Observed: the agent drove the server with curl … -H 'x-cmsis-debugmcp-token: …' against the per-window control port, and ran reg_file=…/cmsis-debugmcp-registry … to discover it. The {"result": "…"} JSON the agent saw is the control-server envelope, not an MCP result.
How that was possible: the registry files (<tmpdir>/cmsis-developer-assistant-registry/window-<pid>.json, workspaceRegistry.ts:42-107) are world-readable JSON containing controlPort and controlToken in cleartext. The token is meant only for the router→worker hop (routingDebuggingHandler.ts:156, controlServer.ts:72); nothing documents it, and list_debug_windows already returns the same window list through MCP. The agent went there because it wanted a longer timeout and a specific window (see the 60 s cap and window-selection issues), not because the channel is useful.
Proposed: write registry files with mode 0600 (and the directory 0700); add to the cmsis-debug-live skill and the MCP instructions that the control server is internal and list_debug_windows / select_debug_window are the way to see and pick windows.
Priority: P3 (hygiene; the real fixes are the timeout and window-selection issues).
Observed: the agent drove the server with
curl … -H 'x-cmsis-debugmcp-token: …'against the per-window control port, and ranreg_file=…/cmsis-debugmcp-registry …to discover it. The{"result": "…"}JSON the agent saw is the control-server envelope, not an MCP result.How that was possible: the registry files (
<tmpdir>/cmsis-developer-assistant-registry/window-<pid>.json, workspaceRegistry.ts:42-107) are world-readable JSON containingcontrolPortandcontrolTokenin cleartext. The token is meant only for the router→worker hop (routingDebuggingHandler.ts:156, controlServer.ts:72); nothing documents it, andlist_debug_windowsalready returns the same window list through MCP. The agent went there because it wanted a longer timeout and a specific window (see the 60 s cap and window-selection issues), not because the channel is useful.Proposed: write registry files with mode 0600 (and the directory 0700); add to the
cmsis-debug-liveskill and the MCPinstructionsthat the control server is internal andlist_debug_windows/select_debug_windoware the way to see and pick windows.Priority: P3 (hygiene; the real fixes are the timeout and window-selection issues).