🟢 #2 Cherry-pick upstream + post-merge code review fixes (security, dedup, MCP encryption) +7,005 -2,678 2mo ago self by
Lef-F ↗ analysis ↗ GitHub ## Summary
Lef-F/mike
Lef-F/mike: self-host stack, upstream security audit, and a jsonb bug fix
Lef-F has done more active development work than most forks in this catalog. Three distinct threads are visible.
The most substantial is a complete self-hosted deployment: docker-compose replacing Supabase Cloud and Cloudflare R2 with vanilla Postgres, GoTrue, PostgREST, Garage (S3), and Caddy - docker compose up on a single host with no managed services. The implementation is detailed and includes real first-boot debugging that surfaced non-obvious issues with Garage bootstrap and backend auth routing.
The second thread is a cherry-pick of eight upstream willchen96/mike PRs (OpenRouter, MCP Connectors, and six fixes) followed by a 13-commit code review of the merged tree. That review found four security gaps in the upstream-contributed code - SSRF in MCP URL handling, a missing RLS migration, a dev-secret fallback in the OAuth flow, and unbounded MCP tool output - plus eight application bugs and a round of deduplication work.
The third is a standalone backend bug fix: .contains() on a jsonb column was receiving a plain JS array instead of a JSON string, silently breaking project sharing for non-owners with a 500 error.
What's in it
- Single-command self-hosted stack A docker-compose setup that lets a firm run the full Mike stack on its own infrastructure without stitching services together by hand.
- Upstream-aware maintenance Lef-F pulls in batches of upstream pull requests and reviews the merged result, rather than tracking upstream blindly.
- Post-merge security audits After absorbing upstream changes, the fork gets a security pass to catch regressions that slipped in alongside the fixes.
- Shared-project reliability fix A bug that broke opening projects shared between colleagues has been tracked down and patched, with the fix shaped to go back upstream.
Direction
infrastructuresecurity
Activity
A complete self-hosted deployment stack so you can run Mike on one box, with no managed cloud services in the loop.
## Summary
If you shared a project with a colleague and they couldn't open it, this is why.
📝 Lef-F cherry-picks eight upstream PRs, then adds a 13-commit security and quality pass 0 commits — securityintegration draft
Lef-F pulled eight willchen96/mike PRs into the fork - six fixes plus OpenRouter and MCP Connectors - then ran a systematic code review of the merged tree that turned up four tier-one security gaps and eight more bugs.
Threads of work (detailed view)
Lef-F makes Mike run on a single server you own
A complete self-hosted deployment stack so you can run Mike on one box, with no managed cloud services in the loop.
Lef-F adds full docker-compose self-host stack: Postgres, GoTrue, PostgREST, Garage, Caddy
Lef-F replaced Supabase Cloud and Cloudflare R2 with a single-host docker-compose stack. Run `docker compose up` and you have the full service mesh with no external managed services.
Lef-F fixes the bug that quietly broke shared projects
If you shared a project with a colleague and they couldn't open it, this is why.
jsonb shared_with bug: .contains() was serializing the wrong format
Two call sites in the backend were passing a plain JS array to PostgREST's `.contains()` on a `jsonb` column. PostgreSQL rejected every request that hit the shared-with code path with a 500 error.
Lef-F cherry-picks eight upstream PRs, then adds a 13-commit security and quality pass
Lef-F pulled eight willchen96/mike PRs into the fork - six fixes plus OpenRouter and MCP Connectors - then ran a systematic code review of the merged tree that turned up four tier-one security gaps and eight more bugs.
Pull requests (detailed view)
🟢 Open (1)
by
Lef-F · opened 2mo ago ✅ Merged (1)
by
Lef-F · opened 2mo ago · merged 2mo ago by Lef-F