# Reported issues for FYI MCP Pod holds 17 of 25 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [FYI MCP](/mcp/fyi-mcp). ## Most discussed ### Track follow-up: Glama review and indexing for fyi-mcp ## Summary Glama accepted the `fyi-mcp` server submission, but the public Glama MCP server index does not yet show `fyi-mcp` under `author:edithatogo`. ## Acceptance Criteria - [ ] Glama public search lists `fyi-mcp` for `author:edithatogo`. - [ ] The server page has a useful description and capability/tool metadata. - [ ] Any Glama score or metadata warnings are captured in a follow-u [Read the thread](https://github.com/edithatogo/fyi-cli/issues/25) · 2026-07-01 · closed · 11 comments ### Plan an opt-in endorsed CLI/MCP route to reduce Alaveteli bot overload ## Purpose Prepare a maintainer-friendly proposal for Alaveteli: an explicitly opt-in, sysadmin-controlled route for fyi-cli and MCP clients that gives well-behaved users a direct way to engage with an instance while reducing accidental overload from ad-hoc clients, scrapers, and bulk retrieval. This issue is planning and evidence work in `edithatogo/fyi-cli`. It does not open an upstream Alaveteli issue or pull request yet. ## Problem framing Many clients are likely not trying to overload a [Read the thread](https://github.com/edithatogo/fyi-cli/issues/148) · 2026-07-10 · closed · 6 comments ### Harden reproducible release source for package submissions Parent: #194 Complete release-source hardening: signed artifacts, SBOM, provenance, hashes, release compatibility matrix, rollback metadata, and package install smoke tests. Keep every package status evidence-backed. [Read the thread](https://github.com/edithatogo/fyi-cli/issues/202) · 2026-07-12 · closed · 5 comments ### Run fork-local Alaveteli contract verification and close out interoperability Parent: https://github.com/edithatogo/fyi-cli/issues/140 Paired server issue: to be linked after creation in `edithatogo/alaveteli`. ## Scope Consume the shared server fixtures, run the complete offline contract suite, optionally run one bounded live smoke test, and reconcile both Conductor tracks. ## One-PR boundary Verification, documentation, and Conductor metadata only. No new behavior. ## Required evidence - Shared contract version and reciprocal issue links in both repositories. - CI ev [Read the thread](https://github.com/edithatogo/fyi-cli/issues/144) · 2026-07-10 · closed · 4 comments ### bleeding-edge-features: Implement MCP resources for corpus exposure Expose archived FOI corpora as MCP resources (not just tools) for AI assistant consumption. [Read the thread](https://github.com/edithatogo/fyi-cli/issues/124) · 2026-07-08 · closed · 3 comments ### registry-distribution-expansion: Submit to Docker MCP Catalog Add fyi-mcp to Docker MCP Catalog; ensure container image is listed. [Read the thread](https://github.com/edithatogo/fyi-cli/issues/102) · 2026-07-08 · closed · 3 comments ### registry-distribution-expansion: Submit to mcp.so catalog Add fyi-mcp to mcp.so catalog; automate submission if API available. [Read the thread](https://github.com/edithatogo/fyi-cli/issues/101) · 2026-07-08 · closed · 3 comments ### registry-distribution-expansion: Submit to PulseMCP catalog Add fyi-mcp to PulseMCP catalog; automate submission if API available. [Read the thread](https://github.com/edithatogo/fyi-cli/issues/100) · 2026-07-08 · closed · 3 comments ## Most recent ### Add bounded Wayback replay adapter Expose fyi internet-archive-replay for approved CDX rows, with host/redirect allowlists, status/length/digest verification, raw payload output, checkpoints, and receipts. Parent: #309. [Read the thread](https://github.com/edithatogo/fyi-cli/issues/312) · 2026-08-12 · open · 1 comment ### [Cross-repo] Emit RIOPA-compatible capture and provenance events Adopt the shared RIOPA provenance profile without replacing the existing tamper-evident payload hash chain. ## Scope - Map current `ProvenanceRecord` fields into artifact/capture events. - Preserve current chain verification as integrity evidence. - Emit source, input/output, agent, rights and schema references alongside current outputs. - Add golden fixtures and round-trip validation against `riopa-infrastructure`. ## Acceptance - Existing chain tests remain green. - One real/synthetic capt [Read the thread](https://github.com/edithatogo/fyi-cli/issues/239) · 2026-07-27 · closed · 0 comments ### Epic: map non-Alaveteli FOI platforms ## Objective Execute `.conductor/tracks/foi-platform-landscape_20260712/`. ## Scope Maintain a source-backed map of non-Alaveteli FOI platforms, API contracts, jurisdiction, authentication, write semantics, rate limits, privacy requirements, and integration feasibility. ## Initial candidates MuckRock, FragDenStaat/Froide, FOIA.gov, USCIS FOIA/PA, Canada ATIP, and India RTI. ## Acceptance The dated landscape document is refreshed from primary sources, Alaveteli exclusions are explicit, and eve [Read the thread](https://github.com/edithatogo/fyi-cli/issues/195) · 2026-07-12 · closed · 2 comments ### Remote MCP: bounded attachment write contract Parent: #169\nRelated: #171\n\nImplement the remaining governed attachment contract: bounded attachment count, per-file and total byte limits, MIME allowlist, canonical path handling, no symlink escape, deterministic cleanup/rollback, WireMock coverage, property/security tests, and offline end-to-end prepare/commit/replay scenarios.\n\nThis follow-up is intentionally separate because PR #178/#180 reject attachment-bearing writes until these controls are implemented. [Read the thread](https://github.com/edithatogo/fyi-cli/issues/181) · 2026-07-11 · closed · 2 comments ### Remote MCP: contract compatibility and aggressive harness engineering Parent: #169 ## Scope Build the compatibility and aggressive harness layer for remote MCP tools across supported Alaveteli variants and MCP clients. ## Acceptance criteria - [ ] Versioned shared fixtures cover representative Alaveteli JSON, RSS, Atom, and error variants. - [ ] Contract tests verify every remote tool schema, annotations, structured content, and error envelope. - [ ] Property tests cover bounds, state expectations, pagination, URL and path normalization, and redaction. - [ ] M [Read the thread](https://github.com/edithatogo/fyi-cli/issues/173) · 2026-07-11 · closed · 2 comments ### Remote MCP: security policy, observability, and operator controls Parent: #169 ## Scope Harden remote MCP operations with capability policy, operator controls, structured observability, auditability, and safe failure behavior. ## Acceptance criteria - [ ] Per-instance allowlist and read/write capability policy are validated at startup. - [ ] Health and status surfaces report enabled capabilities without exposing secrets. - [ ] Structured spans cover MCP request, SyncClient operation, pacing, cache, guardrail outcomes, and correlation IDs. - [ ] Metrics inc [Read the thread](https://github.com/edithatogo/fyi-cli/issues/172) · 2026-07-11 · closed · 2 comments ### Remote MCP: governed write tools and confirmation flow Parent: #169 ## Scope Add explicitly enabled remote write MCP tools for request creation, correspondence with bounded attachments, and optimistic state updates. ## Acceptance criteria - [ ] Separate remote-write capability flag; read enablement never implies write enablement. - [ ] Credentials come only from protected server configuration or keyring integration. - [ ] Tools require confirmation tokens or an equivalent two-step prepare/commit contract. - [ ] update_request_state_if_current pr [Read the thread](https://github.com/edithatogo/fyi-cli/issues/171) · 2026-07-11 · closed · 2 comments ### Remote MCP: guarded read-only SyncClient tools Parent: #169 ## Scope Expose opt-in read-only MCP tools backed by SyncClient: remote health, version, search, request retrieval, authority discovery, and authority feed discovery/pull planning. ## Acceptance criteria - [ ] Remote tools are disabled by default and enabled through validated server configuration. - [ ] Tools reuse ClientIdentity, SSRF validation, rate/back-pressure, concurrency, cache, byte/time/request limits, and redacted errors. - [ ] Stable MCP input/output schemas and anno [Read the thread](https://github.com/edithatogo/fyi-cli/issues/170) · 2026-07-11 · closed · 2 comments ### Epic: Guarded remote Alaveteli tools for the MCP server ## Objective Extend the Rust MCP server beyond local SQLite operations with an opt-in, resource-aware remote Alaveteli surface backed by yi_core::sync::SyncClient. ## Delivery principles - Read-only tools land before writes. - Remote access is disabled by default and bounded by existing identity, SSRF, rate-limit, cache, concurrency, response-size, and trace controls. - Credentials come from protected configuration, never MCP tool arguments or error payloads. - Every tool has a stable input/ [Read the thread](https://github.com/edithatogo/fyi-cli/issues/169) · 2026-07-11 · closed · 2 comments The remaining reports are on [the project's issue tracker](https://github.com/edithatogo/fyi-cli/issues).