Cognee

Cognee AI

Cognee AI

Cognee AI

Cognee AI

Cognee AI

Cognee AI

Cognee AI

Cognee AI

Cognee AI

Cognee AI

PSA: We found a vulnerability in context7 (7,700 stars) that lets AI agents read your private keys. Fix is merged.

A path traversal vulnerability in upstash/context7 allowed any connected AI agent to read arbitrary files from your machine -- including ~/.ssh/id_rsa, .env files, and database credentials. The attack: a malicious prompt tricks the agent into calling a file operation with a path like ../../.ssh/id_rsa. No path validation existed. The server reads the file and returns it into the conversation. We found it with our open-source scanner (spidershield), reported it, and the fix was merged in 6 days: https://github.com/upstash/context7/pull/2235 This isn't an isolated case. We've scanned 15,674 MCP servers and found similar patterns in many of them. Path traversal is the most reliably detected issue (76% true positive rate from 10,970 verified findings). 6 fix PRs merged so far across context7, cognee, mcp-gateway-registry, and others. Full writeup: https://spiderrating.com/blog/agent-escape-mcp-servers-leak-your-secrets Scanner (MIT): https://github.com/teehooai/spidershield submitted by /u/No-Investment-1140 [link] [comments]

[AI Agent] Master Tracking: Complete AI Agent Implementation

## 🎯 Goal Track the complete implementation of autonomous Python AI Agent for CoffeeOrderSystem. --- ## 📋 Implementation Steps ### Phase 1: Infrastructure (Week 1) - [ ] **Step 1:** Setup Python AI Agent Service infrastructure #133 - Python service with FastAPI - Docker integration - Basic health checks - Makefile commands ### Phase 2: AI Integration (Week 1-2) - [ ] **Step 2:** Implement Cognee integration with semantic code search #134 - CogneeService with RAG search - Architecture context gathering - Entity file discovery - Integration tests - [ ] **Step 3:** Implement PlannerAgent with LangChain #135 - TaskPlan models - LangChain planning chain - Prompt templates - Plan generation and posting ### Phase 3: Code Generation (Week 2-3) - [ ] **Step 4:** Implement DevAgent for code generation #136 - GitHub file operations - Code generation prompts - Create/modify/delete operations - Branch management - [ ] **Step 5:** Implement PRAgent and workflow orchestration #137 - PR creation with rich descriptions - Workflow orchestrator - Background task processing - Complete end-to-end flow ### Phase 4: Advanced Features (Week 3-4) - [ ] **Step 6:** Add learning/memory system - Store successful patterns in Cognee - Learn from PR reviews - Avoid failed patterns - Improve over time - [ ] **Step 7:** Add GitHub webhook listener - Auto-trigger on issue label - Real-time processing - Queue management - Concurrent task handling --- ## 🎯 Success Criteria ### MVP (Minimum Viable Product) - ✅ Agent creates plans for issues - ✅ Agent generates compilable code - ✅ Agent creates PRs with descriptions - ✅ Works for simple tasks (add field, update config) - ✅ Error handling with GitHub notifications ### Production Ready - ☐ Handles complex multi-layer changes - ☐ Learns from successful PRs - ☐ Automatic triggering via webhooks - ☐ Rate limiting and queue management - ☐ Comprehensive test coverage (>80%) - ☐ Monitoring and metrics --- ## 📊 Architecture Overview ``` ┌────────────────────────────────────┐ │ GitHub Issues (labeled: ai-agent) │ └───────────────┬────────────────────┘ │ ↓ (webhook or manual trigger) ┌───────────────┼────────────────────┐ │ WorkflowOrchestrator │ └───────────────┬────────────────────┘ │ ┌────────┼────────┐ │ │ │ ↓ ↓ ↓ PlannerAgent DevAgent PRAgent │ │ │ │ │ │ ┌───┼───┐ │ ┌───┼───┐ │ │ │ │ │ │ │ ↓ ↓ ↓ ↓ ↓ ↓ ↓ Cognee LLM GitHub GitHub (RAG) (GPT-4) (API) ``` ### Component Responsibilities **PlannerAgent:** - Analyzes GitHub issue - Searches codebase via Cognee - Creates structured TaskPlan - Posts plan as issue comment **DevAgent:** - Generates code via LLM - Creates/modifies/deletes files - Commits to feature branch - Preserves code style **PRAgent:** - Creates pull request - Writes comprehensive PR description - Links to original issue - Adds testing checklist **WorkflowOrchestrator:** - Coordinates all agents - Handles errors - Posts progress updates - Manages background execution --- ## 📦 Tech Stack ### Core - **Python 3.11+** - Agent runtime - **FastAPI** - Web framework - **LangChain** - LLM orchestration - **OpenAI GPT-4** - Code generation - **PyGithub** - GitHub API client ### AI/ML - **Cognee** - RAG and semantic search - **OpenAI Embeddings** - Vector search - **LangChain Chains** - Prompt management ### Infrastructure - **Docker** - Containerization - **PostgreSQL** - Shared with .NET API - **uvicorn** - ASGI server --- ## 📝 Usage Example ### 1. Create Issue ```markdown Title: Add loyalty points to Customer Labels: ai-agent, enhancement Description: Add LoyaltyPoints field (int, default 0) to Customer entity. Requirements: - Update Domain/Entities/Customer.cs - Update Application/DTOs/CustomerDto.cs - Create EF Core migration - Add unit tests ``` ### 2. Trigger Agent ```bash make agent-process # Enter issue number: 138 ``` ### 3. Monitor Progress Issue comments show: ``` 🤖 AI Agent Started Phase 1/3: Analyzing task... 🤖 Execution Plan Summary: Add LoyaltyPoints field to Customer entity Steps: 1. MODIFY Domain/Entities/Customer.cs 2. MODIFY Application/DTOs/CustomerDto.cs 3. CREATE Migration file 4. CREATE Test file 🛠️ Phase 2/3: Generating code (4 files)... ✅ Step 1/4: modify Customer.cs ✅ Step 2/4: modify CustomerDto.cs ... 📦 Phase 3/3: Creating pull request... 🤖 Pull Request Created: #139 Branch: ai-agent/issue-138 Ready for review! ``` ### 4. Review PR PR includes: - Closes #138 - Comprehensive description - File changes summary - Testing checklist - Risk assessment ### 5. Merge Agent learns from successful merge for future tasks. --- ## 🧪 Testing Strategy ### Unit Tests - Agent logic (plan parsing, code generation) - Service mocks (GitHub, Cognee) - P