Reported issues for FYI MCP

Pod holds 17 of 25 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to FYI MCP.

Most discussed

Track follow-up: Glama review and indexing for fyi-mcp

Summary

Glama accepted the fyi-mcp server submission, but the public Glama MCP server index does not yet show fyi-mcp under author:edithatogo.

Acceptance Criteria

Glama public search lists fyi-mcp for author:edithatogo.
The server page has a useful description and capability/tool metadata.
Any Glama score or metadata warnings are captured in a follow-u

Read the thread · 2026-07-01 · closed · 11 comments

Plan an opt-in endorsed CLI/MCP route to reduce Alaveteli bot overload

Purpose

Prepare a maintainer-friendly proposal for Alaveteli: an explicitly opt-in, sysadmin-controlled route for fyi-cli and MCP clients that gives well-behaved users a direct way to engage with an instance while reducing accidental overload from ad-hoc clients, scrapers, and bulk retrieval.

This issue is planning and evidence work in edithatogo/fyi-cli. It does not open an upstream Alaveteli issue or pull request yet.

Problem framing

Many clients are likely not trying to overload a

Read the thread · 2026-07-10 · closed · 6 comments

Harden reproducible release source for package submissions

Parent: #194

Complete release-source hardening: signed artifacts, SBOM, provenance, hashes, release compatibility matrix, rollback metadata, and package install smoke tests. Keep every package status evidence-backed.

Read the thread · 2026-07-12 · closed · 5 comments

Run fork-local Alaveteli contract verification and close out interoperability

Parent: https://github.com/edithatogo/fyi-cli/issues/140 Paired server issue: to be linked after creation in edithatogo/alaveteli.

Scope

Consume the shared server fixtures, run the complete offline contract suite, optionally run one bounded live smoke test, and reconcile both Conductor tracks.

One-PR boundary

Verification, documentation, and Conductor metadata only. No new behavior.

Required evidence

Shared contract version and reciprocal issue links in both repositories.
CI ev

Read the thread · 2026-07-10 · closed · 4 comments

bleeding-edge-features: Implement MCP resources for corpus exposure

Expose archived FOI corpora as MCP resources (not just tools) for AI assistant consumption.

Read the thread · 2026-07-08 · closed · 3 comments

registry-distribution-expansion: Submit to Docker MCP Catalog

Add fyi-mcp to Docker MCP Catalog; ensure container image is listed.

Read the thread · 2026-07-08 · closed · 3 comments

registry-distribution-expansion: Submit to mcp.so catalog

Add fyi-mcp to mcp.so catalog; automate submission if API available.

Read the thread · 2026-07-08 · closed · 3 comments

registry-distribution-expansion: Submit to PulseMCP catalog

Add fyi-mcp to PulseMCP catalog; automate submission if API available.

Read the thread · 2026-07-08 · closed · 3 comments

Most recent

Add bounded Wayback replay adapter

Expose fyi internet-archive-replay for approved CDX rows, with host/redirect allowlists, status/length/digest verification, raw payload output, checkpoints, and receipts. Parent: #309.

Read the thread · 2026-08-12 · open · 1 comment

[Cross-repo] Emit RIOPA-compatible capture and provenance events

Adopt the shared RIOPA provenance profile without replacing the existing tamper-evident payload hash chain.

Scope

Map current ProvenanceRecord fields into artifact/capture events.
Preserve current chain verification as integrity evidence.
Emit source, input/output, agent, rights and schema references alongside current outputs.
Add golden fixtures and round-trip validation against riopa-infrastructure.

Acceptance

Existing chain tests remain green.
One real/synthetic capt

Read the thread · 2026-07-27 · closed · 0 comments

Epic: map non-Alaveteli FOI platforms

Objective

Execute .conductor/tracks/foi-platform-landscape_20260712/.

Scope

Maintain a source-backed map of non-Alaveteli FOI platforms, API contracts, jurisdiction, authentication, write semantics, rate limits, privacy requirements, and integration feasibility.

Initial candidates

MuckRock, FragDenStaat/Froide, FOIA.gov, USCIS FOIA/PA, Canada ATIP, and India RTI.

Acceptance

The dated landscape document is refreshed from primary sources, Alaveteli exclusions are explicit, and eve

Read the thread · 2026-07-12 · closed · 2 comments

Remote MCP: bounded attachment write contract

Parent: #169\nRelated: #171\n\nImplement the remaining governed attachment contract: bounded attachment count, per-file and total byte limits, MIME allowlist, canonical path handling, no symlink escape, deterministic cleanup/rollback, WireMock coverage, property/security tests, and offline end-to-end prepare/commit/replay scenarios.\n\nThis follow-up is intentionally separate because PR #178/#180 reject attachment-bearing writes until these controls are implemented.

Read the thread · 2026-07-11 · closed · 2 comments

Remote MCP: contract compatibility and aggressive harness engineering

Parent: #169

Scope

Build the compatibility and aggressive harness layer for remote MCP tools across supported Alaveteli variants and MCP clients.

Acceptance criteria

Versioned shared fixtures cover representative Alaveteli JSON, RSS, Atom, and error variants.
Contract tests verify every remote tool schema, annotations, structured content, and error envelope.
Property tests cover bounds, state expectations, pagination, URL and path normalization, and redaction.
M

Read the thread · 2026-07-11 · closed · 2 comments

Remote MCP: security policy, observability, and operator controls

Parent: #169

Scope

Harden remote MCP operations with capability policy, operator controls, structured observability, auditability, and safe failure behavior.

Acceptance criteria

Per-instance allowlist and read/write capability policy are validated at startup.
Health and status surfaces report enabled capabilities without exposing secrets.
Structured spans cover MCP request, SyncClient operation, pacing, cache, guardrail outcomes, and correlation IDs.
Metrics inc

Read the thread · 2026-07-11 · closed · 2 comments

Remote MCP: governed write tools and confirmation flow

Parent: #169

Scope

Add explicitly enabled remote write MCP tools for request creation, correspondence with bounded attachments, and optimistic state updates.

Acceptance criteria

Separate remote-write capability flag; read enablement never implies write enablement.
Credentials come only from protected server configuration or keyring integration.
Tools require confirmation tokens or an equivalent two-step prepare/commit contract.
update_request_state_if_current pr

Read the thread · 2026-07-11 · closed · 2 comments

Remote MCP: guarded read-only SyncClient tools

Parent: #169

Scope

Expose opt-in read-only MCP tools backed by SyncClient: remote health, version, search, request retrieval, authority discovery, and authority feed discovery/pull planning.

Acceptance criteria

Remote tools are disabled by default and enabled through validated server configuration.
Tools reuse ClientIdentity, SSRF validation, rate/back-pressure, concurrency, cache, byte/time/request limits, and redacted errors.
Stable MCP input/output schemas and anno

Read the thread · 2026-07-11 · closed · 2 comments

Epic: Guarded remote Alaveteli tools for the MCP server

Objective

Extend the Rust MCP server beyond local SQLite operations with an opt-in, resource-aware remote Alaveteli surface backed by yi_core::sync::SyncClient.

Delivery principles

Read-only tools land before writes.
Remote access is disabled by default and bounded by existing identity, SSRF, rate-limit, cache, concurrency, response-size, and trace controls.
Credentials come from protected configuration, never MCP tool arguments or error payloads.
Every tool has a stable input/

Read the thread · 2026-07-11 · closed · 2 comments

The remaining reports are on the project's issue tracker.