菜单
Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when `make ci-local` fails locally or a GitHub Actions run reports a CI failure (format, lint, line-budget, typecheck, or test errors).
Use when reviewing a diff, PR, or change set for correctness and quality before merge or handoff. For a deep security-only pass, use security-review instead.
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Use when preparing to tag, publish, or deploy a genefoundry-router build.
Use when changing the router's authentication or authorization — JWT/OAuth modes, verifiers, resource/audience metadata, the secure-by-default bind guard, or the no-token-passthrough boundary.
Use when adding, removing, enabling/disabling, or reconfiguring a backend in the router's servers.yaml registry (URLs, namespaces, entrypoints, server_name/transform overrides).
| name | security-review |
| description | Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question. |
Follow AGENTS.md first. The router is the trust boundary: it owns edge auth and must never forward the caller's token to backends. Ground in docs/SECURITY-ASSESSMENT-2026-06-29.md, docs/RESPONSE-ENVELOPE-STANDARD-v1.1.md (§Error-message sanitation), and the FastMCP not-found reflection guard.
make_proxy_client() (in composition.py) with forward_incoming_headers=False; the caller's Authorization is never re-sent to a backend (fastmcp's ProxyClient default forwards it — regression-tested in tests/unit/test_no_token_passthrough.py).is_insecure_public_bind in cli.py, flag GF_ALLOW_INSECURE in config.py) refuses GF_AUTH_MODE=none on a non-loopback bind unless GF_ALLOW_INSECURE=true.JWTVerifier, RFC 9728 Protected Resource Metadata, WWW-Authenticate, OAuth proxy; audience = the …/mcp resource (RFC 8707), tolerant of a duplicated /mcp.GF_MAX_BODY_BYTES) and opt-in rate limit (GF_RATE_LIMIT_RPM); outbound GF_BACKEND_TIMEOUT.make fleet-probe / genefoundry-router drift as a rug-pull / tool-poisoning tripwire; re-pin the baseline only after reviewing the diff._unknown (safe_log_identity in observability.py), and the AggregateProvider provider-fault log is scrubbed (notfound_guard.py). See Response-Envelope v1.1 §Error-message sanitation and the FastMCP not-found reflection guard.make_proxy_client enforcement — a library default undid it once.auth=none on a public bind by overriding the guard.