Security fixes target the latest stable @agentskit/doc-bridge release on npm.

Please do not open a public issue for security reports.

Use GitHub private vulnerability reporting when possible. If that channel is unavailable, email security@agentskit.io.

Include:

• affected version or commit
• reproduction steps
• impact
• any suggested fix

Please do not include secrets or private repository content beyond what is necessary to reproduce the issue. We aim to acknowledge a complete report within 14 days, investigate it, and coordinate disclosure and remediation with the reporter before publishing details.

• Core commands must work without sending repository content to a network service.
• MCP doc.get must only read indexed docs inside the project root.
• Optional intelligence features must stay opt-in and provider-controlled by the user.