P3-18 / security LOW-3: the run_applescript MCP tool MUST be registered
with requiresConfirmation: true so the HUD's confirmation panel gates
every AppleScript execution. Today the production registration lives
in App/MCP/MCPRuntimeWiring.swift:119 and is exercised by
MCPRuntimeWiringTests, but a grep gate adds defense in depth — every
line of source is covered, not just the path the test exercises.
Detection:
For each non-comment, non-test line containing the literal
`run_applescript`, walk down up to 5 lines (until the next `)` —
the close of the enclosing register call), accumulate the call body,
and assert requiresConfirmation: true is present. The window
terminates early at the closing paren so a sibling register block
with the flag set differently can't leak in via overlap.
Verified the gate catches a regression: temporarily flipped line 119
to `requiresConfirmation: false` — gate FAILed with the file:line
citation. Reverted; gate PASSes on clean tree.
Comment-only references to run_applescript (HudStateIntent.swift:19,
InProcessTool.swift:9) are filtered by is_comment_line, so they don't
trigger false positives.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
