fix(mcp): sanitize god node labels

[dsfaccini]

This pull request was posted by codex-tui using gpt-5.6-sol on behalf of David.

Summary

• sanitize graph-derived labels in the MCP god_nodes handler
• preserve ordinary output ordering and degree values
• cover long and control-character labels through an HTTP MCP tool call

Fixes #3226.

Validation

• uv run --frozen --extra mcp pytest -p no:xdist tests/test_serve_http.py -q — pass
• changed-file pre-commit hooks — pass
• GRAPHIFY_MAX_WORKERS=2 uv run --frozen --no-dev --extra mcp graphify update . — pass

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

Sanitizes node labels in the god_nodes MCP tool output through sanitize_label, stripping control characters and truncating overlong labels before they reach clients. Adds test_god_nodes_sanitizes_labels_over_mcp verifying a label with NUL/\x1f/\x7f bytes and 300 padding chars comes back as clean, 256-char-capped text over the HTTP transport.

No blocking issues surfaced. 1 lower-confidence candidate did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 508 functions depend on the 168 functions this change touches.

Health — this change adds coupling hotspots:

• new: dispatch_command() — 2 callers, 123 callees
• new: _query_graph_text() — 20 callers, 9 callees
• new: _score_query() — 15 callers, 5 callees
• new: _query_terms() — 20 callers, 3 callees
• new: run_benchmark() — 16 callers, 3 callees
• new: _build_server() — 2 callers, 16 callees
• new: _load_graph() — 9 callers, 3 callees
• new: _query_subgraph_tokens() — 7 callers, 3 callees
• …and 8 more — each is listed as a finding

Verification — 508 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 333 function(s) in the blast radius were not formally verified this run

Formal verification

Could not verify: Could not verify \_build\_server.

The verifier did not have enough to check \_build\_server, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 23 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous

· 16 more finding(s) on lines outside this diff (see the check run).