Menu
Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when `make ci-local` fails locally or a GitHub Actions run reports a CI failure (format, lint, line-budget, typecheck, or test errors).
Use when reviewing a diff, PR, or change set for correctness and quality before merge or handoff. For a deep security-only pass, use security-review instead.
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Use when preparing to tag, publish, or deploy a genefoundry-router build.
Use when changing the router's authentication or authorization — JWT/OAuth modes, verifiers, resource/audience metadata, the secure-by-default bind guard, or the no-token-passthrough boundary.
Use when adding, removing, enabling/disabling, or reconfiguring a backend in the router's servers.yaml registry (URLs, namespaces, entrypoints, server_name/transform overrides).
| name | security-review |
| description | Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question. |
Follow AGENTS.md first. The router is the trust boundary: it owns edge auth and must never forward the caller's token to backends. Ground in docs/SECURITY-ASSESSMENT-2026-06-29.md, docs/RESPONSE-ENVELOPE-STANDARD-v1.1.md (§Error-message sanitation), and the FastMCP not-found reflection guard.
make_proxy_client() (in composition.py) with forward_incoming_headers=False; the caller's Authorization is never re-sent to a backend (fastmcp's ProxyClient default forwards it — regression-tested in tests/unit/test_no_token_passthrough.py).is_insecure_public_bind in cli.py, flag GF_ALLOW_INSECURE in config.py) refuses GF_AUTH_MODE=none on a non-loopback bind unless GF_ALLOW_INSECURE=true.JWTVerifier, RFC 9728 Protected Resource Metadata, WWW-Authenticate, OAuth proxy; audience = the …/mcp resource (RFC 8707), tolerant of a duplicated /mcp.GF_MAX_BODY_BYTES) and opt-in rate limit (GF_RATE_LIMIT_RPM); outbound GF_BACKEND_TIMEOUT.make fleet-probe / genefoundry-router drift as a rug-pull / tool-poisoning tripwire; re-pin the baseline only after reviewing the diff._unknown (safe_log_identity in observability.py), and the AggregateProvider provider-fault log is scrubbed (notfound_guard.py). See Response-Envelope v1.1 §Error-message sanitation and the FastMCP not-found reflection guard.make_proxy_client enforcement — a library default undid it once.auth=none on a public bind by overriding the guard.