Description: Appending unvalidated here-doc content to user-controlled files based solely on a
single-character prompt may enable unintended modification of sensitive dotfiles if an
attacker can influence environment variables or symlinks (e.g., target files being
symlinks), so writes should avoid following symlinks or should validate targets before
appending.
install [215-221]

    read -p "Would you like to add MCPM documentation reference? [y/N] " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        echo "$MCPM_SECTION" >> "$file"
        success "Added MCPM documentation reference to $file"
    fi
fi

Description: Downloading documentation over HTTPS without verifying integrity (no checksum, signature,
or pinned certificate) risks TOFU issues and supply-chain tampering if the remote content
is compromised, which then gets stored under ~/.config/mcpm/llm.txt and referenced by
agents.
install [176-181]

if curl -sSL "$LLM_TXT_URL" -o "$MCPM_LLM_TXT" 2>/dev/null; then
    info "Saved AI agent documentation to $MCPM_LLM_TXT"
else
    info "Could not download llm.txt (will use GitHub URL as fallback)"
fi

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No audit logs: Newly added actions (downloading documentation and modifying user files) are not logged in
an audit-friendly manner, making it unclear who consented and what files were changed.

# Function to setup AI agent integration
setup_ai_agent_docs() {
    MCPM_CONFIG_DIR="$HOME/.config/mcpm"
    MCPM_LLM_TXT="$MCPM_CONFIG_DIR/llm.txt"
    LLM_TXT_URL="https://raw.githubusercontent.com/pathintegral-institute/mcpm.sh/main/llm.txt"

    # Download llm.txt to config directory
    info "Downloading MCPM documentation for AI agents..."
    mkdir -p "$MCPM_CONFIG_DIR"
    if curl -sSL "$LLM_TXT_URL" -o "$MCPM_LLM_TXT" 2>/dev/null; then
        info "Saved AI agent documentation to $MCPM_LLM_TXT"
    else
        info "Could not download llm.txt (will use GitHub URL as fallback)"
    fi

    # Check for AI agent instruction files
    AI_INSTRUCTION_FILES=(
        "$HOME/CLAUDE.md"
        "$HOME/.claude/CLAUDE.md"
        "$HOME/agents.md"
        "$HOME/.config/claude/CLAUDE.md"


 ... (clipped 37 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Silent failures: The curl download failure only logs a generic info message without exit status or retry,
and file append operations do not check write errors or handle non-writable files.

# Download llm.txt to config directory
info "Downloading MCPM documentation for AI agents..."
mkdir -p "$MCPM_CONFIG_DIR"
if curl -sSL "$LLM_TXT_URL" -o "$MCPM_LLM_TXT" 2>/dev/null; then
    info "Saved AI agent documentation to $MCPM_LLM_TXT"
else
    info "Could not download llm.txt (will use GitHub URL as fallback)"
fi

# Check for AI agent instruction files
AI_INSTRUCTION_FILES=(
    "$HOME/CLAUDE.md"
    "$HOME/.claude/CLAUDE.md"
    "$HOME/agents.md"
    "$HOME/.config/claude/CLAUDE.md"
)

MCPM_MARKER="<!-- MCPM-AI-AGENT-DOCS -->"

read -r -d '' MCPM_SECTION << 'MCPM_EOF'



 ... (clipped 28 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Unstructured logs: The script uses human-readable echo/info messages without structured format, which may
hinder auditing while including full file paths in prompts and messages.

# Download llm.txt to config directory
info "Downloading MCPM documentation for AI agents..."
mkdir -p "$MCPM_CONFIG_DIR"
if curl -sSL "$LLM_TXT_URL" -o "$MCPM_LLM_TXT" 2>/dev/null; then
    info "Saved AI agent documentation to $MCPM_LLM_TXT"
else
    info "Could not download llm.txt (will use GitHub URL as fallback)"
fi

# Check for AI agent instruction files
AI_INSTRUCTION_FILES=(
    "$HOME/CLAUDE.md"
    "$HOME/.claude/CLAUDE.md"
    "$HOME/agents.md"
    "$HOME/.config/claude/CLAUDE.md"
)

MCPM_MARKER="<!-- MCPM-AI-AGENT-DOCS -->"

read -r -d '' MCPM_SECTION << 'MCPM_EOF'



 ... (clipped 28 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Input handling: User prompt reads a single char without validating or timing out and appends heredoc
content to arbitrary existing files without verifying permissions or safe write semantics
(e.g., atomic writes/backup).

    echo
    echo -e "${CYAN}Found AI agent instruction file: $file${NC}"
    read -p "Would you like to add MCPM documentation reference? [y/N] " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        echo "$MCPM_SECTION" >> "$file"
        success "Added MCPM documentation reference to $file"
    fi
fi

Learn more about managing compliance generic rules or creating your own custom rules

The AI integration logic should be removed from the installation script.
Instead, it should be offered as a separate, post-install command like mcpm
setup-ai to keep the installer focused and make the integration an explicit user
action.

Examples:

setup_ai_agent_docs() {
    MCPM_CONFIG_DIR="$HOME/.config/mcpm"
    MCPM_LLM_TXT="$MCPM_CONFIG_DIR/llm.txt"
    LLM_TXT_URL="https://raw.githubusercontent.com/pathintegral-institute/mcpm.sh/main/llm.txt"

    # Download llm.txt to config directory
    info "Downloading MCPM documentation for AI agents..."
    mkdir -p "$MCPM_CONFIG_DIR"
    if curl -sSL "$LLM_TXT_URL" -o "$MCPM_LLM_TXT" 2>/dev/null; then
        info "Saved AI agent documentation to $MCPM_LLM_TXT"

 ... (clipped 56 lines)

Solution Walkthrough:

Before:

# pages/install

setup_ai_agent_docs() {
    # ... download docs ...
    AI_INSTRUCTION_FILES=(...)
    for file in "${AI_INSTRUCTION_FILES[@]}"; do
        if [ -f "$file" ]; then
            read -p "Would you like to add MCPM documentation reference?"
            if [[ $REPLY =~ ^[Yy]$ ]]; then
                echo "$MCPM_SECTION" >> "$file"
            fi
        fi
    done
}

main() {
    # ... install steps ...
    setup_ai_agent_docs
}

After:

# pages/install

main() {
    # ... install steps ...
    # AI setup is removed from installer.
    info("To integrate with AI assistants, run 'mcpm setup-ai' after installation.")
}


# In the mcpm application (new command)
# mcpm setup-ai
def setup_ai_command():
    # ... download docs ...
    # ... find AI instruction files ...
    # ... prompt user and append docs ...

Check if appending to the user's file was successful before printing a success
message, and report an error if the write operation fails.

pages/install [217-220]

 if [[ $REPLY =~ ^[Yy]$ ]]; then
-    echo "$MCPM_SECTION" >> "$file"
-    success "Added MCPM documentation reference to $file"
+    if echo "$MCPM_SECTION" >> "$file"; then
+        success "Added MCPM documentation reference to $file"
+    else
+        error "Failed to write to $file. Please check permissions."
+    fi
 fi

• Apply / Chat

Remove the 2>/dev/null redirection from the curl command to allow its error
messages to be displayed, which will help with debugging download failures.

pages/install [176-180]

-if curl -sSL "$LLM_TXT_URL" -o "$MCPM_LLM_TXT" 2>/dev/null; then
+if curl -sSL "$LLM_TXT_URL" -o "$MCPM_LLM_TXT"; then
     info "Saved AI agent documentation to $MCPM_LLM_TXT"
 else
     info "Could not download llm.txt (will use GitHub URL as fallback)"
 fi

• Apply / Chat