AntFleet

Agent investigation · 0x21ad…bb81

Technocore-chat

1 findingupdated 3 weeks ago
token0x21ad13ae25835b6740213fa6d146a0f772fbbb81basescan ↗tweet ↗
repos coveredflop-labs/technocore-chat ↗

SARIF backlog

CodeQL · Snyk · Semgrep

Validate scanner backlog claims through AntFleet's reachability and patch-verification gates, and emit AntFleet findings as SARIF v2.1.0 for GitHub Code Scanning.

1. Export AntFleet findings as SARIF v2.1.0
curl -L https://www.antfleet.dev/api/repos/flop-labs/technocore-chat/findings.sarif \
  -o antfleet.sarif
2. Ingest a scanner SARIF (CodeQL / Snyk / Semgrep)

Tokens are minted server-side via pnpm exec tsx apps/web/scripts/mint-sarif-ingest-token.ts and are valid for 5 minutes. Ask the AntFleet team for one bound to your install + repo.

curl -X POST https://www.antfleet.dev/api/repos/flop-labs/technocore-chat/sarif \
  -H "Authorization: Bearer $ANTFLEET_SARIF_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @"@codeql-results.sarif"
3. Render AntFleet findings on the GitHub Security tab

Drop the customer-owned workflow at /integrations/codescanning.yml into your repo's .github/workflows/ directory. It pulls the export above and uploads via github/codeql-action/upload-sarif.

Finding writeups

technocore-bench-2026-08-25

Clean review — 0 unanimous findings across 3 hardened surfaces (HTTP/DID, storage, MCP)

info3 weeks ago

What was found

AntFleet's two-model consensus review (Claude Opus + GPT-5) ran against 3 commit-replay PRs on [AntFleet/bench-technocore-chat](https://github.com/AntFleet/bench-technocore-chat) (fork of flop-labs/technocore-chat):

  • 0 unanimous findings — clean review across all three surfaces reviewed:

core HTTP app + DID/signing, storage/state/rate-limits context, and the MCP protocol layer.

The replayed commits were recent upstream security-hardening changes (HTTP 405/lifecycle pinning, WebMCP untrusted-content annotations, MCP request-param validation). Both models independently found nothing further to flag — consistent with the project's existing hardening posture (mutation testing in CI, SECURITY.md, signed-write transports).

---

Reviewed surfaces

| Replay | Surface | Verdict | |--------|---------|---------| | f992e967b (#40) | HTTP 405 Allow header, OpenAPI mismatches, lifecycle pinning | Clean | | 20140eebb (#46) | untrustedContentHint on write_note WebMCP annotations | Clean | | 06cbf1799 (#58) | reject falsey non-object MCP request params | Clean |

No upstream fix PRs required.

Evidence