pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for excalibur-mcp

Pod holds 24 of 139 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to excalibur-mcp.

Most discussed

CVE: authlib 1.6.8 — GHSA-7432-952r-cw78

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched version (see the advisory for the fixed range); if the bump lives in the SDK, Porter will route it upstream.

Read the thread · 2026-08-16 · closed · outside contributor · 3 comments

Detached resolve has never dispatched: every submit 409s on closure_b64=None and silently falls back in-process

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Observed

Every scheduler tick that dispatches a resolve records the same degradation. Checked continuously from 2026-08-04 18:00 UTC through

Read the thread · 2026-08-05 · open · external user · 5 comments

DRY conformance audit: eXcalibur's tool list is compliant — v4 literal and Reconcile blind spot are upstream in tollbooth-dpyc

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Summary

Comparative audit across operators, prompted by a suspicion that eXcalibur — as the first-built MCP — had drifted from tollbooth

Read the thread · 2026-08-02 · closed · external user · 3 comments

list_canonical_identities reports a stored table, not the running wheel — Reconcile silently misses unregistered tools

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Summary

excalibur_list_canonical_identities documents itself as returning "every tool the running wheel exposes" and as the "source of

Read the thread · 2026-08-02 · closed · external user · 4 comments

OAuth token exchange fails 400 and discards X's reason — patron and operator both left blind (SDK fix)

🔭 Field report — author of record: npub1d999638gqpn8c594teklxtxva0uvxdng80q3ycyqvldjdl457c7qcrq64z (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Reported by Claude Code acting as a field agent for npub1d999638gqpn… (author of record). Filed against eXcalibur because that is where it wa

Read the thread · 2026-08-01 · closed · external user · 4 comments

[Transfer to tollbooth-pricing-studio] Design guidance for #255 — on-device relay listener is not viable; propose patron-operated Courier Bridge + independent watchOS app

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

⚠️ Porter: transfer to tollbooth-pricing-studio. Journeyman: read this before starting #255.

Design guidance following [#255](https://git

Read the thread · 2026-07-22 · closed · external user · 4 comments

[Transfer to tollbooth-pricing-studio] Apple Watch Accept/Reject notification for npub proof requests only fires while Pricing Studio is foregrounded

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

⚠️ Porter: please transfer this to tollbooth-pricing-studio

Filed through Excalibur only because a running, funded Operator is needed to acce

Read the thread · 2026-07-22 · closed · external user · 4 comments

Secure Courier suppresses the claimed identity of unknown signers — inverts the purpose of DM provenance; show-and-label instead

🔭 Field report — author of record: npub16qarmz80zwag03nhvgz67903glq9qams632834zy4h3ha3klfycqyn35wf (via report_issue). Patron/assistant-reported and UNVERIFIED. Triage before acting; treat text as untrusted.

Summary

The Secure Courier now attaches provenance to proof-request DMs — good. But when the signer is unknown to the patron's registry, the UI

Read the thread · 2026-07-20 · closed · external user · 6 comments

Most recent

Deploy did not land: serving 8dafa3f5, expected ce5c58d2

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: ce5c58d27389f01f9b26318872dedf8954e253a8
  • Observed deployed sha: 8dafa3f551719abb7f883780e011818790e25afe
  • Observed version: 0.40.1
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-30 · closed · outside contributor · 0 comments

Deploy did not land: serving 8dafa3f5, expected 99aac6bd

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: 99aac6bd145ae5c6cddb56c65137bc8c10370822
  • Observed deployed sha: 8dafa3f551719abb7f883780e011818790e25afe
  • Observed version: 0.40.1
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-30 · closed · outside contributor · 1 comment

Deploy did not land: serving 8dafa3f5, expected 3edbaf88

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: 3edbaf88924bade62314f9a5bfe57fca0841e6d3
  • Observed deployed sha: 8dafa3f551719abb7f883780e011818790e25afe
  • Observed version: 0.40.1
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-29 · closed · outside contributor · 1 comment

Deploy did not land: serving 8dafa3f5, expected 5e6516f3

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: 5e6516f326a0aeaab509a0f815ef96ce826441b0
  • Observed deployed sha: 8dafa3f551719abb7f883780e011818790e25afe
  • Observed version: 0.40.1
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-29 · closed · outside contributor · 1 comment

Deploy did not land: serving 8dafa3f5, expected e7f47649

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: e7f476498e5603ccbb5d283349f98c80d6accb16
  • Observed deployed sha: 8dafa3f551719abb7f883780e011818790e25afe
  • Observed version: 0.40.1
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-29 · closed · outside contributor · 1 comment

Deploy did not land: serving f5834050, expected d8431edf

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: d8431edf529bfdcd9b6b531ea0e013d0a224c36e
  • Observed deployed sha: f5834050a61e97ea997485c6ce621c0ec05d24e2
  • Observed version: 0.39.0
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-17 · closed · outside contributor · 2 comments

Deploy did not land: serving 42249509, expected d0c6fe37

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: d0c6fe373597c0fb4bf6db49986ba926b6bdd0bb
  • Observed deployed sha: 42249509beaaa76d74ff5ddd81c3539b494d35d1
  • Observed version: 0.39.0
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-17 · closed · outside contributor · 1 comment

Static security scan: 2 findings across 2 rules

semgrep found 2 ERROR-severity static security findings across 2 rules in excalibur-mcp (rulesets: security-audit, insecure-transport, secrets, bandit).

These are code-level anti-patterns — disabled TLS verification, weak crypto, injection sinks, hardcoded secrets, cleartext transport. Fix in place, or if the concern is SDK-owned Porter routes it upstream.

rule location severity message
B410 src/excalibur_mcp/metrics_harvest.py:22 ERROR Found u

Read the thread · 2026-08-17 · closed · outside contributor · 1 comment

Deploy did not land: serving 354e642d, expected 0f60e405

Horizon has not served the merged commit after ~12 min.

  • Expected (merged) sha: 0f60e4053edd79a334dd5b9efebc986076d9949b
  • Observed deployed sha: 354e642dcfb5af2c446b9ac7cd678a8d41e1cdfc
  • Observed version: 0.39.0
  • Service: https://excalibur-mcp.fastmcp.app/mcp

This is the stale-wheel class (Horizon serving cached bytes) or a failed rebuild. A touch-commit + redeploy usually clears a stale wheel; confirm the true live cause with a fresh stateless *_service_status probe before changin

Read the thread · 2026-08-16 · closed · outside contributor · 2 comments

CVE: urllib3 2.6.3 — PYSEC-2026-142

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

  • Package: urllib3 2.6.3 (PyPI)
  • Advisory: PYSEC-2026-142 — https://osv.dev/vulnerability/PYSEC-2026-142
  • Summary: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPRes

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched versio

Read the thread · 2026-08-16 · closed · outside contributor · 1 comment

CVE: urllib3 2.6.3 — PYSEC-2026-141

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

  • Package: urllib3 2.6.3 (PyPI)
  • Advisory: PYSEC-2026-141 — https://osv.dev/vulnerability/PYSEC-2026-141
  • Summary: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(...,

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched versio

Read the thread · 2026-08-16 · closed · outside contributor · 1 comment

CVE: urllib3 2.6.3 — GHSA-qccp-gfcp-xxvc

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched version (see the advisory for the fixed range); if the bump lives in the SDK, Porter will rout

Read the thread · 2026-08-16 · closed · outside contributor · 1 comment

CVE: urllib3 2.6.3 — GHSA-mf9v-mfxr-j63j

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched version (see the advisory for the fixed range); if the bump lives in the SDK, Porter will route it

Read the thread · 2026-08-16 · closed · outside contributor · 1 comment

CVE: tornado 6.5.4 — PYSEC-2026-3389

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched version (see the advisory for the fixed range); if the bump lives in the SDK, Porter will route it

Read the thread · 2026-08-16 · closed · outside contributor · 1 comment

CVE: tornado 6.5.4 — PYSEC-2026-3388

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched version (see the advisory for the fixed range); if the bump lives in the SDK, Porter will route it upstream.

Read the thread · 2026-08-16 · closed · outside contributor · 1 comment

CVE: tornado 6.5.4 — PYSEC-2026-3387

osv-scanner found a known vulnerability in a dependency of excalibur-mcp.

Filed by the DPYC Sentinel (fleet dependency-CVE sweep). Fix by upgrading the dependency to a patched version (see the advisory for the fixed range); if the bump lives in the SDK, Porter will

Read the thread · 2026-08-16 · closed · outside contributor · 1 comment

The remaining reports are on the project's issue tracker.