secret scanning:
# Rotate the exposed credential immediately
# Remove from code history if needed
# Update .gitignore / .env.example as needed