check_pins

Instructions

Implementation Reference

• bawbel_mcp/server.py:504-561 (handler)

  The check_pins function is the handler for the 'check_pins' tool. It runs 'bawbel check-pins' via subprocess, parses JSON output, and reports which pinned skill files have drifted (changed SHA-256 hashes).

  def check_pins(path: str = ".") -> str:
      """
      Check a directory for skill file rug pull drift.
  
      Compares current SHA-256 hashes of skill files against the pins
      stored in .bawbel-pins.json. Reports any files that changed after
      the last audit.
  
      Run bawbel pin <path> from the CLI to create the initial pin file.
  
      Args:
          path: Directory to check (default: current directory)
      """
      result = subprocess.run(  # nosec B603  # noqa: S603
          ["bawbel", "check-pins", path, "--format", "json"],
          capture_output=True,
          text=True,
          timeout=30,
      )
  
      raw = result.stdout.strip()
      if not raw:
          stderr = result.stderr.strip()
          if "No pin file found" in stderr or result.returncode == 1:
              return (
                  f"No .bawbel-pins.json found in {path}.\n"
                  "Run 'bawbel pin <path>' from the CLI to create initial pins."
              )
          return stderr or "No output from pin check"
  
      try:
          data = json.loads(raw)
      except json.JSONDecodeError:
          return raw
  
      drifted = data.get("drifted", [])
      pinned = data.get("pinned_count", 0)
      status = data.get("status", "")
  
      if not drifted:
          return f"Clean: all {pinned} pinned files match their stored hashes."
  
      lines = [
          f"DRIFT DETECTED: {len(drifted)} of {pinned} files changed",
          "",
      ]
      for f in drifted:
          lines.append(f"  {f.get('file', '')}")
          lines.append(f"    Pinned:  {f.get('pinned_hash', '')[:16]}...")
          lines.append(f"    Current: {f.get('current_hash', '')[:16]}...")
          lines.append("")
  
      lines.append(
          "Action: review the changed files with 'bawbel report <file>'. "
          "If safe, re-pin with 'bawbel pin --update <file>'."
      )
  
      return "\n".join(lines)

• bawbel_mcp/server.py:503-503 (registration)

  The @mcp.tool() decorator registers check_pins as an MCP tool on the FastMCP instance named 'Bawbel Scanner'.

  @mcp.tool()

• bawbel_mcp/server.py:504-516 (schema)

  The schema for check_pins is defined by the function signature and docstring. It takes one optional string parameter 'path' (default '.') representing the directory to check.

  def check_pins(path: str = ".") -> str:
      """
      Check a directory for skill file rug pull drift.
  
      Compares current SHA-256 hashes of skill files against the pins
      stored in .bawbel-pins.json. Reports any files that changed after
      the last audit.
  
      Run bawbel pin <path> from the CLI to create the initial pin file.
  
      Args:
          path: Directory to check (default: current directory)
      """