All pull requests

Pull requests

• fix(mcp): offload MCPToolProvider._log_activity DB write to asyncio.to_thread

  #626·ojaswa072 opened Nov 6, 2026·

  ·

• fix(vendor): return 409 instead of 500 when deleting a vendor with linked records

  #625·prince-shakyaa opened Nov 5, 2026·

  ·
  1

  1

• test(ctf): add unit tests for VendorStatusFlipDetector

  #621·LOGICAL09 opened Nov 3, 2026·

  ·

• Optional Labs guardrail enforcement and agent_name on hook payload

  #618·nizba06 opened Nov 1, 2026·1 of 4 tasks·

  ·
  1

• fix(ci): install test dependencies from uv.lock

  #616·steadhac opened Oct 29, 2026Contributor·

  ·

• feat: test creation agents — find untested changes and write the missing tests

  #615·steadhac opened Oct 29, 2026Contributor·

  ·
  1

• fix(vendor): block invoice edits after approval or payment

  #614·prince-shakyaa opened Oct 28, 2026·

  ·
  1

  1

• feat(ctf): add CumulativeOverpaymentDetector for structured overpayment coverage

  #612·genesisadversary opened Oct 21, 2026·

  ·

• fix(agents): validate, bound, and sanitize tool output in agent loop (closes #199)

  #611·rohanbuilds-ai opened Oct 21, 2026·

  ·
  1

• fix(security): resolve profile update SSRF bypass and harden avatar fetch (#506)

  #610·rohanbuilds-ai opened Oct 21, 2026·

  ·
  1

  1

• fix(detectors): extract clean text from list content blocks in PIIDetector (#127)

  #608·rohanbuilds-ai opened Oct 20, 2026·

  ·
  1

• fix(ws): take WebSocket identity from the session cookie

  #607·prince-shakyaa opened Oct 20, 2026·

  ·
  1

  1

• fix(ctf): reject None for numeric detector config keys

  #605·Prasad-desh opened Oct 18, 2026·

  ·
  1

• fix(ctf): don't count the current event in the RCE multi-turn gate

  #604·Sahil-u07 opened Oct 17, 2026·

  ·

• fix(detectors): safely parse invoice attachment file IDs in InflatedPaymentDetector (#260)

  #603·rohanbuilds-ai opened Oct 16, 2026·

  ·
  1

• fix(cc): calculate Platform Pulse total_users from User accounts

  #601·prince-shakyaa opened Oct 15, 2026·

  ·
  1

  1

• fix(mcp): prevent deletion of protected SystemUtils users

  #599·rohanbuilds-ai opened Oct 15, 2026·

  ·
  1

• fix(mcp): enforce SystemUtils enabled_tools allow-list

  #597·rohanbuilds-ai opened Oct 15, 2026·

  ·

• fix(detectors): harden tool call condition evaluation

  #596·rohanbuilds-ai opened Oct 15, 2026·

  ·

• fix(agents): handle unresolvable task_data IDs

  #595·rohanbuilds-ai opened Oct 15, 2026·

  ·
  1

• fix(ctf): reject None for list-typed detector config keys

  #594·Prasad-desh opened Oct 15, 2026·

  ·
  2

  1

• feat(ctf): add poisoned handoff challenge and detector

  #593·Dee-Tee11 opened Oct 12, 2026·

  ·

• Fix SSN and EIN classification in TaxCalc validation

  #592·rohanbuilds-ai opened Oct 11, 2026·

  ·
  3

• fix(findrive): reject empty or whitespace-only upload content

  #590·Prasad-desh opened Oct 7, 2026·

  ·
  1

  2

• test(agents): await _get_user_prompt in the two SAI-EDGE prompt tests

  #588·Prasad-desh opened Oct 4, 2026·

  ·
  5