Security

Supported versions

Security fixes are provided for the latest weavatrix 1.x MCP release, latest weavatrix-rust 2.x engine release, Weavatrix SEO 0.6.2, Refactor 1.0.11, and Online 0.3.2. Users on the legacy JavaScript Core should upgrade before reporting an issue that may already be resolved.

Default boundary

The native Core MCP has no HTTP or source-write implementation. Its protocol-independent weavatrix-rust engine owns analysis, not an MCP server or network transport. Repository reads are constrained by canonical-path and symlink/junction checks. Itsall, code, and seo profiles expose bounded views of the same read-only engine; disabled features are not advertised as unavailable stubs.

Separate search-evidence product

The MIT weavatrix-seo package is read-only. It never writes pages or source. Live HTTP happens only for origins you pass toaudit or an MCP tool; the MCP host defaults to--public-only. Off-crawl canonicals stay UNMEASURED rather than being treated as healthy. Report SEO issues onweavatrix-seo advisories.

Separate online product

The MIT weavatrix 1.x package contains no outbound HTTP implementation. Cloud and compatible self-hosted transport lives in the separately installed MIT weavatrix-onlineproduct. It performs endpoint capability negotiation and requires an exact preview confirmation before sync. The graph-sync contract excludes source bodies, snippets, absolute host paths, environment values, credentials and Git remotes; unknown payload fields are discarded.

Separate write product

Core has no application-source write path. It stores derived analysis caches outside the repository; explicit architecture approval may create .weavatrix/architecture.jsononly after preview and token confirmation. The separately installed MITweavatrix-refactor package can edit source only when its environment gate and single-use plan token authorize the exact reviewed plan. Profiles narrow the advertised tool catalog but do not grant write authority. It verifies hashes and expected text, journals crash-recoverable writes and keeps a drift-checked rollback bundle under the repository's.weavatrix/worktree control directory.

Full policy

Process isolation, optional test execution, payload limits and reporting details are documented in the repository'scomplete security policy. See also the privacy policy and license.