MCP Codebase Tool Bug Returns Wrong Function Data With No Error Signal

·1 views

A developer discovered a silent bug in an MCP codebase-intelligence server after a reader described unexpected behavior in a similar tool. When queried about a function, the server returned data for a shadow definition in an experiments folder instead of the real one in src, because the lookup used a first-match search on function name alone. Unlike previously fixed issues involving stale data (issue #102) or failed source reads (issue #101), this flaw — logged as issue #103 — returns fully valid, fresh, correctly sourced data, just for the wrong candidate. The core problem is that the lookup destroys evidence a choice was made at all, meaning no metadata flag can reliably warn the caller that an ambiguous match occurred. The fix requires scoping lookups to file-qualified node IDs rather than relying on name matching alone.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build a Private AI Codebook Generator Using Mistral and FastAPI

A new tutorial from Gate of AI outlines a privacy-focused qualitative research workflow using Mistral Small 3.1, Ollama, and FastAPI to help researchers generate thematic codebook entries from interview or survey data. The guide is designed for teams handling sensitive text who require greater control than cloud-based tools typically allow. Mistral Small 3.1 is a 24-billion-parameter model that also served as the parent for the Ministral 3 family through pruning and distillation. The tutorial is explicitly framed as a planning blueprint rather than a ready-to-run deployment, cautioning developers to verify model identifiers, API endpoints, and hardware requirements against official documentation before writing production code. It also stresses that while local AI can propose candidate codes and organize excerpts, it cannot independently validate research conclusions or establish causality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Most Proptech AI Pilots Fail Before Reaching Production

AI adoption in property management rose sharply from 20% to 58%, yet only 8% of processes are fully automated, and a 2025 MIT report found 95% of generative AI pilots generated no profit. In commercial real estate, 92% of firms ran an AI pilot but just 5% met all their goals, a gap engineers attribute to structural flaws rather than model quality. Pilots typically run against clean, sandboxed data, while production systems require authentication boundaries, audit trails, and write paths back into legacy systems — none of which most pilots account for. Key barriers include change management (76%), data integrity failures from unpopulated schema fields (49%), and legacy system limitations (28%), with integration described as the core challenge since 73% of proptech tools must connect to pre-existing infrastructure. Engineers recommend resolving read and write paths, entity resolution, and identity models before signing vendor contracts, and favour a read-replica architecture that defers writes to a later phase.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Backdoored npm Packages Used Bun Runtime to Steal Secrets and Self-Propagate

On November 24, 2025, security researchers identified hundreds of backdoored npm packages that silently downloaded the Bun JavaScript runtime during installation to evade standard Node.js monitoring tools. The malicious packages, found under well-known scopes including Zapier, Postman, and PostHog, used a preinstall hook to fetch Bun and execute a heavily obfuscated payload in the background. The payload deployed TruffleHog to scan for credentials, queried cloud metadata services on AWS, Azure, and Google Cloud, and exfiltrated stolen data to GitHub repositories created in victims' own accounts. Using stolen npm tokens, the worm then injected itself into up to 100 of each compromised maintainer's packages and republished them, effectively spreading itself further. Datadog reported over 796 backdoored packages affecting more than 500 GitHub users and 150 organisations, while Socket placed the count at over 500 packages, with the last known malicious publish recorded at 6 p.m. UTC on November 24.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Ways to Convert a Char to String in Java: Performance and Trade-offs

In Java, converting a primitive char to a String object is a common task that can affect performance and memory usage, particularly inside high-frequency loops. The three standard methods are Character.toString(char), String.valueOf(char), and the concatenation shorthand "" + char, each with distinct readability and memory characteristics. Character.toString() is explicit and readable, while String.valueOf() is widely recommended for general primitive-to-string conversions. The concatenation approach is quick to write but may generate garbage collector pressure in intensive iterative operations. Understanding how the JVM allocates memory differently for stack-based primitives and heap-based String objects helps developers choose the most appropriate method for their use case.

0 comments Read more at DEV Community