Reported issues for Claude Bridge

Pod holds 12 of 12 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Claude Bridge.

Most discussed

Auth design check-in: confirm scope, storage, protected endpoints

Decisions confirmed 2026-05-27 session:

• Scope: global token only. Per-channel deferred.
• Storage: env var CLAUDE_BRIDGE_AUTH_TOKEN + --auth-token CLI override. No config file.
• Protected surface: /sse, /messages/, /api/*, /, static dashboard files. /status stays public.
• Header format: standard Authorization: Bearer <token>. Will fall back to X-Bridge-Token only if empirical test (below) shows claude mcp add --header mangles standard

Read the thread · 2026-05-27 · closed · 2 comments

Pluggable storage backends (Tier 2.4)

Parent: #12

Today: hardcoded SQLite with one global connection. To run several bridges behind a load balancer (or for HA), need a shared backend — Redis or Postgres being the obvious candidates.

Touch surface: define Storage protocol; refactor every db() call site in server.py (~12) to go through it; new storage/ subpackage with SQLiteStorage (default), RedisStorage, PostgresStorage. ~400 LoC. Tradeoff: adds dependency surface and config complexity. Don't pursue unless mu

Read the thread · 2026-05-28 · open · 1 comment

Per-channel auth tokens (Tier 2.2)

Parent: #12

The v0.7.0 design check-in punt. Today's BearerAuthMiddleware uses one global token. Spec: each channel optionally has its own token; sending or receiving on it requires that token.

The existing BearerAuthMiddleware(token_getter=...) callable was deliberately designed for this — swap lambda: AUTH_TOKEN for a channel-aware lookup against a new channel_tokens SQLite table.

Touch surface: new table, replace token_getter, add an admin CLI (`claude-bridge tokens mint|list

Read the thread · 2026-05-28 · open · 1 comment

Server-pushed message stream — live SSE per channel (Tier 2.1)

Parent: #12

GET /sse/channel/<name> emits server-sent events as messages arrive. Dashboard + TUI drop their 2-second poll loops. The MCP SSE transport already exists in server.py for tool-call delivery — the anyio plumbing is reusable.

Touch surface: new route, broadcast hook on insert_message. ~100 LoC. Tradeoff: connection limits become a concern. Document a cap and surface it in /api/state. Why important: single most user-visible quality bump. Reduces idle CPU + DB rea

Read the thread · 2026-05-28 · closed · 1 comment

Message retention / TTL (Tier 1.2)

Parent: #12

SQLite grows unbounded. A long-running bridge will eventually want a --retention-days N flag (global) and/or a per-channel override. Background task deletes messages older than the cutoff.

Touch surface: schema additions, periodic task in server.py startup, new CLI flag, possibly a new MCP tool bridge_retention(channel, days). ~120 LoC + migration. Tradeoff: first feature that modifies historical state — needs careful default. Recommend opt-in with a loud startup bann

Read the thread · 2026-05-28 · closed · 1 comment

TLS / HTTPS support (Tier 1.1)

Parent: #12

Today the bridge serves plain HTTP. Cross-machine deployment over untrusted networks still requires a reverse proxy or a Tailscale-equivalent overlay. Adding --tls-cert PATH --tls-key PATH flags (uvicorn supports them natively) makes the bridge a self-contained option.

Touch surface: claude_bridge/cli.py argparse + the uvicorn.run(...) call. ~20 LoC. Tradeoff: cert lifecycle becomes the operator's problem. Default still "behind a reverse proxy"; TLS-on-bridge as alter

Read the thread · 2026-05-28 · closed · 1 comment

Docs: README + CLAUDE.md updates for auth

Where: README.md, CLAUDE.md

Acceptance

• README documents CLAUDE_BRIDGE_AUTH_TOKEN env var and --auth-token flag
• README explains the opt-in default ("the bridge runs without auth unless you set the env var")
• README shows the claude mcp add command with --header "Authorization: Bearer ..."
• CLAUDE.md adds a one-line note that bridge sessions on auth-enabled hosts need the token configured
• Roadmap entry for "Auth token support" is checked off in README

Part of #1.

Read the thread · 2026-05-27 · closed · 1 comment

Starlette middleware: enforce Bearer on all routes except /status

Where: claude_bridge/auth.py (new) or inline in server.py if it stays small.

Acceptance

• Middleware reads configured token at app-init time
• If no token configured → middleware is a no-op (today behavior)
• If configured:
  • /status passes through unauthenticated
  • All other routes require Authorization: Bearer <token>
  • Wrong / missing header → 401 with a small JSON body ({error: unauthorized})
• Constant-time comparison (hmac.compare_digest) to avoid timing leaks

Read the thread · 2026-05-27 · closed · 1 comment

Most recent

Add --auth-token CLI flag + CLAUDE_BRIDGE_AUTH_TOKEN env var

Where: claude_bridge/cli.py

Acceptance

• New --auth-token <value> flag in the argparse setup (alongside --host/--port/--db/--no-dashboard/--version)
• Reads CLAUDE_BRIDGE_AUTH_TOKEN env var as default when flag is omitted
• CLI value wins over env var when both are set
• Passes the resolved token through to the server bootstrap
• claude-bridge --help documents both inputs

Part of #1.

Read the thread · 2026-05-27 · closed · 1 comment

WebSocket transport (deferred)

Status: deferred unless specific demand.

SSE works fine across machines; WebSocket would give bidirectional traffic in one socket but doesn't unlock new capability for the relay use case. Scope is large — parallel /ws route, parallel handle_ws, doc updates.

Tracking issue only. Do not start unless a concrete use case appears that SSE cannot serve.

When to revisit

• Someone reports SSE drops they cannot recover from with the existing since_id flow
• A consumer wants to push m

Read the thread · 2026-05-27 · closed · 1 comment

Submit to MCP server directory

Goal: Claude Bridge listed at https://github.com/modelcontextprotocol/servers under the community section.

Blocked by #1 (auth tokens). Listing a bare instance in the official directory before auth lands would invite trivial abuse.

Work

• Read CONTRIBUTING.md at modelcontextprotocol/servers
• Write the entry pointing at pip install claude-code-bridge and this repo
• Open the PR

Estimate: ~30 min once auth is in place.

Read the thread · 2026-05-27 · closed · 1 comment

Auth tokens (v0.7.0)

Goal: allow the bridge to require Authorization: Bearer <token> on its endpoints so a publicly-reachable instance is not wide open. Opt-in; default behavior unchanged.

Scope (initial direction, subject to design check-in)

• Global token only (one secret, all clients). Per-channel can layer on later if anyone asks.
• Env var: CLAUDE_BRIDGE_AUTH_TOKEN (matches existing CLAUDE_BRIDGE_DB / CLAUDE_BRIDGE_NO_DASHBOARD pattern). Also exposable via --auth-token <value> CLI fla

Read the thread · 2026-05-27 · closed · 1 comment

The remaining reports are on the project's issue tracker.