# Reported issues for Claude Bridge Pod holds 12 of 12 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [Claude Bridge](/mcp/claude-bridge). ## Most discussed ### Auth design check-in: confirm scope, storage, protected endpoints **Decisions confirmed 2026-05-27 session:** - [x] **Scope:** global token only. Per-channel deferred. - [x] **Storage:** env var `CLAUDE_BRIDGE_AUTH_TOKEN` + `--auth-token` CLI override. No config file. - [x] **Protected surface:** `/sse`, `/messages/`, `/api/*`, `/`, static dashboard files. `/status` stays public. - [x] **Header format:** standard `Authorization: Bearer `. Will fall back to `X-Bridge-Token` only if empirical test (below) shows `claude mcp add --header` mangles standard [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/8) · 2026-05-27 · closed · 2 comments ### Pluggable storage backends (Tier 2.4) Parent: #12 Today: hardcoded SQLite with one global connection. To run several bridges behind a load balancer (or for HA), need a shared backend — Redis or Postgres being the obvious candidates. **Touch surface:** define `Storage` protocol; refactor every `db()` call site in `server.py` (~12) to go through it; new `storage/` subpackage with `SQLiteStorage` (default), `RedisStorage`, `PostgresStorage`. ~400 LoC. **Tradeoff:** adds dependency surface and config complexity. Don't pursue unless mu [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/18) · 2026-05-28 · open · 1 comment ### Per-channel auth tokens (Tier 2.2) Parent: #12 The v0.7.0 design check-in punt. Today's `BearerAuthMiddleware` uses one global token. Spec: each channel optionally has its own token; sending or receiving on it requires that token. The existing `BearerAuthMiddleware(token_getter=...)` callable was deliberately designed for this — swap `lambda: AUTH_TOKEN` for a channel-aware lookup against a new `channel_tokens` SQLite table. **Touch surface:** new table, replace `token_getter`, add an admin CLI (`claude-bridge tokens mint|list [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/17) · 2026-05-28 · open · 1 comment ### Server-pushed message stream — live SSE per channel (Tier 2.1) Parent: #12 `GET /sse/channel/` emits server-sent events as messages arrive. Dashboard + TUI drop their 2-second poll loops. The MCP SSE transport already exists in `server.py` for tool-call delivery — the `anyio` plumbing is reusable. **Touch surface:** new route, broadcast hook on `insert_message`. ~100 LoC. **Tradeoff:** connection limits become a concern. Document a cap and surface it in `/api/state`. **Why important:** single most user-visible quality bump. Reduces idle CPU + DB rea [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/16) · 2026-05-28 · closed · 1 comment ### Message retention / TTL (Tier 1.2) Parent: #12 SQLite grows unbounded. A long-running bridge will eventually want a `--retention-days N` flag (global) and/or a per-channel override. Background task deletes messages older than the cutoff. **Touch surface:** schema additions, periodic task in `server.py` startup, new CLI flag, possibly a new MCP tool `bridge_retention(channel, days)`. ~120 LoC + migration. **Tradeoff:** first feature that modifies historical state — needs careful default. Recommend opt-in with a loud startup bann [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/14) · 2026-05-28 · closed · 1 comment ### TLS / HTTPS support (Tier 1.1) Parent: #12 Today the bridge serves plain HTTP. Cross-machine deployment over untrusted networks still requires a reverse proxy or a Tailscale-equivalent overlay. Adding `--tls-cert PATH --tls-key PATH` flags (uvicorn supports them natively) makes the bridge a self-contained option. **Touch surface:** `claude_bridge/cli.py` argparse + the `uvicorn.run(...)` call. ~20 LoC. **Tradeoff:** cert lifecycle becomes the operator's problem. Default still "behind a reverse proxy"; TLS-on-bridge as alter [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/13) · 2026-05-28 · closed · 1 comment ### Docs: README + CLAUDE.md updates for auth **Where:** `README.md`, `CLAUDE.md` ## Acceptance - README documents `CLAUDE_BRIDGE_AUTH_TOKEN` env var and `--auth-token` flag - README explains the opt-in default ("the bridge runs without auth unless you set the env var") - README shows the `claude mcp add` command with `--header "Authorization: Bearer ..."` - CLAUDE.md adds a one-line note that bridge sessions on auth-enabled hosts need the token configured - Roadmap entry for "Auth token support" is checked off in README Part of #1. [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/11) · 2026-05-27 · closed · 1 comment ### Starlette middleware: enforce Bearer on all routes except /status **Where:** `claude_bridge/auth.py` (new) or inline in `server.py` if it stays small. ## Acceptance - Middleware reads configured token at app-init time - If no token configured → middleware is a no-op (today behavior) - If configured: - `/status` passes through unauthenticated - All other routes require `Authorization: Bearer ` - Wrong / missing header → 401 with a small JSON body (`{error: unauthorized}`) - Constant-time comparison (`hmac.compare_digest`) to avoid timing leaks - [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/5) · 2026-05-27 · closed · 1 comment ## Most recent ### Add --auth-token CLI flag + CLAUDE_BRIDGE_AUTH_TOKEN env var **Where:** `claude_bridge/cli.py` ## Acceptance - New `--auth-token ` flag in the argparse setup (alongside `--host/--port/--db/--no-dashboard/--version`) - Reads `CLAUDE_BRIDGE_AUTH_TOKEN` env var as default when flag is omitted - CLI value wins over env var when both are set - Passes the resolved token through to the server bootstrap - `claude-bridge --help` documents both inputs Part of #1. [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/4) · 2026-05-27 · closed · 1 comment ### WebSocket transport (deferred) **Status: deferred unless specific demand.** SSE works fine across machines; WebSocket would give bidirectional traffic in one socket but doesn't unlock new capability for the relay use case. Scope is large — parallel `/ws` route, parallel `handle_ws`, doc updates. Tracking issue only. **Do not start unless a concrete use case appears that SSE cannot serve.** ## When to revisit - Someone reports SSE drops they cannot recover from with the existing `since_id` flow - A consumer wants to push m [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/3) · 2026-05-27 · closed · 1 comment ### Submit to MCP server directory **Goal:** Claude Bridge listed at https://github.com/modelcontextprotocol/servers under the community section. **Blocked by #1 (auth tokens).** Listing a bare instance in the official directory before auth lands would invite trivial abuse. ## Work - Read CONTRIBUTING.md at `modelcontextprotocol/servers` - Write the entry pointing at `pip install claude-code-bridge` and this repo - Open the PR **Estimate:** ~30 min once auth is in place. [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/2) · 2026-05-27 · closed · 1 comment ### Auth tokens (v0.7.0) **Goal:** allow the bridge to require `Authorization: Bearer ` on its endpoints so a publicly-reachable instance is not wide open. Opt-in; default behavior unchanged. ## Scope (initial direction, subject to design check-in) - **Global token only** (one secret, all clients). Per-channel can layer on later if anyone asks. - **Env var:** `CLAUDE_BRIDGE_AUTH_TOKEN` (matches existing `CLAUDE_BRIDGE_DB` / `CLAUDE_BRIDGE_NO_DASHBOARD` pattern). Also exposable via `--auth-token ` CLI fla [Read the thread](https://github.com/constripacity/Claude-Bridge/issues/1) · 2026-05-27 · closed · 1 comment The remaining reports are on [the project's issue tracker](https://github.com/constripacity/Claude-Bridge/issues).