chore(facts): waive a disclosure false positive on the troubleshooting env-var reference

[yakimoto]

User description

The new disclosure gate (wave-av/wave-context#157) flags an environment-variable name appearing near a state verb, because that pattern is how deployed configuration state leaks into published content.

Here it is a false positive, and worth recording rather than silencing: the README's troubleshooting section tells the reader to check their own environment. The variable belongs to the person installing the MCP server; it says nothing about any WAVE deployment.

Waivers are scoped to rule and match together, so this excuses exactly this identifier and cannot quietly cover a genuine deployed value added later. The finding stays printed on every run — only the exit code ignores it, so the exception cannot outlive its justification unnoticed.

Unrelated, and not addressed here

This repo already fails the policy gate on a pre-existing disallowed-url finding — an npm link outside the @wave-av scope — which predates this change and this PR does not touch. Flagging it so it is not mistaken for fallout from the new gate.

---

---

Note

Low Risk
Config-only changes to waiver metadata and description; no application or security logic is modified.

Overview
Updates .wave/repo.json so WAVE facts/disclosure gates can pass with documented exceptions.

Adds a description string for the MCP server package metadata. Introduces policyWaivers for www.npmjs.com/package/@anthropic-ai so README links to the Claude Agent SDK install package are allowed without tripping disallowed-url rules. Adds disclosureWaivers for rule config-state with match WAVE_API_KEY, documenting that troubleshooting’s echo $WAVE_API_KEY refers to the installer’s env, not deployed WAVE config.

^{Reviewed by Cursor Bugbot for commit d8672f7. Configure here.}

Note

Waive WAVE_API_KEY disclosure false positive in WAVE repo scan config

Adds a disclosureWaivers entry in repo.json to suppress a false positive triggered by the WAVE_API_KEY environment variable reference used in troubleshooting docs. Also adds a policyWaivers entry for the @anthropic-ai npm package path and a project description string.

^{Macroscope summarized d8672f7.}

Summary by Sourcery

Enhancements:

• Document repository policy and disclosure exceptions for known false positives in WAVE scanning.

---

CodeAnt-AI Description

Clarify the MCP server’s package description and document narrowly scoped policy exceptions

What Changed

• Adds a clear package description explaining that the server exposes WAVE media APIs to Claude Code, Cursor, and Windsurf over MCP
• Allows the documented @anthropic-ai package link while continuing to flag unrelated npm links
• Records the troubleshooting environment-variable example as an intentional exception without hiding other configuration disclosures

Impact

✅ Clearer package information
✅ Fewer false-positive policy failures
✅ Unrelated links and disclosures remain reportable

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7972715e-2a59-4988-a6f4-a4a35461e615)

[coderabbitai]

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 97 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 7aa35e8a-bfd0-463f-ab5e-495ee78ab18b

📥 Commits

Reviewing files that changed from the base of the PR and between abf02f1 and 23b2dea.

📒 Files selected for processing (1)

• .wave/repo.json

---

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

PR Summary by Qodo

Waive disclosure gate false positive for README troubleshooting env var

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Add a narrowly-scoped disclosure waiver for config-state matching WAVE_API_KEY.
• Document why this match is a false positive (reader-owned env var in troubleshooting).
• Keep the finding visible while preventing it from failing the policy gate exit code.

Diagram

graph TD
  G["Disclosure policy gate"] --> R["README.md content"] --> D{"Waiver match?"} --> X["Fail build"]
  G --> F[".wave/repo.json"] --> W["disclosureWaivers"] --> D
  D --> P["Pass (exit 0)"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Rewrite troubleshooting docs to avoid the env-var identifier

• ➕ Eliminates the triggering pattern without policy exceptions
• ➕ Keeps policy signal-to-noise high by avoiding waivers
• ➖ Degrades troubleshooting clarity for users
• ➖ Does not address other legitimate mentions of required env vars in docs

2. Fix/tune the disclosure rule upstream (heuristic improvement)

• ➕ Reduces false positives across all repos using the gate
• ➕ Avoids accumulating repo-specific waivers over time
• ➖ Higher effort and longer lead time than a repo-local waiver
• ➖ May still require waivers for edge cases even after tuning

3. Add a more specific suppression mechanism (e.g., per-file/section suppression)

• ➕ More granular than rule+match when the same token is used legitimately elsewhere
• ➕ Can keep the gate strict while allowing targeted documentation patterns
• ➖ Adds complexity to the policy system and its configuration model
• ➖ Requires tooling/support work beyond this repo

Recommendation: The current approach (rule+match-scoped waiver with an explicit reason) is the best tradeoff here: it preserves clear user-facing troubleshooting guidance, prevents this known false positive from failing CI, and remains narrowly bounded so it can’t silently excuse future genuine disclosure regressions.

Files changed (1) +7 / -0

Other (1) +7 / -0

repo.jsonAdd disclosure waiver for 'config-state'/'WAVE_API_KEY' false positive +7/-0

Add disclosure waiver for 'config-state'/'WAVE_API_KEY' false positive

• Introduces a 'disclosureWaivers' section that waives the 'config-state' rule when matching 'WAVE_API_KEY'. Includes a detailed rationale explaining the reference is user-owned troubleshooting guidance ('echo $WAVE_API_KEY') rather than deployed WAVE configuration state.

.wave/repo.json

[qodo-code-review]

Qodo Fixer

No findings are available for this PR yet. Findings appear here once Qodo has reviewed the PR.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR only changes repository metadata and scanning waivers, but the npm URL waiver covers every package under the @anthropic-ai scope rather than only the documented SDK package. That broader suppression of policy findings is a concrete security concern requiring human review.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ced9f66c-c50f-42f1-b612-55c456671cd0)

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	23b2dea	Sep 06, 2026 · 22:27	22:28

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b204a6db-405e-46c1-8d64-b7a4ac17c68f)

[codeant-ai]

Suggestion: pathPrefix covers every package under @anthropic-ai, so links to unrelated packages in that organization are silently exempted despite the waiver's narrower stated reason. [security]

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** .wave/repo.json
**Line:** 616:616
**Comment:**
	*Security: `pathPrefix` covers every package under `@anthropic-ai`, so links to unrelated packages in that organization are silently exempted despite the waiver's narrower stated reason.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎