# Reported issues for Drafto

Pod holds 9 of 9 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Drafto](/mcp/drafto).

## Most discussed

### feat(dark-factory): let the implement + watch stages see screenshots

### What

The dark-factory **planner** can now fetch and view screenshots (PR #554 added a host-validated `bundle.screenshots` field plus a tightly-scoped fetch+Read tool in `scripts/factory-plan-prompt.md`). The **implement** and **watch** stages still cannot: `buildFactoryImplementBundle` / `buildFactoryWatchBundle` in `scripts/lib/factory-bundle.mjs` don't surface `screenshots`, and `scripts/factory-prompt.md` (the implementer prompt) has no screenshot-fetch tool.

So when the planner writes 

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/555) · 2026-06-29 · closed · 5 comments

### feat: notebook delete & rename via MCP

### What

The Drafto MCP server exposes note-level tools (create/read/update/trash/move) and can create + list notebooks, but it cannot **delete** or **rename** a notebook. This gap surfaced during the Evernote re-import cleanup: trashing a notebook's notes via MCP leaves an empty notebook shell that can only be removed in the web UI, and a "(fixed)" notebook can't be renamed back to its original name from MCP. Add `rename_notebook` and `delete_notebook` MCP tools so an agent can fully manage no

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/525) · 2026-06-14 · closed · 2 comments

### chore: type RPC Functions and Block/Json boundary, drop url-polyfill any

### What

The repo's "strict TypeScript — no `any`" rule is being evaded at three boundaries. (1) `packages/shared/src/types/database.ts:215` declares `Functions: Record<string, never>`, so RPC calls bypass the type system entirely: `apps/web/src/app/api/notes/search/route.ts:31-36` calls `supabase.rpc("search_notes" as never, { search_query: q } as never)` and asserts a hand-written result type — if a migration changes the `search_notes` signature (it already changed once, in `supabase/migratio

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/516) · 2026-06-12 · open · 0 comments

### fix: use constant-time comparison for cron and webhook shared secrets

### What

Two privileged web API endpoints compare caller-supplied shared secrets with plain string equality, which short-circuits on the first differing byte instead of running in constant time. `apps/web/src/app/api/cron/cleanup-trash/route.ts:11` checks `authHeader === ` `Bearer ${cronSecret}` `` to authorize a bulk-deletion RPC, and `apps/web/src/app/api/webhooks/new-signup/route.ts:54-56` checks `providedSecret !== env.WEBHOOK_SECRET` to authorize a service-role-backed webhook. This is inco

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/512) · 2026-06-12 · open · 0 comments

### fix: wrong status codes and false-success paths in web API routes

### What

Several web API routes return the wrong HTTP status or a wrong result, which misleads clients and pollutes monitoring. In `apps/web/src/app/api/notes/[id]/route.ts`, PATCH accepts `body.notebook_id` (line 111) and `body.content` completely unvalidated and then maps **every** database error — RLS rejection, malformed UUID, FK violation, bad jsonb — to a blanket 404 (`errorResponse("Failed to update note", 404)` at lines 132–134), conflating 400/403/404/500. DELETE in the same file (line

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/505) · 2026-06-12 · open · 0 comments

### chore(web): route MCP auth through createAdminClient, drop inline client

### What

`apps/web/src/lib/api/mcp-auth.ts` hand-rolls the RLS-bypassing service-role Supabase client instead of using the centralized factory in `apps/web/src/lib/supabase/admin.ts`. Evidence: `mcp-auth.ts:1` imports `createClient` from `@supabase/supabase-js` directly, and `mcp-auth.ts:42-45` constructs a client with the exact options of `createAdminClient` (`admin.ts:26-35`), hard-coding the `"x-drafto-client": "web-mcp"` header that `admin.ts:18` explicitly documents as an intended `clientT

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/493) · 2026-06-12 · open · 0 comments

### fix: make MCP search_notes match full-text promise and escape wildcards

### What

The MCP tool `search_notes` is registered in `apps/web/src/app/api/mcp/route.ts:45` with the description "Full-text search across all notes (titles, content, and notebook names)", but the handler in `apps/web/src/lib/api/mcp-tools.ts:93-102` only runs `.ilike("title", pattern)` — note content and notebook names are never searched (the comment at line 93-94 explains the web `search_notes` RPC can't be reused because it is `security invoker` and relies on `auth.uid()`, which is unset for

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/485) · 2026-06-12 · open · 0 comments

### fix: unreliable fire-and-forget DB writes; note GET mutates updated_at

### What

Two API code paths issue Supabase writes as dangling promises that are never awaited, so on Vercel serverless the function can freeze as soon as the response is returned and the writes silently complete only sometimes. In `apps/web/src/app/api/notes/[id]/route.ts:52-61`, the GET handler persists TipTap→BlockNote-repaired content via an unawaited `.then()` (`supabase.from("notes").update({ content: converted ... }).eq("id", id)...then(...)`) while the response is returned at line 79 — s

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/478) · 2026-06-12 · open · 0 comments

## Most recent

### fix: markdown-converter round-trip corrupts note content via MCP

### What

The MCP server's read-modify-write flow (`readNote` returns `blockNoteToMarkdown(blocks)`; `updateNote` persists `markdownToBlockNote(contentMarkdown)` at `apps/web/src/lib/api/mcp-tools.ts:163`) silently corrupts canonical note content because the round-trip in `packages/shared/src/editor/markdown-converter.ts` is lossy in four execution-verified ways. (1) Nesting is flattened: `markdownToBlockNote` computes the indent but discards it — `markdown-converter.ts:236` reads `const { conte

[Read the thread](https://github.com/JakubAnderwald/drafto/issues/465) · 2026-06-12 · open · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/JakubAnderwald/drafto/issues).