Attio MCP Server

name: 'CodeQL Config for Attio MCP Server' disable-default-queries: false query-filters: # Suppress clear-text logging alerts for development/debug scripts - exclude: id: js/clear-text-logging paths: - '**/scripts/debug/**' - '**/scripts/setup-test-data.ts' - '**/test/**' - '**/tests/**' reason: 'Debug scripts and test files are development-only and do not handle production secrets' # Suppress clear-text logging alerts for development utilities that have been manually reviewed - exclude: id: js/clear-text-logging paths: - '**/src/utils/json-serializer.ts' - '**/src/utils/logger.ts' reason: 'Core utilities have been reviewed - they use structured logging without exposing secrets' paths: # Only analyze production code for security issues - 'src/**' - 'scripts/**' paths-ignore: # Exclude generated files and dependencies - 'node_modules/**' - 'dist/**' - 'build/**' - 'coverage/**'