# Reported issues for Connapse

Pod holds 18 of 54 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Connapse](/mcp/connapse).

## Most discussed

### Phase 3 — Connector contract split and cursor-based sync engine

Part of #348. Blocked by #350.

## What

Split write capability out of `IConnector`, add cursor-based incremental sync, rebuild the watcher around sources, delete `ContainerWriteGuard`, and add the `/api/sources` endpoints plus the `kind` discriminator.

## Why

The current sync model polls every five minutes, lists the entire remote corpus, and diffs it against an in-memory snapshot. That is O(corpus) per poll, it discards the durable cursor nearly every provider API offers, and it does not sur

[Read the thread](https://github.com/Destrayon/Connapse/issues/351) · 2026-08-14 · closed · 5 comments

### Security Model Implementation Plan: Identity + PAT + JWT (Three-Tier Auth)

## Summary

Research from the AI Knowledge Agent suggests a comprehensive security implementation plan for Connapse. This issue documents the recommended security model, priority order, and architectural decisions based on analysis of the current codebase and patterns used by comparable open-source platforms (Supabase, PostHog, Gitea, Bitwarden).

---

## Current Security Posture

**What's already solid:**
- Parameterized SQL queries everywhere (EF Core + `NpgsqlParameter` for pgvector)
- Blazor

[Read the thread](https://github.com/Destrayon/Connapse/issues/7) · 2026-02-17 · closed · 4 comments

### Submit to official MCP Registry

## Description
The official MCP Registry at `registry.modelcontextprotocol.io` is the canonical source. Glama syncs from it daily. Being listed adds legitimacy and keeps Glama's listing fresh.

## Acceptance Criteria
- [ ] Connapse appears on `registry.modelcontextprotocol.io`
- [ ] `server.json` follows official schema
- [ ] Glama listing reflects official registry presence

## Implementation Notes
- `server.json` already follows `https://static.modelcontextprotocol.io/schemas/2025-12-11/server

[Read the thread](https://github.com/Destrayon/Connapse/issues/256) · 2026-03-14 · closed · 1 comment

### Add VS Code install button/deep-link to README

## Description
Playwright and Brave Search listings have a "Install in VS Code" button that deep-links to extension install. This is a one-click install path for VS Code users.

## Acceptance Criteria
- [ ] VS Code install button or deep-link exists in README
- [ ] Button works and installs/configures the MCP server
- [ ] Glama picks up and displays the VS Code install option

## Implementation Notes
- Research how to register as VS Code MCP server extension or create a deep-link
- May require p

[Read the thread](https://github.com/Destrayon/Connapse/issues/255) · 2026-03-14 · closed · 1 comment

### Add a zero-setup trial path (hosted demo or one-click deploy)

## Description
The biggest friction for MCP server adoption is deployment. Top servers work instantly because they're remote-hosted. Connapse requires Docker setup before trying. A hosted demo or one-click deploy would dramatically lower the barrier.

## Acceptance Criteria
- [ ] At least one zero-setup trial path exists (pick one):
  - Public read-only demo instance with sample documents
  - "Deploy to Railway" / "Deploy to Render" button in README
  - Glama Firecracker VM hosting
- [ ] README 

[Read the thread](https://github.com/Destrayon/Connapse/issues/254) · 2026-03-14 · closed · 1 comment

### Add MCP client compatibility matrix to README

## Description
Users need to know which MCP clients are tested before investing setup time. Top listings state supported clients explicitly.

## Acceptance Criteria
- [ ] Compatibility matrix table exists in README
- [ ] At least 3 clients listed as "Tested"
- [ ] Transport type listed for each client
- [ ] Status column reflects actual testing results

## Implementation Notes
- Clients to include: Claude Desktop, Claude Code, Cursor, VS Code (Copilot), Windsurf, MCP Inspector
- Transport: Strea

[Read the thread](https://github.com/Destrayon/Connapse/issues/251) · 2026-03-14 · closed · 1 comment

### Add smithery.yaml for Smithery.ai listing

## Description
Smithery.ai is the second-largest MCP directory (3,305+ servers). Adding a `smithery.yaml` also helps Glama's indexing since they monitor Smithery. Top servers publish to both platforms.

## Acceptance Criteria
- [ ] `smithery.yaml` exists at repo root with valid schema
- [ ] Server start command, transport type, and config schema defined
- [ ] Server is listed on smithery.ai after submission
- [ ] Smithery listing shows all 11 MCP tools

## Implementation Notes
- Schema docs: htt

[Read the thread](https://github.com/Destrayon/Connapse/issues/249) · 2026-03-14 · closed · 1 comment

### refactor(api): extract shared upload service to centralize validation

## Description
Upload validation (filename checks, extension allowlist, zero-byte rejection, write guards) is currently duplicated across three entry points:
- `DocumentsEndpoints.cs` (REST API)
- `McpTools.cs` `upload_file` (MCP)
- `McpTools.cs` `bulk_upload` (MCP)

Each independently validates, writes to storage, and enqueues ingestion jobs. Adding a new validation rule (like the extension allowlist in #194) requires touching all three locations.

## Proposal
Extract a shared `IUploadService` 

[Read the thread](https://github.com/Destrayon/Connapse/issues/213) · 2026-03-12 · closed · 1 comment

## Most recent

### Permission filter is unsafe and dishonest before any resolver is connected

Sub-phase 5a of [#421](https://github.com/Destrayon/Connapse/issues/421). The enforcement machinery landed in #426 with a default resolver that permits everything, so nothing filters yet. Several things about it are wrong, and they are much cheaper to fix now than after a real resolver is connected.

## A grant can be read wider than it was written

AWS reports a whole-bucket access grant as `s3://bucket*` — an asterisk with **no separating slash**. Strip the asterisk and match it as a prefix an

[Read the thread](https://github.com/Destrayon/Connapse/issues/427) · 2026-08-28 · closed · 0 comments

### Guided setup for the S3 connection, and credentials the container can actually see

## What

A guided setup for the S3 connection, mirroring the SFTP and AWS SSO ones — but this time Connapse can do the work itself rather than handing out a script.

1. **Preflight** — call `sts:GetCallerIdentity` from inside the container and report which identity resolved, or that none did.
2. **Pick a bucket** — `ListBuckets` fills a dropdown, `GetBucketLocation` fills the region.
3. **Tighten** — generate a least-privilege IAM policy scoped to the chosen bucket and prefix.
4. **Test** — the 

[Read the thread](https://github.com/Destrayon/Connapse/issues/415) · 2026-08-26 · closed · 0 comments

### Container auto-summaries (per-doc + Stuff-or-Cluster rollup + container_describe MCP tool)

Implementation of the container auto-summary feature.

## Summary

Ships auto-generated agent-optimized natural-language summaries per
container, exposed via a new `container_describe` MCP tool and a
truncated one-sentence field on `container_list`. Per-doc summaries
generated at ingestion via `ILlmProvider`; container rollup uses a
single LLM call in two regimes (Stuff for N≤30 docs, Cluster + medoid
sampling for N>30). Debounced trigger via Channel + BackgroundService.
BYOLLM via the existing 

[Read the thread](https://github.com/Destrayon/Connapse/issues/328) · 2026-05-25 · closed · 0 comments

### feat(mcp): Steer agents toward search_knowledge — server instructions + tool description rewrites + soft errors

## Summary

MCP-connected agents (Claude Code in particular) systematically prefer `list_files` + `get_document` over `search_knowledge` for question-answering tasks. This issue implements the four-pattern reinforcement stack from the research brief [`/agent-experience/agent-rag-corpus-grounding-2026-05-22.md`](https://github.com/Destrayon/Connapse) in `connapse-product-engineering` (32KB, 2026-05-22), grounded in Anthropic engineering posts, the MCP spec 2025-06-18, and arXiv 2505.18135.

## Wh

[Read the thread](https://github.com/Destrayon/Connapse/issues/324) · 2026-05-22 · closed · 0 comments

### Add troubleshooting section to README

## Description
Playwright is the only top server with troubleshooting docs — easy differentiation. Pre-answer common MCP setup issues (auth failures, transport errors, Docker networking).

## Acceptance Criteria
- [ ] Troubleshooting section covers 3-5 most common setup issues
- [ ] Uses collapsible `<details>` to keep README clean
- [ ] Covers: connection refused, 401 unauthorized, tools not appearing

## Implementation Notes
- Use `<details><summary>Troubleshooting</summary>` for collapsibilit

[Read the thread](https://github.com/Destrayon/Connapse/issues/259) · 2026-03-14 · closed · 0 comments

### Add example prompts / prompt library to README

## Description
Example natural-language prompts show users what they can ask their AI agent once MCP is connected. This is both a marketing tool and a usability tool.

## Acceptance Criteria
- [ ] 5-10 example prompts covering main tool categories (CRUD, search, bulk ops)
- [ ] Prompts are realistic and demonstrate the value proposition
- [ ] Section exists in README or `docs/mcp-tools.md`

## Implementation Notes
- Example prompts: create container, upload, search, list files, bulk delete, summ

[Read the thread](https://github.com/Destrayon/Connapse/issues/258) · 2026-03-14 · closed · 0 comments

### Enrich MCP tool descriptions with examples and return shapes

## Description
Current tool descriptions are one-liners. Top listings document parameters, return values, and include natural-language usage examples. Richer descriptions improve the Glama listing AND help AI agents use tools more effectively.

## Acceptance Criteria
- [ ] Each tool description in code includes a usage hint or example prompt
- [ ] \`docs/mcp-tools.md\` exists with full parameter tables, return shapes, and error codes
- [ ] README links to \`docs/mcp-tools.md\`
- [ ] Tests pass (

[Read the thread](https://github.com/Destrayon/Connapse/issues/252) · 2026-03-14 · closed · 0 comments

### Add MCP tool annotations (readOnly, destructive, idempotent hints)

## Description
The MCP spec recommends tool annotations (\`readOnlyHint\`, \`destructiveHint\`, \`idempotentHint\`) for better client UX. Glama and other clients use these to display safety indicators.

## Acceptance Criteria
- [ ] All 11 tools have \`readOnlyHint\`, \`destructiveHint\`, and \`idempotentHint\` annotations
- [ ] Destructive tools (\`container_delete\`, \`delete_file\`, \`bulk_delete\`) marked accordingly
- [ ] Read-only tools (\`container_list\`, \`container_stats\`, \`list_files

[Read the thread](https://github.com/Destrayon/Connapse/issues/250) · 2026-03-14 · closed · 0 comments

### Add MCP client config snippets to README

## Description
The #1 adoption friction point. Every top MCP listing provides ready-to-paste JSON config for Claude Desktop, Cursor, and VS Code. Connapse's README has an MCP tools table but no config snippets.

## Acceptance Criteria
- [ ] README has config snippets for Claude Desktop, Claude Code, Cursor, and VS Code
- [ ] Each snippet is inside a fenced code block with correct language tag
- [ ] API key setup explained in 1-2 sentences (Settings > Agent API Keys or \`connapse auth agent-key c

[Read the thread](https://github.com/Destrayon/Connapse/issues/247) · 2026-03-14 · closed · 0 comments

### Pass Glama security and quality audits (Triple-A)

## Description
Connapse currently shows "Not tested" for Security and Quality grades on Glama. Every top listing has A/A/A grades. This is the most visible trust deficit on the page. License already grades A (MIT).

## Acceptance Criteria
- [x] Security grade: A on Glama
- [x] Quality grade: A on Glama
- [x] No vulnerable NuGet packages (`dotnet list package --vulnerable` clean)
- [x] MCP tool discovery works without auth (read-only schema enumeration)
- [x] Latest GitHub Release is a non-prerel

[Read the thread](https://github.com/Destrayon/Connapse/issues/246) · 2026-03-14 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/Destrayon/Connapse/issues).