Safety on madtea

Credential Safety

Mon, 01 Jan 0001 00:00:00 +0000

How madtea stores your Forgejo/Gitea token locally and what the “credential-safe git wrappers” claim actually guarantees. For what scopes to enable on the token itself, see PERMISSIONS.md. For how to report a credential-related vulnerability, see SECURITY.md.

Storage backends

By default madtea auth login stores your token in a secure backend — the OS keychain when one is available, otherwise pass, otherwise systemd-creds on a headless server with systemd. The URL and username always go to git config (they are not secret). When no secure backend is available, madtea refuses to store the token with an error naming the fix — plaintext git config is never an automatic fallback; it happens only with the explicit --insecure-storage flag, which also forces the plaintext path when a keychain is present. The backend is not user-selectable beyond that: auto-detection always tries the OS keychain first, then pass, then systemd-creds.

Safe body edits

Mon, 01 Jan 0001 00:00:00 +0000

madtea has no command that overwrites an issue body or pull-request body wholesale. Every edit is surgical and anchored: you change a specific span, line, or named region, and the write is rejected if the text you anchored to has drifted or the body changed underneath you. That makes silent clobbering — by an AI agent working from a stale read, or by two writers racing — structurally impossible rather than merely discouraged. (Comments are the one surface Gitea gives no version token: there comment-edit does a full-body replace guarded by an --expected-body check — required on the MCP/agent surface, optional on the CLI. See Comments.)

Safety hooks

Mon, 01 Jan 0001 00:00:00 +0000

Claude Code only. These bash hooks are Claude-Code-specific. They ship with the Claude Code plugin — installing the plugin is the way to get them. Agents on other MCP clients (Codex, Antigravity, Cursor, Zed, …) get the same credential-safe MCP tools but not these hooks — and don’t need them, because the MCP tools never put a token in argv, history, or errors in the first place.

The Claude Code plugin installs seven PreToolUse hooks that intercept tool calls before they run — they don’t change git itself, only what the agent is permitted to run. The plugin is the single delivery channel: a binary-only madtea (Homebrew, Scoop, release tarball) does not materialize these hooks — install the plugin to add them. An MCP-only user who installs neither still keeps the credential-safe MCP tools, which never leak credentials in the first place.

Wrong-repo fail-closed guard

Mon, 01 Jan 0001 00:00:00 +0000

A repo-scoped MCP tool called without an explicit owner_repo resolves its target repo from the MCP server process’s working directory — not from any cd the agent did. The server is a single long-lived process whose OS working directory is fixed at launch, and concurrent tool calls share it, so the server cannot follow an agent into a sibling repo. In a multi-repo workspace that fixed cwd may be the wrong repo, which has caused real wrong-repo writes — a finish merged the wrong branch to the wrong repo, and an issue create filed on the wrong repo (the wrong-repo hazard). To keep that from happening silently, madtea applies a fail-closed guard before any repo-scoped handler runs.