Reported issues for datanika-mcp

Pod holds 18 of 31 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to datanika-mcp.

Most discussed

[Engineering] P0: mcp 2.x breaks the image — datanika-mcp's unpinned dep clobbers core's mcp<2, /mcp unmounted, all deploys blocked

This blocks every production deploy. Found when a monitoring-only promotion (#601) failed on the box. Nothing about that change was related; any deploy today would have hit this.

Symptom

deploy-pointer.yml → Deploy the app via blue/green swap fails its post-swap assertion:

15:59:08   public /mcp unauth -> 404 (expect 401; 200 means it fell through to the SPA)
15:59:08 FATAL: /mcp returned 404

The app itself is healthy — /healthz, /readyz, / all 200 on the new colou

Read the thread · 2026-08-29 · closed · 7 comments

[QA] S1: prod runs 4 Reflex workers with per-process state — 48% of reconnects are served a stale session (root cause of #472/#529)

S1 — reproduced on production, 2026-08-30, without a browser.

Production runs the Reflex backend as 4 independent worker processes with a per-process state store. A client that reconnects lands on a different process roughly half the time and is served a state that has lost earlier writes. Since AuthState.access_token is a plain server-side state var and check_auth does if not self.access_token: return rx.redirect("/login"), a stale read is a logout.

This is the cause of

Read the thread · 2026-08-30 · closed · 4 comments

[QA] e2e-staging failure on e8198d1

Run: https://github.com/datanika-io/datanika-core/actions/runs/33344167976 Commit: e8198d1 Message: [Engineering] Route every Connection lookup through an org-scoped accessor Report: playwright-report artifact on the run page

Only the GATING tier can open this — informational specs do not fail the job (core#521).

Read the thread · 2026-08-31 · closed · external user · 2 comments

[Growth] List datanika-mcp in the MCP registries (discoverability)

Part of the AI-first agent-surface wave (coordinator-routed 2026-07-18). Quick win — free discoverability where agents/users browse for tools.

Gap: we have a working MCP server but it's unlisted, so nobody browsing MCP directories finds Datanika.

Scope (registry landscape verified 2026-07-18)

Publish to the official MCP registry first — registry.modelcontextprotocol.io (Anthropic/GitHub/Microsoft/PulseMCP metaregistry). It feeds the directories + clients, so do it first

Read the thread · 2026-07-18 · closed · 2 comments

[Infra P0] Post-deploy smoke gate — app.datanika.io after ci.yml

Summary

Add a post-deploy smoke gate as a new job in .github/workflows/ci.yml that runs after the Deploy step on push to master, curls a curated list of URLs on https://app.datanika.io, asserts 200 + non-empty body (plus per-URL content-type and body-substring checks), and fails the workflow on any miss. Same task in parallel on the landing side: datanika-landing (separate tracking issue, same source-of-truth).

Paired issue: datanika-landing#<TBD, see cross-ref> adds the

Read the thread · 2026-04-14 · closed · 2 comments

[Product] Chrome autofills the user's Datanika password into connector credential fields — and Google Ads then sends it to Google as a header

Found on production while capturing a 02-add-connection screenshot for the Google Ads guide. I caught it because the screenshot I was about to publish contained credentials I had never typed. The shot was deleted, not shipped.

Symptom

Open Connections → New Connection → type google_ads on app.datanika.io in Chrome, with the Datanika site password saved in the browser (the ordinary state for any returning user). Without touching either field:

Customer ID is pre-fil

Read the thread · 2026-08-29 · closed · 1 comment

[Infra] deploy-bluegreen.sh: FATAL paths bypass the ERR rollback trap, leaving prod half-deployed on the new colour

Found during the #601 promotion, which failed at a post-swap assertion and left production on the new colour with /mcp down, instead of rolling back. Root cause of the deploy failure itself is #602; this issue is about the deploy script's behaviour when an assertion fails.

1. The FATAL paths bypass the rollback trap

scripts/deploy-bluegreen.sh arms a rollback:

trap 'rollback' ERR          # line 107

but every assertion failure exits like this:

[ "$MCP" = 401

[Read the thread](https://github.com/datanika-io/datanika-core/issues/603) · 2026-08-29 · closed · 1 comment

### [QA] MongoDB source cannot authenticate: the connection URI sets no authSource, so users in admin are rejected

## Authenticated MongoDB connections cannot authenticate

`_build_mongodb_source` (`dlt_runner.py:760`) builds:

```python
uri = f"mongodb://{quote_plus(user)}:{quote_plus(password)}@{host}:{port}/{database}"

The database in the path is also the authentication database. MongoDB users are conventionally created in admin — that is what MONGO_INITDB_ROOT_USERNAME does in the official image, and what MongoDB Atlas and every managed provider do. So unless the user happens to exist *insid

Read the thread · 2026-07-22 · closed · 1 comment

Most recent

datanika-mcp: the transport's stateless mode and its private-attribute reach-through both need guards

Filed by Infra while deciding the mcp 2.x question left open by #602. Nothing is broken and nothing is exploitable today — this is about two invariants that currently hold by accident.

1. `stateless=True` is load-bearing, and nothing says so

datanika-mcp/src/datanika_mcp/server.py:492-496:

manager = StreamableHTTPSessionManager(
    app=mcp._mcp_server,
    stateless=True,
    json_response=True,
)

While auditing the pinned mcp version I checked our exposure to

Read the thread · 2026-08-30 · open · 0 comments

[Engineering] OpenAPI P2 — spec URL-fetch behind the §7 SSRF guards

OpenAPI connector P2, first slice (SPEC_OPENAPI_CONNECTOR §9): accept a spec URL at POST /api/v1/connections/openapi/parse, not just a pasted document.