[uk-ai-resilience] Untracked go/allocation-size-overflow alert #678 in mcp_cli_mount.go — sibling of #59773 (Tier C) #60876

Summary

CodeQL alert #678 (go/allocation-size-overflow, CWE-190, severity: high) in the MCP gateway config generator has no matching open tracking issue, breaking the classification → control-verification loop for this run's recent-changes scope (7-day lookback since 2026-09-07).

• Alert: #678 — pkg/workflow/mcp_cli_mount.go:378
• Created 2026-09-11; still open at time of this review.

This is the same finding class as sibling alerts #677/#676/#675 (mcp_setup_generator.go:146, mcp_github_config.go:84 x2), which are already tracked in open issue #59773 (Tier C) — but that issue does not cover mcp_cli_mount.go:378. This is now the 4th untracked instance of go/allocation-size-overflow in the MCP config-generation area.

Tier & risk-scoring

• Tier: C — Restricted Pending Review
• Exposure amplification: Low–Medium (feeds MCP container mount/config generation for agentic workflows; an overflow-triggered panic or undersized allocation could affect all generated MCP configs using this code path)
• Patchability: High
• Detectability: Medium (CodeQL catches it, but it isn't visible in the tracking-issue backlog, and the reconciliation gap with [uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C) #59773 shows sibling-alert tracking is incomplete)
• Operational fragility: Medium
• Ownership confidence: Low-Medium (repository CODEOWNERS is a single flat global rule with no path-specific reviewer for pkg/workflow/)

Remediation action

• Guard the size computation with a bounds check before use in the allocation at mcp_cli_mount.go:378, or widen the intermediate type (e.g., accumulate as uint64/int64 before converting to a slice length) — consistent with the fix pattern requested in [uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C) #59773 for the sibling files.
• Add a regression test exercising a large/edge-case input to confirm no panic or wraparound occurs.
• Consider addressing all four go/allocation-size-overflow instances ([Custom Engine Test] Test Issue Created by Custom Engine #675/[Custom Engine Test] Test Pull Request - Custom Engine Safe Output #676/Test Issue for Commands #677/E2E test status #678) together in one PR/fix pass, and update [uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C) #59773 to reference this issue to avoid future reconciliation drift.
• After fixing, verify the alert transitions to fixed/dismissed in code scanning before closing this issue.

SLA urgency

Critical — untracked, security-severity-"high" alert in actively-changed MCP config-generation code that is part of a recurring, partially-tracked finding class.

Related

• Sibling tracking issue (does not cover this alert): [uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C) #59773

Discussion report

See the "UK AI Governance: recent-change risk review (2026-09-07 to 2026-09-14)" discussion created by this run for full asset graph, control verification, and risk-scoring context.

Generated by UK AI Operational Resilience · copilot · auto · 82.3 AIC · ⌖ 8.97 AIC · ⊞ 8.2K · ◷