Suspected vulnerability? Please do not open a public issue. Use GitHub's private vulnerability reporting.
Security fixes are provided for the latest weavatrix 1.x MCP
release, latest weavatrix-rust 2.x engine release, Weavatrix SEO
0.6.2, Refactor 1.0.11, and Online 0.3.2. Users on the legacy JavaScript Core
should upgrade before reporting an issue that may already be resolved.
The native Core MCP has no HTTP or source-write implementation. Its
protocol-independent weavatrix-rust engine owns analysis, not an
MCP server or network transport. Repository reads
are constrained by canonical-path and symlink/junction checks. Its
all, code, and seo profiles expose
bounded views of the same read-only engine; disabled features are not
advertised as unavailable stubs.
The MIT weavatrix-seo package is read-only. It never writes
pages or source. Live HTTP happens only for origins you pass to
audit or an MCP tool; the MCP host defaults to
--public-only. Off-crawl canonicals stay UNMEASURED rather than
being treated as healthy. Report SEO issues on
weavatrix-seo advisories.
The MIT weavatrix 1.x package contains no outbound HTTP implementation. Cloud and
compatible self-hosted transport lives in the separately installed MIT weavatrix-online
product. It performs endpoint capability negotiation and requires an exact preview confirmation
before sync. The graph-sync contract excludes source bodies, snippets, absolute host paths,
environment values, credentials and Git remotes; unknown payload fields are discarded.
Core has no application-source write path. It stores derived analysis caches outside the
repository; explicit architecture approval may create .weavatrix/architecture.json
only after preview and token confirmation. The separately installed MIT
weavatrix-refactor package can edit source only when its environment gate and
single-use plan token authorize the exact reviewed plan. Profiles narrow the advertised tool
catalog but do not grant write authority. It verifies hashes and expected text, journals
crash-recoverable writes and keeps a drift-checked rollback bundle under the repository's
.weavatrix/worktree control directory.
Process isolation, optional test execution, payload limits and reporting details are documented in the repository's complete security policy. See also the privacy policy and license.