rails-mcp-server 1.6.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61b6de0c4ec67e88054b3fa1b91cfc3d0a9b6cb5d1c565c5086b1e88dfcd7dda
-  data.tar.gz: 6af401f97462dd368072b223117fab10f49da0b873f7b2f29985da63ec4d8a98
+  metadata.gz: 380196bc8728daef0f20e005b40ef1464163062c4e871d60adc5a819da8f9e61
+  data.tar.gz: bc43ce8aa0a82c432def067b39394d9f3a1554484040fabc6bb4cf78b2268546
 SHA512:
-  metadata.gz: 8cd00e7e51074c682b42ddcbd07dc7697547313c4712c69c0641f6357bbde84775bc8425fe5cad1b05807ca97c065e6d015a5d0aa03079dd371f39e3f664a331
-  data.tar.gz: 20d054080683e9c8151075fcd6084eaaa868b549c99128768a18abe37bb1ec1ab96c32661273920fd03d100eea37c47c92e36ea6a11c266eff21239f84545d54
+  metadata.gz: f8025ec3e715e178650a138658fc4b8ebe9b81f49a4a1401d4b37efbde7a82c150c021e1737826536605f9c966e20b3ade4c5bf7879f85d383b9f28e047e9256
+  data.tar.gz: dfc2ce718b07936d8775a875bcf6f8979934151cf4e95827d7a41931ca5406b7b42671fbd17b7a8d312131f8f17679cb91457b6739f0ae41af0fe1acc235ceba

data/CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-08-04
+
+### Removed
+
+- **`execute_ruby` tool removed** (breaking): The tool that executed caller-supplied Ruby via `bin/rails runner` is gone. It was originally intended for Rails introspection (routes, schema, model queries), but accepting arbitrary Ruby made it an arbitrary-code-execution surface that a regex denylist and in-process monkey-patching could not safely contain — the root cause behind the 1.6.x hardening series. The server is an **introspection tool**, and its dedicated analyzers already cover the intended uses:
+  - Reading files → `get_file`
+  - Finding files → `list_files`
+  - Routes / schema / models / controllers / env / structure → `get_routes`, `get_schema`, `analyze_models`, `analyze_controller_views`, `analyze_environment_config`, `project_info`
+  - The only capability dropped is running arbitrary live Ruby against the app (ad-hoc data queries), which is out of scope for an introspection server and was the source of the risk.
+
+### Changed
+
+- **Bootstrap tools reduced from 4 to 3**: `switch_project`, `search_tools`, `execute_tool`. The internal analyzers are unchanged and still discovered via `search_tools` / invoked via `execute_tool`.
+- **`switch_project` quick-start** now points to `execute_tool("get_file", …)` / `execute_tool("list_files", …)` instead of `execute_ruby`.
+- **Docs** (`README.md`, `docs/AGENT.md`, `docs/COPILOT_AGENT.md`, `SECURITY.md`) rewritten to route file reads/finds through `get_file` / `list_files` and to describe the server as introspection-only. `SECURITY.md` drops the `execute_ruby` sandbox section; the remaining file tools are protected by `PathValidator` (path-traversal and sensitive-file checks) and the app-booting analyzers pass caller input as validated parameters, never as code.
+
+### Migration
+
+Clients that listed `execute_ruby` in their tool config should remove it. Replace `execute_ruby` file reads with `get_file` (`{ path: ... }`) and file globs with `list_files` (`{ pattern: ... }`). Ad-hoc data queries (`User.count`, custom scopes) are no longer supported by design; use the dedicated analyzers for structural introspection. Users who still want free-form execution should pin to the `1.6.x` line, which retains the hardened `execute_ruby`.
+
+## [1.6.1] - 2026-08-04
+
+### Security
+
+- **`execute_ruby` process-execution hardening**: Closed a command-execution path and tightened the static filter.
+  - **`require` restricted to a tiny data-lib allowlist**: `require_relative` and dynamic `require`s are refused, and literal `require "lib"` is refused except for a small allowlist of pure-data libraries not always preloaded (`csv`, `tzinfo`, `date`, `time`). Under `bin/rails runner` the app's models, ActiveRecord, and the stdlib Rails loads on boot are already available, so inspection code needs almost no requires — and every dangerous stdlib escape has to be required first. This closes `require "pty"` (`PTY.spawn`/`PTY.getpty` started a child process outside the `Kernel#system` guard, giving arbitrary host command execution), along with `open3`, `fiddle`, `ffi`, and `socket`, at the source rather than by enumerating individual APIs. (`tzinfo` pairs with the existing system-timezone read-path allowlist so `Time.zone` code keeps working.)
+  - **Native/PTY patterns**: `PTY`, `Fiddle`, and `FFI` are added to the forbidden-pattern scan as defense in depth.
+  - **Dynamic dispatch to execution sinks hard-blocked**: `send`/`public_send`/`__send__`/`const_get` aimed by name at an execution or eval sink (`system`, `exec`, `spawn`, `fork`, `eval`, `popen`, `Open3`, `Process`, `PTY`, …) are now rejected outright instead of merely gated behind `confirm_risky`. Benign dynamic dispatch (e.g. `record.send(:name)`) is unaffected.
+  - **Honest framing**: the tool description and docs no longer call `execute_ruby` a read-only sandbox. It runs caller-supplied Ruby with the privileges of the server process; the controls are best-effort guardrails, not an isolation boundary.
+
+### Fixed
+
+- **ReDoS in the `execute_ruby` static scan**: Rewrote the `require`/dynamic-dispatch matchers to remove an ambiguous `\s*\(?\s*` construct that backtracked in polynomial time on adversarial whitespace input (CodeQL alert). Matching is now linear.
+
 ## [1.6.0] - 2026-08-03
 
 ### Added
@@ -355,6 +389,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Version History Summary
 
+- **v2.0.0** (2026-08-04): Removed the `execute_ruby` tool — the server is introspection-only via its dedicated analyzers (breaking)
+- **v1.6.1** (2026-08-04): `execute_ruby` process-execution hardening (blocks the `require "pty"` → `PTY.spawn` command-execution path, restricts `require` to a data-lib allowlist, hard-blocks dynamic dispatch to execution sinks) and a ReDoS fix in the static scan
 - **v1.6.0** (2026-08-03): Sandbox hardening for `execute_ruby`, version-manager Ruby resolution, namespaced model resolution, dependency + security updates (drops Ruby 3.2)
 - **v1.5.1** (2026-03-04): Relaxed dependency version constraints for better compatibility
 - **v1.4.0** (2025-12-10): Context-efficient architecture with progressive tool discovery (67% token reduction)

data/README.md

@@ -17,7 +17,6 @@ This Rails MCP Server implements the MCP specification to give AI models access
 - Get database schema information
 - Analyze controller-view relationships
 - Analyze environment configurations
-- Execute sandboxed Ruby code for custom queries
 - Access comprehensive Rails, Turbo, Stimulus, and Kamal documentation
 - Context-efficient architecture with progressive tool discovery
 - Seamless integration with LLM clients
@@ -230,7 +229,7 @@ Replace `/home/your_user/.rbenv/shims/ruby` with your actual Ruby path (an rbenv
 
 #### 2. The Ruby used to introspect each Rails project
 
-Tools that boot your app — `execute_ruby`, `get_schema`, and the introspection half of `analyze_models` / `analyze_controller_views` — run `bin/rails` inside the project directory. The server selects the **project's** Ruby automatically and is agnostic to your version manager: it prepends the active manager's shims (**mise**, **asdf**, **rbenv**) to the subprocess `PATH` and sources **rvm** when present, then uses a non-login shell so macOS `path_helper` cannot substitute the system Ruby. The version is taken from the project's `.ruby-version` / `.tool-versions` / `.mise.toml`, so different projects can use different Rubies with no extra configuration.
+Tools that boot your app — `get_schema`, `get_routes`, and the introspection half of `analyze_models` / `analyze_controller_views` — run `bin/rails` inside the project directory. The server selects the **project's** Ruby automatically and is agnostic to your version manager: it prepends the active manager's shims (**mise**, **asdf**, **rbenv**) to the subprocess `PATH` and sources **rvm** when present, then uses a non-login shell so macOS `path_helper` cannot substitute the system Ruby. The version is taken from the project's `.ruby-version` / `.tool-versions` / `.mise.toml`, so different projects can use different Rubies with no extra configuration.
 
 > No manual `PATH` workaround is needed. Previously these tools could fall back to the system Ruby on mise/asdf machines, where the app's Bundler then failed to boot.
 
@@ -286,7 +285,7 @@ Rails MCP Server works with GitHub Copilot coding agent out of the box. The serv
       "type": "local",
       "command": "rails-mcp-server",
       "args": ["--single-project"],
-      "tools": ["switch_project", "search_tools", "execute_tool", "execute_ruby"]
+      "tools": ["switch_project", "search_tools", "execute_tool"]
     }
   }
 }
@@ -331,7 +330,7 @@ You can also use the `RAILS_MCP_PROJECT_PATH` environment variable:
       "env": {
         "RAILS_MCP_PROJECT_PATH": "."
       },
-      "tools": ["switch_project", "search_tools", "execute_tool", "execute_ruby"]
+      "tools": ["switch_project", "search_tools", "execute_tool"]
     }
   }
 }
@@ -355,14 +354,13 @@ Each request includes a sequence number to match requests with responses, as def
 
 ### Context-Efficient Architecture
 
-The server uses a progressive tool discovery architecture to minimize context usage. Instead of exposing all tools upfront, it provides 4 bootstrap tools that allow LLMs to discover and invoke additional analyzers on-demand:
+The server uses a progressive tool discovery architecture to minimize context usage. Instead of exposing all tools upfront, it provides 3 bootstrap tools that allow LLMs to discover and invoke the introspection analyzers on-demand:
 
 - **`switch_project`** - Select the active Rails project
 - **`search_tools`** - Discover available tools by category or keyword
 - **`execute_tool`** - Invoke internal analyzers with parameters
-- **`execute_ruby`** - Run sandboxed Ruby code for custom queries
 
-This design reduces initial context from ~2,400 tokens to ~800 tokens while maintaining full functionality.
+This design keeps initial context small while exposing the full set of analyzers on demand.
 
 ## AI Agent Guide
 
@@ -370,14 +368,13 @@ For AI agents (Claude, GPT, etc.) using this server, see the comprehensive **[AI
 
 - Quick start workflow
 - Tool selection guide for common tasks
-- Helper methods available in `execute_ruby`
 - Common pitfalls and how to avoid them
 - Error handling and fallback strategies
 - Integration with other MCP servers (e.g., Neovim MCP)
 
 ## Available Tools
 
-The server provides 4 registered tools plus internal analyzers accessible via `execute_tool`.
+The server provides 3 registered tools plus internal analyzers accessible via `execute_tool`.
 
 ### Registered Tools
 
@@ -410,36 +407,6 @@ After switching, you'll see a Quick Start guide with common commands.
 - `tool_name`: (String, required) Name of the analyzer (e.g., 'get_routes', 'analyze_models')
 - `params`: (Hash, optional) Parameters for the analyzer
 
-#### 4. `execute_ruby`
-
-**Description:** Execute sandboxed Ruby code in the Rails project context.
-
-**Parameters:**
-
-- `code`: (String, required) Ruby code to execute
-- `timeout`: (Integer, optional) Timeout in seconds (default: 30, max: 60)
-- `confirm_risky`: (Boolean, optional) Set `true` only after you have explicitly approved code that uses dual-use constructs (`send`, `public_send`, `const_get`, `Kernel#open`). When false/absent, such code is not executed — the tool returns a `CONFIRMATION REQUIRED` message explaining the risk instead.
-
-**Available helper methods:**
-
-- `read_file(path)` - Read a file safely
-- `file_exists?(path)` - Check if a file exists
-- `list_files(pattern)` - Glob files (e.g., `'app/models/**/*.rb'`)
-- `project_root` - Get the project root path
-
-**Note:** Use `puts` to see output from your code.
-
-**Security:** The sandbox is intended for read-only exploration and applies several layers of defense:
-
-- **No writes / shell / network:** file writes, `system`/`exec`/backticks, and network libraries are blocked by both static analysis and runtime overrides.
-- **Confined file reads:** reads are limited to the project directory (via all of `File`/`IO` `read`/`readlines`/`binread`/`foreach` and `File.open`), plus a small allowlist of read-only system timezone paths (e.g. `/usr/share/zoneinfo`) that Rails needs when code touches `Time.zone`. Paths are symlink-resolved (`realpath`) so a link inside the project cannot point outside it.
-- **No sensitive files:** `.env`, credentials, keys, and any `.gitignore`d path are refused.
-- **Database writes are rolled back:** user code runs inside a transaction that is always rolled back, so `delete_all`, `update`, `save`, and raw DML are undone. Treat the tool as read-only for data too. (Caveat: DDL may still commit on some adapters such as MySQL, and `after_commit` callbacks do not fire.)
-- **Bounded execution:** a timeout (default 30s, max 60s) kills the whole process group, so a runaway `bin/rails runner` is terminated rather than orphaned.
-- **Confirmation for dual-use constructs:** `send`, `public_send`, `const_get`, and `Kernel#open` are not run until you approve them via `confirm_risky: true`.
-
-These controls are defense-in-depth, not a hard isolation boundary. `execute_ruby` executes real Ruby with full access to the Rails app, so only enable it for projects and clients you trust. For stronger isolation run the server against a database user with read-only grants and/or inside an OS-level sandbox (container, `sandbox-exec`, etc.).
-
 ### Internal Analyzers (via execute_tool)
 
 #### `project_info`
@@ -598,7 +565,7 @@ This will:
 
 In the MCP Inspector UI, you can:
 
-- See all available tools (you should see 4 registered tools)
+- See all available tools (you should see 3 registered tools)
 - Execute tool calls interactively
 - View request and response details
 - Debug issues in real-time
@@ -609,8 +576,8 @@ The Inspector UI provides an intuitive interface to interact with your MCP serve
 
 1. **Switch to a project:** `switch_project` with your project name
 2. **Discover tools:** `search_tools` to see available analyzers
-3. **Test analyzers:** `execute_tool` to invoke specific analyzers
-4. **Test Ruby execution:** `execute_ruby` with code like `puts read_file('Gemfile')`
+3. **Test analyzers:** `execute_tool` to invoke specific analyzers (e.g. `get_routes`, `get_schema`)
+4. **Read a file:** `execute_tool` with `get_file`, e.g. `{ "path": "Gemfile" }`
 
 ## Integration with LLM Clients
 

data/docs/AGENT.md

@@ -11,20 +11,17 @@ MCP Client (Claude, etc.)
     │
     ▼
 ┌─────────────────────────────────────────────┐
-│  4 MCP-Registered Tools                     │
+│  3 MCP-Registered Tools                     │
 │  ┌─────────────┐  ┌─────────────────────┐   │
 │  │switch_project│  │search_tools        │   │
 │  └─────────────┘  └─────────────────────┘   │
 │  ┌─────────────┐  ┌─────────────────────┐   │
 │  │execute_tool │──▶│ 9 Internal Analyzers│   │
 │  └─────────────┘  └─────────────────────┘   │
-│  ┌─────────────┐                            │
-│  │execute_ruby │                            │
-│  └─────────────┘                            │
 └─────────────────────────────────────────────┘
 ```
 
-**Key concept:** Only 4 tools are registered with MCP. The 9 internal analyzers (`analyze_models`, `get_routes`, etc.) are discovered via `search_tools` and invoked via `execute_tool`.
+**Key concept:** Only 3 tools are registered with MCP. The 9 internal analyzers (`analyze_models`, `get_routes`, `get_file`, etc.) are discovered via `search_tools` and invoked via `execute_tool`. The server is an introspection tool — it exposes this fixed set of analyzers and does not execute arbitrary Ruby.
 
 ---
 
@@ -54,50 +51,39 @@ railsMcpServer:search_tools query: "routes"
 
 ### Reading Files
 
-**Primary method** - Use `execute_ruby` with `read_file()`:
-
-```
-railsMcpServer:execute_ruby code: "puts read_file('config/routes.rb')"
-railsMcpServer:execute_ruby code: "puts read_file('app/models/user.rb')"
-railsMcpServer:execute_ruby code: "puts read_file('app/controllers/users_controller.rb')"
-```
-
-**Alternative** - Use `get_file` tool:
+Use the `get_file` analyzer:
 
 ```
 railsMcpServer:execute_tool tool_name: "get_file" params: { path: "config/routes.rb" }
+railsMcpServer:execute_tool tool_name: "get_file" params: { path: "app/models/user.rb" }
+railsMcpServer:execute_tool tool_name: "get_file" params: { path: "app/controllers/users_controller.rb" }
 ```
 
+Paths are relative to the project root. Reads are confined to the project directory, and sensitive files (`.env`, credentials, keys) are refused.
+
 > ⚠️ **Important:** Do NOT use Claude's built-in `view` tool for Rails project files. It cannot access the project directory. Always use Rails MCP tools.
 
 ---
 
 ### Finding Files
 
-**Use `execute_ruby` with `Dir.glob()`:**
+Use the `list_files` analyzer with a glob `pattern` (and optional `directory`):
 
 ```
 # Find all models
-railsMcpServer:execute_ruby code: "puts Dir.glob('app/models/**/*.rb').join('\n')"
+railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/models/**/*.rb" }
 
 # Find all controllers
-railsMcpServer:execute_ruby code: "puts Dir.glob('app/controllers/**/*.rb').join('\n')"
+railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/controllers/**/*.rb" }
 
 # Find files by name pattern
-railsMcpServer:execute_ruby code: "puts Dir.glob('app/**/*user*').join('\n')"
+railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/**/*user*" }
 
 # Find all view templates
-railsMcpServer:execute_ruby code: "puts Dir.glob('app/views/**/*.erb').join('\n')"
+railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/views/**/*.erb" }
 
 # Find Stimulus controllers
-railsMcpServer:execute_ruby code: "puts Dir.glob('app/javascript/controllers/**/*.js').join('\n')"
-```
-
-**Using `list_files` helper** (glob pattern):
-
-```
-# List Ruby files in models directory
-railsMcpServer:execute_ruby code: "puts list_files('app/models/**/*.rb')"
+railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/javascript/controllers/**/*.js" }
 ```
 
 ---
@@ -160,10 +146,10 @@ railsMcpServer:execute_tool tool_name: "get_routes" params: { path_contains: "ap
 railsMcpServer:execute_tool tool_name: "get_routes" params: { named_only: true }
 ```
 
-**Fallback if `get_routes` fails:**
+**Fallback if `get_routes` fails:** read the routes file directly.
 
 ```
-railsMcpServer:execute_ruby code: "puts read_file('config/routes.rb')"
+railsMcpServer:execute_tool tool_name: "get_file" params: { path: "config/routes.rb" }
 ```
 
 ---
@@ -204,46 +190,19 @@ railsMcpServer:execute_tool tool_name: "analyze_environment_config"
 
 ---
 
-## Helper Methods in `execute_ruby`
-
-When using `execute_ruby`, these helper methods are available:
-
-| Helper | Usage | Description |
-|--------|-------|-------------|
-| `read_file(path)` | `read_file('config/routes.rb')` | Read file contents (relative to project root) |
-| `file_exists?(path)` | `file_exists?('app/models/user.rb')` | Check if file exists (returns boolean) |
-| `list_files(pattern)` | `list_files('app/models/*.rb')` | Glob pattern to find files |
-| `project_root` | `project_root` | Returns the project root path |
-
-**Critical:** Always use `puts` to see output:
-
-```
-# ❌ Bad - returns "Code executed successfully (no output)"
-railsMcpServer:execute_ruby code: "read_file('Gemfile')"
-
-# ✅ Good - returns file contents
-railsMcpServer:execute_ruby code: "puts read_file('Gemfile')"
-```
-
-**Read-only by design:** `execute_ruby` is for exploration, not mutation. File writes, shell/system calls, and network access are blocked, and any database writes run inside a transaction that is **always rolled back** — so `delete_all`, `update`, and `save` will not persist. Do not rely on it to change data.
-
-**Confirmation for dual-use constructs:** if your code uses `send`, `public_send`, `const_get`, or `Kernel#open`, the tool returns a `CONFIRMATION REQUIRED` message instead of running. These can bypass the sandbox's safety scan, so ask the user to review the code and, only with their explicit approval, re-invoke with `confirm_risky: true`. Do not set `confirm_risky` on your own.
-
----
-
 ## Tool Selection Summary
 
 | Task | Tool to Use |
 |------|-------------|
-| Read a project file | `execute_ruby` with `read_file()` or `get_file` |
-| Find files by pattern | `execute_ruby` with `Dir.glob()` |
+| Read a project file | `get_file` (params: `path`) |
+| Find files by pattern | `list_files` (params: `pattern`) |
 | Analyze models | `analyze_models` |
 | Get database schema | `get_schema` |
-| Get routes | `get_routes` (fallback: read routes.rb) |
+| Get routes | `get_routes` (fallback: `get_file` on `config/routes.rb`) |
 | Analyze controllers | `analyze_controller_views` |
 | Compare environments | `analyze_environment_config` |
 | Load documentation | `load_guide` |
-| Custom Ruby queries | `execute_ruby` |
+| Project overview | `project_info` |
 
 ---
 
@@ -272,7 +231,7 @@ railsMcpServer:execute_ruby code: "puts read_file('Gemfile')"
 
 | Task | Use This | NOT This |
 |------|----------|----------|
-| Read Rails project files | `railsMcpServer:execute_ruby` with `read_file()` | Claude's `view` tool |
+| Read Rails project files | `railsMcpServer:execute_tool` with `get_file` | Claude's `view` tool |
 | Edit files in Neovim | `nvimMcpServer:update_buffer` | Claude's `str_replace` |
 | Create new files | Claude's `create_file` | — |
 | View images | Claude's `view` tool | — |
@@ -293,7 +252,7 @@ When starting work on an unfamiliar codebase:
 railsMcpServer:execute_tool tool_name: "project_info"
 
 # 2. Find relevant files
-railsMcpServer:execute_ruby code: "puts Dir.glob('app/**/*transaction*').join('\n')"
+railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/**/*transaction*" }
 
 # 3. Understand the data model
 railsMcpServer:execute_tool tool_name: "analyze_models" params: { model_name: "Transaction" }
@@ -303,10 +262,10 @@ railsMcpServer:execute_tool tool_name: "get_schema" params: { table_name: "trans
 railsMcpServer:execute_tool tool_name: "get_routes" params: { controller: "transactions" }
 
 # 5. Read the controller
-railsMcpServer:execute_ruby code: "puts read_file('app/controllers/transactions_controller.rb')"
+railsMcpServer:execute_tool tool_name: "get_file" params: { path: "app/controllers/transactions_controller.rb" }
 
 # 6. Check existing views
-railsMcpServer:execute_ruby code: "puts Dir.glob('app/views/transactions/**/*').join('\n')"
+railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/views/transactions/**/*" }
 ```
 
 ---
@@ -317,10 +276,10 @@ railsMcpServer:execute_ruby code: "puts Dir.glob('app/views/transactions/**/*').
 What do you need to do?
 │
 ├─► Read/analyze code?
-│   ├─► Single file? ──────────► execute_ruby with read_file()
+│   ├─► Single file? ──────────► get_file (params: path)
 │   ├─► Model info? ───────────► analyze_models (params: model_name)
 │   ├─► Controller info? ──────► analyze_controller_views (params: controller_name)
-│   └─► Multiple files? ───────► execute_ruby with Dir.glob()
+│   └─► Multiple files? ───────► list_files (params: pattern)
 │
 ├─► Database info?
 │   ├─► Table structure? ──────► get_schema (params: table_name)
@@ -332,9 +291,7 @@ What do you need to do?
 │
 ├─► Project overview? ─────────► project_info
 │
-├─► Documentation? ────────────► load_guide (params: library, guide)
-│
-└─► Custom Ruby code? ─────────► execute_ruby
+└─► Documentation? ────────────► load_guide (params: library, guide)
 ```
 
 ---
@@ -344,7 +301,6 @@ What do you need to do?
 ### ❌ Don't
 
 - Use Claude's `view` tool for Rails project files
-- Forget `puts` in `execute_ruby` calls
 - Use absolute paths (always use paths relative to project root)
 - Skip `switch_project` before using other tools
 - Use `users` (plural) for model names - use `User` (singular CamelCase)
@@ -353,9 +309,8 @@ What do you need to do?
 ### ✅ Do
 
 - Call `switch_project` before any other MCP tool
-- Use `execute_ruby` with `read_file()` as your primary file reading method
-- Use `puts` to output results in `execute_ruby`
-- Fall back to `execute_ruby` when specialized tools fail
+- Use `get_file` to read files and `list_files` to find them
+- Use the specialized analyzers (`analyze_models`, `get_routes`, `get_schema`) for structured info
 - Use `search_tools` when unsure what's available
 - Use CamelCase singular for models: `User`, `BlogPost`, `OrderItem`
 - Use snake_case plural for tables: `users`, `blog_posts`, `order_items`
@@ -366,45 +321,27 @@ What do you need to do?
 
 ### "undefined method" errors from analyzers
 
-Some analyzers may fail with certain Rails versions. Fall back to `execute_ruby`:
+Some analyzers may fail with certain Rails versions. Fall back to reading the source directly:
 
 ```
 # If get_routes fails:
-railsMcpServer:execute_ruby code: "puts read_file('config/routes.rb')"
+railsMcpServer:execute_tool tool_name: "get_file" params: { path: "config/routes.rb" }
 
 # If analyze_models fails:
-railsMcpServer:execute_ruby code: "puts read_file('app/models/user.rb')"
+railsMcpServer:execute_tool tool_name: "get_file" params: { path: "app/models/user.rb" }
 ```
 
-### "Path not found" errors
+### "Path not found" / "Access denied" errors
 
 1. Ensure you've called `switch_project` first
 2. Use relative paths, not absolute paths
-3. Check if path exists:
+3. Check whether the file shows up in a listing:
    ```
-   railsMcpServer:execute_ruby code: "puts file_exists?('app/models/user.rb')"
+   railsMcpServer:execute_tool tool_name: "list_files" params: { pattern: "app/models/*.rb" }
    ```
+4. Sensitive files (`.env`, credentials, keys) are intentionally refused by `get_file` / `list_files`.
 
-### "wrong number of arguments" errors
-
-The `list_files()` helper takes a glob pattern as a single argument:
-```
-# Correct usage
-railsMcpServer:execute_ruby code: "puts list_files('app/models/**/*.rb')"
-```
-
-### No output from `execute_ruby`
-
-Add `puts` before your expression:
-```
-# Before (no output)
-railsMcpServer:execute_ruby code: "User.count"
-
-# After (shows result)
-railsMcpServer:execute_ruby code: "puts User.count"
-```
-
-### `execute_ruby` / `get_schema` fail to boot the app (Bundler / wrong Ruby)
+### `get_schema` / `get_routes` fail to boot the app (Bundler / wrong Ruby)
 
 These tools run the project's `bin/rails`. The server auto-selects the project's Ruby via your version manager's shims (**mise**, **asdf**, **rbenv**; **rvm** is sourced), reading `.ruby-version` / `.tool-versions` / `.mise.toml`. If they still fail with a Bundler or boot error:
 
@@ -434,3 +371,4 @@ nvimMcpServer:update_buffer project_name: "your-project" file_path: "/full/path/
 - You need to read/analyze project files
 - You need Rails-specific analysis (models, routes, schema)
 - The file isn't open in Neovim
+```

data/docs/COPILOT_AGENT.md

@@ -29,7 +29,7 @@ Create `.github/copilot/mcp.json` in your repository:
       "type": "local",
       "command": "rails-mcp-server",
       "args": ["--single-project"],
-      "tools": ["switch_project", "search_tools", "execute_tool", "execute_ruby"]
+      "tools": ["switch_project", "search_tools", "execute_tool"]
     }
   }
 }
@@ -133,7 +133,6 @@ GitHub Copilot Agent only supports MCP **tools**. The following are available:
 | `switch_project` | Change active project (optional in single-project mode) |
 | `search_tools` | Discover available analyzers |
 | `execute_tool` | Invoke internal analyzers |
-| `execute_ruby` | Run sandboxed Ruby code |
 
 ### Internal Analyzers (via `execute_tool`)
 
@@ -171,7 +170,7 @@ The `load_guide` analyzer requires guides to be downloaded. To include guides:
 
 ### Network Restrictions
 
-GitHub Copilot Agent runs in a sandboxed environment with firewall restrictions. The MCP server has read-only access to the repository.
+GitHub Copilot Agent runs in a sandboxed environment with firewall restrictions. The MCP server is used here to inspect the repository and runs with the permissions of that agent environment. It exposes a fixed set of introspection tools and does not execute caller-supplied Ruby; the tools that boot the app run the project's environment, so use it with repositories you trust.
 
 ## Troubleshooting
 
@@ -205,7 +204,7 @@ Here's a complete example for a typical Rails project:
       "type": "local",
       "command": "rails-mcp-server",
       "args": ["--single-project"],
-      "tools": ["switch_project", "search_tools", "execute_tool", "execute_ruby"]
+      "tools": ["switch_project", "search_tools", "execute_tool"]
     }
   }
 }

data/exe/rails-mcp-server

@@ -83,15 +83,13 @@ RailsMcpServer.log(:info, "Starting Rails MCP Server in #{mode} mode...")
 # Workflow:
 #   1. switch_project  - Select a Rails project to work with
 #   2. search_tools    - Discover available tools and their parameters
-#   3. execute_tool    - Invoke internal tools by name
-#   4. execute_ruby    - Run custom Ruby code for complex queries
+#   3. execute_tool    - Invoke internal introspection tools by name
 #
 def setup_mcp_tools(server)
   server.register_tools(
     RailsMcpServer::SwitchProject,
     RailsMcpServer::SearchTools,
-    RailsMcpServer::ExecuteTool,
-    RailsMcpServer::ExecuteRuby
+    RailsMcpServer::ExecuteTool
   )
 
   server.register_resources(

data/lib/rails-mcp-server/tools/switch_project.rb

@@ -21,15 +21,12 @@ module RailsMcpServer
 
       Quick Start:
       • Get project overview:  execute_tool("project_info")
-      • Read a file:           execute_ruby("puts read_file('config/routes.rb')")
-      • Find files:            execute_ruby("puts Dir.glob('app/models/*.rb').join('\\n')")
+      • Read a file:           execute_tool("get_file", { path: "config/routes.rb" })
+      • Find files:            execute_tool("list_files", { pattern: "app/models/*.rb" })
       • Analyze models:        execute_tool("analyze_models", { model_name: "User" })
       • Get routes:            execute_tool("get_routes")
       • Get schema:            execute_tool("get_schema", { table_name: "users" })
       • Search available tools: search_tools()
-
-      Helpers in execute_ruby: read_file(path), file_exists?(path), list_files(pattern), project_root
-      Note: Always use `puts` in execute_ruby to see output.
     GUIDE
 
     def call(project_name:)

data/lib/rails-mcp-server/version.rb

@@ -1,3 +1,3 @@
 module RailsMcpServer
-  VERSION = "1.6.0"
+  VERSION = "2.0.0"
 end

data/lib/rails_mcp_server.rb

@@ -12,7 +12,6 @@ require_relative "rails-mcp-server/tools/base_tool"
 require_relative "rails-mcp-server/tools/switch_project"
 require_relative "rails-mcp-server/tools/search_tools"
 require_relative "rails-mcp-server/tools/execute_tool"
-require_relative "rails-mcp-server/tools/execute_ruby"
 
 # Analyzers (internal, invoked via execute_tool)
 require_relative "rails-mcp-server/analyzers/base_analyzer"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-mcp-server
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Mario Alberto Chávez Cárdenas
@@ -218,7 +218,6 @@ files:
 - lib/rails-mcp-server/resources/turbo_guides_resource.rb
 - lib/rails-mcp-server/resources/turbo_guides_resources.rb
 - lib/rails-mcp-server/tools/base_tool.rb
-- lib/rails-mcp-server/tools/execute_ruby.rb
 - lib/rails-mcp-server/tools/execute_tool.rb
 - lib/rails-mcp-server/tools/get_model.rb
 - lib/rails-mcp-server/tools/search_tools.rb

data/lib/rails-mcp-server/tools/execute_ruby.rb

@@ -1,586 +0,0 @@
-module RailsMcpServer
-  class ExecuteRuby < BaseTool
-    tool_name "execute_ruby"
-
-    description <<~DESC
-      Execute read-only Ruby code in the context of the Rails project. Use this for:
-      - Complex queries that would require multiple tool calls
-      - Filtering/transforming data before returning
-      - Custom exploration of the codebase
-
-      RESTRICTIONS:
-      - Cannot create, modify, or delete files
-      - Cannot read .env, credentials, key files, or .gitignore'd files
-      - Cannot access files outside the project directory (read-only system data
-        such as timezone files under /usr/share/zoneinfo is allowed)
-      - Cannot execute shell commands or system calls
-      - Database writes run inside a transaction that is always rolled back, so
-        treat this as read-only for data too (note: DDL may still commit on some
-        adapters, and after_commit callbacks do not fire)
-
-      HELPER METHODS AVAILABLE:
-      - read_file(path) - safely read a file
-      - file_exists?(path) - check if file exists (false for sensitive files)
-      - list_files(pattern) - glob files safely, e.g., list_files('app/models/**/*.rb')
-      - project_root - returns the project root path
-
-      NOTE: Use `puts` to see output, e.g., puts read_file('Gemfile')
-
-      Some dual-use constructs (Kernel#open, send, public_send, const_get) are
-      not run immediately: the tool returns a CONFIRMATION REQUIRED message
-      explaining the risk. Re-invoke with confirm_risky: true only after the
-      user has reviewed the code and approved it.
-    DESC
-
-    arguments do
-      required(:code).filled(:string).description("Ruby code to execute (read-only operations only)")
-      optional(:timeout).filled(:integer).description("Timeout in seconds. Default: 30, Max: 60")
-      optional(:confirm_risky).filled(:bool).description("Set true ONLY after the user has explicitly approved running code that uses sandbox-bypass-capable constructs (send, public_send, const_get, Kernel#open). When false/absent, such code is not executed; the tool returns a CONFIRMATION REQUIRED message instead.")
-    end
-
-    # Patterns that indicate dangerous operations
-    FORBIDDEN_PATTERNS = [
-      # File/IO writing
-      /File\.(write|open|new)\s*\([^)]*['"][wa+]/i,
-      /File\.(delete|unlink|rename|chmod|chown|truncate)/i,
-      /FileUtils\./i,
-      /IO\.(write|syswrite|popen|pipe)/i,
-      /\.(write|puts|print|syswrite)\s*[(\s]/,
-
-      # Directory modification
-      /Dir\.(mkdir|rmdir|delete|chdir)/i,
-
-      # System/shell execution
-      /system\s*[(\s]/,
-      /exec\s*[(\s]/,
-      /`[^`]+`/,
-      /%x[{(\[]/,
-      /Kernel\.(system|exec|spawn|`)/,
-      /Open3\./i,
-      /IO\.popen/i,
-      /Process\.(spawn|exec|fork)/i,
-      /Shellwords/i,
-
-      # Network access
-      /Net::(HTTP|FTP|SMTP)/i,
-      /URI\.(open|parse)/i,
-      /HTTParty/i,
-      /Faraday/i,
-      /RestClient/i,
-      /open-uri/i,
-      /Socket/i,
-      /TCPSocket/i,
-      /UDPSocket/i,
-
-      # Dangerous Ruby features
-      /eval\s*[(\s]/,
-      /instance_eval/i,
-      /class_eval/i,
-      /module_eval/i,
-      /define_method/i,
-      /send\s*[(\s]+[:'"]*(system|exec|`)/i,
-      /__send__/,
-      /ObjectSpace/i,
-      /Binding/i,
-      /set_trace_func/i,
-
-      # Environment/credentials access
-      # Match any ENV usage (ENV[, ENV.fetch, ENV.to_h, ENV.values_at, ENV.each,
-      # ...). Case-sensitive so it doesn't flag `Rails.env` or a local `env`.
-      /\bENV\b/,
-      /Rails\.application\.credentials/i,
-      /Rails\.application\.secrets/i,
-
-      # Load/require that could execute arbitrary code
-      /load\s*[(\s]+[^)]*\$/i,
-      /require\s+[^'"]/i
-    ].freeze
-
-    # Dual-use constructs that are NOT hard-blocked (they have legitimate
-    # read-only uses) but can defeat the static safety scan, so running them
-    # requires explicit user confirmation via confirm_risky: true.
-    # Each entry: [pattern, label, why-it-is-risky].
-    CONFIRMATION_REQUIRED_PATTERNS = [
-      [/(?<![.\w])open\s*\(/, "Kernel#open",
-        "`open(arg)` runs a shell command when arg begins with '|', and can open network/URI targets — both escape the sandbox."],
-      [/\bpublic_send\b/, "public_send",
-        "dynamic dispatch can invoke methods the static scan cannot see, e.g. reaching blocked system/file APIs indirectly."],
-      [/\bsend\s*[(\s]/, "send",
-        "dynamic dispatch can invoke methods the static scan cannot see, e.g. reaching blocked system/file APIs indirectly."],
-      [/\bconst_get\b/, "const_get",
-        "resolves constants by name at runtime, which can reach classes the static scan would otherwise block."]
-    ].freeze
-
-    # Sensitive file patterns (in addition to .gitignore)
-    SENSITIVE_PATTERNS = [
-      /\.env(\..*)?$/i,
-      /\.key$/i,
-      /\.pem$/i,
-      /\.crt$/i,
-      /\.p12$/i,
-      /credentials\.yml/i,
-      /secrets\.yml/i,
-      /master\.key/i,
-      /config\/credentials/i,
-      /config\/secrets/i,
-      /\.secret$/i,
-      /password/i,
-      /\.ssh\//i,
-      /id_rsa/i,
-      /id_ed25519/i
-    ].freeze
-
-    # Read-only system data directories the sandbox may read. TZInfo lazily
-    # loads IANA timezone data on first Time.zone use; these are its default
-    # search paths plus /var/db/timezone, the real location behind macOS's
-    # /usr/share/zoneinfo symlink. Writes remain blocked by the File/Dir/
-    # FileUtils overrides.
-    ALLOWED_READ_PATHS = %w[
-      /usr/share/zoneinfo
-      /usr/share/lib/zoneinfo
-      /etc/zoneinfo
-      /var/db/timezone
-    ].freeze
-
-    NO_OUTPUT_MESSAGE = <<~MSG
-      Code executed successfully (no output).
-
-      Hint: Use `puts` to see results, e.g.:
-        puts read_file('config/routes.rb')
-        puts User.count
-        puts Dir.glob('app/models/*.rb')
-    MSG
-
-    def call(code:, timeout: 30, confirm_risky: false)
-      unless current_project
-        return "No active project. Please switch to a project first."
-      end
-
-      timeout = [timeout.to_i, 60].min # Cap at 60 seconds
-      timeout = 10 if timeout < 1
-
-      # Step 1: Static analysis - reject outright-dangerous code
-      validation_error = validate_code_safety(code)
-      return validation_error if validation_error
-
-      # Step 2: Dual-use constructs require explicit user confirmation
-      unless confirm_risky
-        confirmation = confirmation_required(code)
-        return confirmation if confirmation
-      end
-
-      # Step 3: Build the sandboxed execution environment
-      sandbox_code = build_sandbox(code)
-
-      # Step 4: Execute with timeout
-      execute_sandboxed(sandbox_code, timeout)
-    end
-
-    private
-
-    def validate_code_safety(code)
-      FORBIDDEN_PATTERNS.each do |pattern|
-        if code.match?(pattern)
-          return "REJECTED: Code contains forbidden pattern (#{pattern.source.split("\\").first}...). " \
-                 "This tool only allows read-only operations."
-        end
-      end
-      nil
-    end
-
-    # Returns a message asking the model to confirm with the user when the code
-    # uses dual-use constructs, or nil when there is nothing to confirm.
-    def confirmation_required(code)
-      matched = CONFIRMATION_REQUIRED_PATTERNS.select { |pattern, _label, _reason| code.match?(pattern) }
-      return nil if matched.empty?
-
-      details = matched.map { |_pattern, label, reason| "  - `#{label}`: #{reason}" }.join("\n")
-
-      <<~MSG
-        CONFIRMATION REQUIRED: This code uses constructs that can bypass the sandbox's static safety checks:
-
-        #{details}
-
-        These are not blocked outright because they have legitimate read-only uses, but they can reach APIs the safety scan would otherwise stop. Ask the user to review the code and confirm they want to run it. If they approve, re-invoke execute_ruby with confirm_risky: true. Do not set confirm_risky yourself without the user's explicit approval.
-      MSG
-    end
-
-    def build_sandbox(user_code)
-      gitignore_patterns = parse_gitignore
-      all_patterns = SENSITIVE_PATTERNS.map(&:source) + gitignore_patterns
-      sensitive_patterns_ruby = all_patterns.map { |p| "Regexp.new(#{p.inspect}, Regexp::IGNORECASE)" }.join(",\n      ")
-
-      <<~RUBY
-        require "stringio" # the File.open override below yields StringIO objects
-
-        # Sandbox wrapper for safe execution
-        module McpSandbox
-          # realpath-normalized so symlink resolution below compares against the
-          # canonical root (e.g. macOS /var -> /private/var) rather than a path
-          # that would never prefix-match a resolved target.
-          PROJECT_ROOT = File.realpath(#{active_project_path.inspect}).freeze
-
-          ALLOWED_READ_PATHS = #{ALLOWED_READ_PATHS.inspect}.freeze
-
-          # realpath-resolved forms of the allowlist, so a resolved target still
-          # matches when the allowed dir is itself a symlink (e.g. macOS
-          # /usr/share/zoneinfo -> /private/var/db/timezone/.../zoneinfo).
-          CANONICAL_ALLOWED_READ_PATHS = ALLOWED_READ_PATHS.map { |dir|
-            File.exist?(dir) ? File.realpath(dir) : dir
-          }.freeze
-
-          SENSITIVE_PATTERNS = [
-            #{sensitive_patterns_ruby}
-          ].freeze
-
-          # Native method handles captured *before* the File/Dir overrides below
-          # replace them. Held in private constants so sandboxed user code has no
-          # public `File.original_read`-style alias to call the raw method back.
-          ORIGINAL_FILE_READ      = File.method(:read)
-          ORIGINAL_FILE_READLINES = File.method(:readlines)
-          ORIGINAL_FILE_BINREAD   = File.method(:binread)
-          ORIGINAL_FILE_EXIST     = File.method(:exist?)
-          ORIGINAL_FILE_DIRECTORY = File.method(:directory?)
-          ORIGINAL_FILE_FILE      = File.method(:file?)
-          ORIGINAL_FILE_REALPATH  = File.method(:realpath)
-          ORIGINAL_DIR_GLOB       = Dir.method(:glob)
-          ORIGINAL_DIR_ENTRIES    = Dir.method(:entries)
-          private_constant :ORIGINAL_FILE_READ, :ORIGINAL_FILE_READLINES,
-            :ORIGINAL_FILE_BINREAD, :ORIGINAL_FILE_EXIST, :ORIGINAL_FILE_DIRECTORY,
-            :ORIGINAL_FILE_FILE, :ORIGINAL_FILE_REALPATH, :ORIGINAL_DIR_GLOB,
-            :ORIGINAL_DIR_ENTRIES
-
-          class PathViolation < StandardError; end
-          class SensitiveFileViolation < StandardError; end
-          class WriteViolation < StandardError; end
-
-          module_function
-
-          # Resolve symlinks so a link *inside* the project cannot be used to
-          # read a target outside it. realpath needs the path to exist, so for a
-          # not-yet-existing path resolve the deepest existing ancestor and
-          # re-append the remainder (which still catches a symlinked ancestor).
-          def resolve_symlinks(expanded)
-            return ORIGINAL_FILE_REALPATH.call(expanded) if ORIGINAL_FILE_EXIST.call(expanded)
-
-            parent = File.dirname(expanded)
-            return expanded if parent == expanded
-
-            File.join(resolve_symlinks(parent), File.basename(expanded))
-          end
-
-          def validate_path!(path)
-            expanded = File.expand_path(path, PROJECT_ROOT)
-            resolved = resolve_symlinks(expanded)
-
-            if (ALLOWED_READ_PATHS + CANONICAL_ALLOWED_READ_PATHS).any? { |dir| resolved == dir || resolved.start_with?(dir + "/") }
-              return resolved
-            end
-
-            unless resolved.start_with?(PROJECT_ROOT + "/") || resolved == PROJECT_ROOT
-              raise PathViolation, "Access denied: path '\#{path}' is outside project directory"
-            end
-
-            relative_path = resolved.sub(PROJECT_ROOT + "/", "")
-
-            SENSITIVE_PATTERNS.each do |pattern|
-              if relative_path.match?(pattern)
-                raise SensitiveFileViolation, "Access denied: '\#{relative_path}' matches sensitive file pattern"
-              end
-            end
-
-            resolved
-          end
-
-          def safe_read(path)
-            ORIGINAL_FILE_READ.call(validate_path!(path))
-          end
-
-          def safe_readlines(path)
-            ORIGINAL_FILE_READLINES.call(validate_path!(path))
-          end
-
-          def safe_binread(path)
-            ORIGINAL_FILE_BINREAD.call(validate_path!(path))
-          end
-
-          def safe_foreach(path, &block)
-            lines = safe_readlines(path)
-            return lines.each unless block
-
-            lines.each(&block)
-          end
-
-          def safe_exist?(path)
-            ORIGINAL_FILE_EXIST.call(validate_path!(path))
-          rescue PathViolation, SensitiveFileViolation
-            false
-          end
-
-          def safe_directory?(path)
-            ORIGINAL_FILE_DIRECTORY.call(validate_path!(path))
-          rescue PathViolation, SensitiveFileViolation
-            false
-          end
-
-          def safe_file?(path)
-            ORIGINAL_FILE_FILE.call(validate_path!(path))
-          rescue PathViolation, SensitiveFileViolation
-            false
-          end
-
-          def safe_glob(pattern, base: PROJECT_ROOT)
-            ORIGINAL_DIR_GLOB.call(File.join(base, pattern)).select do |path|
-              validate_path!(path)
-              true
-            rescue PathViolation, SensitiveFileViolation
-              false
-            end
-          end
-
-          def safe_entries(path)
-            ORIGINAL_DIR_ENTRIES.call(validate_path!(path)).reject { |e| e.start_with?(".") }
-          end
-
-          # True only when ActiveRecord is loaded *and* a connection can be
-          # obtained, so we never turn a pure-Ruby read-only snippet into a
-          # database connection error just to wrap it in a transaction.
-          def database_available?
-            return false unless defined?(ActiveRecord::Base)
-
-            ActiveRecord::Base.connection
-            true
-          rescue StandardError
-            false
-          end
-
-          # Run the block inside a transaction that is *always* rolled back, so
-          # accidental writes are undone. Harm reduction, not a guarantee: DDL
-          # auto-commits on some adapters (e.g. MySQL) and after_commit
-          # callbacks are suppressed. Falls back to a plain call when no
-          # database is available. Real exceptions still propagate (and also
-          # trigger the rollback).
-          def readonly_guard
-            return yield unless database_available?
-
-            result = nil
-            ActiveRecord::Base.transaction do
-              result = yield
-              raise ActiveRecord::Rollback
-            end
-            result
-          end
-        end
-
-        # Override File class methods
-        class File
-          class << self
-            def read(path, *args)
-              McpSandbox.safe_read(path)
-            end
-
-            def readlines(path, *args)
-              McpSandbox.safe_readlines(path)
-            end
-
-            def binread(path, *args)
-              McpSandbox.safe_binread(path)
-            end
-
-            def foreach(path, *args, &block)
-              McpSandbox.safe_foreach(path, &block)
-            end
-
-            def exist?(path)
-              McpSandbox.safe_exist?(path)
-            end
-
-            def directory?(path)
-              McpSandbox.safe_directory?(path)
-            end
-
-            def file?(path)
-              McpSandbox.safe_file?(path)
-            end
-
-            # Block all write operations
-            [:write, :delete, :unlink, :rename, :chmod, :chown, :truncate].each do |method|
-              define_method(method) do |*args, &block|
-                raise McpSandbox::WriteViolation, "Write operations are not permitted: File.\#{method}"
-              end
-            end
-
-            # Handle open specially - allow read-only mode
-            def open(path, mode = "r", *args, &block)
-              if mode.to_s =~ /[wa+]/
-                raise McpSandbox::WriteViolation, "Write operations are not permitted: File.open with mode '\#{mode}'"
-              end
-              content = McpSandbox.safe_read(path)
-              if block_given?
-                yield StringIO.new(content)
-              else
-                StringIO.new(content)
-              end
-            end
-          end
-        end
-
-        # Override Dir class methods
-        class Dir
-          class << self
-            def glob(pattern, *args)
-              McpSandbox.safe_glob(pattern)
-            end
-
-            def entries(path)
-              McpSandbox.safe_entries(path)
-            end
-
-            [:mkdir, :rmdir, :delete, :chdir].each do |method|
-              define_method(method) do |*args|
-                raise McpSandbox::WriteViolation, "Directory modifications are not permitted: Dir.\#{method}"
-              end
-            end
-          end
-        end
-
-        # Override IO read entry points. File < IO, but IO.read / IO.readlines /
-        # IO.binread / IO.foreach are separate class methods that bypass the File
-        # overrides above, so they must be sandboxed independently.
-        class IO
-          class << self
-            def read(path, *args)
-              McpSandbox.safe_read(path)
-            end
-
-            def readlines(path, *args)
-              McpSandbox.safe_readlines(path)
-            end
-
-            def binread(path, *args)
-              McpSandbox.safe_binread(path)
-            end
-
-            def foreach(path, *args, &block)
-              McpSandbox.safe_foreach(path, &block)
-            end
-          end
-        end
-
-        # Block FileUtils entirely
-        if defined?(FileUtils)
-          module FileUtils
-            class << self
-              def method_missing(method, *args)
-                raise McpSandbox::WriteViolation, "FileUtils operations are not permitted"
-              end
-            end
-          end
-        end
-
-        # Block system calls at Kernel level
-        module Kernel
-          def system(*args)
-            raise McpSandbox::WriteViolation, "System calls are not permitted"
-          end
-
-          def exec(*args)
-            raise McpSandbox::WriteViolation, "System calls are not permitted"
-          end
-
-          def spawn(*args)
-            raise McpSandbox::WriteViolation, "System calls are not permitted"
-          end
-
-          def `(cmd)
-            raise McpSandbox::WriteViolation, "Shell execution is not permitted"
-          end
-        end
-
-        # Block backticks at Object level
-        class Object
-          def `(cmd)
-            raise McpSandbox::WriteViolation, "Shell execution is not permitted"
-          end
-        end
-
-        # Provide convenient aliases for sandboxed operations
-        def read_file(path)
-          McpSandbox.safe_read(path)
-        end
-
-        def file_exists?(path)
-          McpSandbox.safe_exist?(path)
-        end
-
-        def list_files(pattern)
-          McpSandbox.safe_glob(pattern)
-        end
-
-        def project_root
-          McpSandbox::PROJECT_ROOT
-        end
-
-        # ============ USER CODE BELOW ============
-        # Wrapped in an always-rolled-back transaction so accidental DB writes
-        # (delete_all, update, save, raw DML) are undone. See McpSandbox
-        # .readonly_guard for the caveats; it's a no-op without a database.
-        begin
-          McpSandbox.readonly_guard do
-            #{user_code}
-          end
-        rescue McpSandbox::PathViolation => e
-          puts "PATH ERROR: \#{e.message}"
-        rescue McpSandbox::SensitiveFileViolation => e
-          puts "ACCESS DENIED: \#{e.message}"
-        rescue McpSandbox::WriteViolation => e
-          puts "WRITE ERROR: \#{e.message}"
-        rescue => e
-          puts "ERROR: \#{e.class} - \#{e.message}"
-        end
-      RUBY
-    end
-
-    def parse_gitignore
-      gitignore_path = File.join(active_project_path, ".gitignore")
-      return [] unless File.exist?(gitignore_path)
-
-      File.readlines(gitignore_path)
-        .map(&:strip)
-        .reject { |line| line.empty? || line.start_with?("#") } # rubocop:disable Performance/ChainArrayAllocation
-        .map { |pattern| convert_gitignore_to_regex(pattern) } # rubocop:disable Performance/ChainArrayAllocation
-    end
-
-    def convert_gitignore_to_regex(pattern)
-      # Convert gitignore glob pattern to regex
-      regex = Regexp.escape(pattern)
-        .gsub('\*\*', ".*")           # ** matches everything
-        .gsub('\*', "[^/]*")          # * matches within directory
-        .gsub('\?', ".")              # ? matches single char
-        .gsub(/^\//, "^")             # Leading / anchors to root
-
-      # If pattern doesn't start with /, it can match anywhere
-      regex = "(?:^|/)" + regex unless pattern.start_with?("/")
-
-      regex
-    end
-
-    def execute_sandboxed(code, timeout)
-      require "tempfile"
-
-      Tempfile.create(["mcp_sandbox", ".rb"]) do |f|
-        f.write(code)
-        f.flush
-
-        # RunProcess enforces the timeout by killing the whole process group, so
-        # a runaway `rails runner` is actually terminated rather than orphaned.
-        result = RailsMcpServer::RunProcess.execute_rails_command(
-          active_project_path,
-          "bin/rails runner #{f.path} 2>&1",
-          timeout: timeout
-        )
-        result.to_s.empty? ? NO_OUTPUT_MESSAGE : result
-      end
-    end
-  end
-end