From 896b03388461be7e3d01ae6d2ff235873bbd9eb1 Mon Sep 17 00:00:00 2001 From: Thizeidler Date: Tue, 7 Jul 2026 09:41:26 -0300 Subject: [PATCH] docs(security): clarify stdio-only claim now that HTTP transport exists SECURITY.md said graphify never runs a network listener and only communicates over stdio. README.md documents an opt-in --transport http mode (with --host/--api-key flags) for sharing one server across a team, which does open a network listener. Update the claim to describe the default (stdio, no listener) and the documented opt-in exception. --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 297b7d8d3..795454b21 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -42,7 +42,7 @@ graphify is a **local development tool**. It runs as a Claude Code skill and opt ### What graphify does NOT do -- Does not run a network listener (MCP server communicates over stdio only) +- Does not run a network listener by default (stdio transport); `--transport http` is opt-in, documented in the README, and binds to `127.0.0.1` unless `--host 0.0.0.0` is passed - Does not execute code from source files (tree-sitter parses ASTs - no eval/exec) - Does not use `shell=True` in any subprocess call - Does not store credentials or API keys