Matthew Goodman

fix(ecs-mcp-server): add path validation for user-supplied paths (#4480) Path validation only pattern-matched the raw string for "../" sequences, so an absolute path, a "~" prefix, or a symlink pointing at a user configuration directory was accepted. prepare_template_files also swallowed validation errors containing "does not exist", so a rejected path could still be created. Add a path_validation module, mirroring the one in eks-mcp-server, that expands "~", resolves paths with os.path.realpath, and rejects any path resolving inside or containing a sensitive directory (~/.aws, ~/.ssh, ~/.kube, ~/.gnupg, ~/.docker, /etc, /root, /var/lib). Relative paths stay supported, and the resolved absolute path is returned. Applied in prepare_template_files, build_and_push_image, and validate_cloudformation_template, replacing validate_file_path in utils/security.py. Co-authored-by: Matthew Goodman <mtgoo@amazon.com>

chore(ecs-mcp-server): stop tracking generated test template (#4501) tests/llm_testing/invalid_cfn_template.yaml is written at runtime by scenario 01 and removed again by that scenario's cleanup script, so running the documented workflow deletes a tracked file and leaves a dirty working tree. Nothing reads the tracked copy, and it had drifted from what the script generates, adding ClusterSettings and using long-form Ref instead of !Ref. Remove it and add a .gitignore so it stays out, matching the pattern already used by the sibling harness in tests/integ/mcp-inspector. Also correct the comment above the placeholder image: the scenario fails on the missing NetworkConfiguration in AWS::ECS::Service, before any image pull is attempted. Co-authored-by: Matthew Goodman <mtgoo@amazon.com>

chore(ecs-mcp-server): update CODEOWNERS (#4502) Trim the list to the engineers currently maintaining this package. Remove @guitar80ep, @lewisct and @tusharbabbar, and add @meseer. Co-authored-by: Matthew Goodman <mtgoo@amazon.com> Co-authored-by: Alex Dudarenko <mail4chemik@gmail.com>