chore(deps): update dependency octocode-mcp to v16

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
octocode-mcp (source)	15.0.2 → 16.0.0

---

Release Notes

bgauryy/octocode-mcp (octocode-mcp)

v16.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ octocode-mcp

• Status: Passed
• Tools scanned: 12
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅

[danbarr]

@claude analyze the security scan's findings and determine whether the AITech-8.2 rule violations are expected for this MCP server.

[danbarr]

Investigated the two AITech-8.2 findings. Both are false positives, not a new security concern.

The scan flags ghSearchCode and localViewStructure — both read-only search/browse tools that return results to the calling agent, nothing writes or forwards data externally. Confirmed by pulling the actual tool descriptions from the running v16.0.0 server and comparing to v15.0.2:

• v15.0.2's equivalent tools (githubSearchCode, localViewStructure) had the same read capability and passed the scan cleanly (0 findings, 13 tools).
• v16.0.0's descriptions added new phrasing around local caching/proof-of-work (cache fetch, clone, --materialize required, structured entries[] output) that trips the scanner's YARA heuristic for data-exfiltration patterns, without any actual new data path.
• The scan also ran its LLM semantic analyzer in this same pass and found nothing to corroborate — only the keyword-pattern yara_analyzer flagged it.

Pushed 2d3b877, which adds an AITech-8.2 allowlist entry to spec.yaml with this reasoning (matches the style used in npx/notion/spec.yaml for the same code). Should unblock the security scan check.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.