` under ~400 characters of doctype/stylesheet boilerplate. Observed while driving Loom with a local open-weight model against usegalaxy.org: ``` Error: Error calling tool 'run_tool': Run tool failed: Unexpected HTTP status code: 400: `, dropping t [Read the thread](https://github.com/galaxyproject/galaxy-mcp/issues/78) · 2026-06-19 · open · 0 comments ### invoke_workflow rejects `inputs`/`params` sent as JSON strings (Optional[dict] drops the schema type) ### Summary Calling `invoke_workflow` with an `inputs` mapping fails with a pydantic `dict_type` error when the MCP client serializes the object argument as a JSON **string**. `run_tool` (same shape of dataset-mapping argument) works fine, which points at a schema-typing difference rather than user error. ### Environment - galaxy-mcp: v1.8.0 (installed via `uvx`) - - Python 3.12, macOS - - - Client: an MCP host whose tool-arg serializer omits object args for parameters that lack an explicit JSO [Read the thread](https://github.com/galaxyproject/galaxy-mcp/issues/72) · 2026-06-14 · closed · outside contributor · 0 comments ### Authorization codes are replayable within their TTL (single-use not enforced) The OAuth provider issues stateless, encrypted authorization codes but never marks one as used, so the same code can be exchanged for tokens repeatedly until it expires (5-minute TTL). RFC 6749 §10.5 / §4.1.2 require authorization codes to be single-use. **Where:** `exchange_authorization_code` in `mcp-server-galaxy-py/src/galaxy_mcp/auth.py` only checks expiry + client binding and then re-issues tokens -- it never invalidates the code. Nothing upstream covers it either: the MCP SDK token handl [Read the thread](https://github.com/galaxyproject/galaxy-mcp/issues/68) · 2026-06-10 · closed · 0 comments ### Tool-input template steers agents into unsatisfiable conditional branches (empty dynamic selects); add a data-availability lookup Surfaced from a loom beta report (galaxyproject/loom#198): an agent running RNA STARSolo got `400 ... "Parameter 'genomeDir': requires a value, but no legal values defined"` and couldn't recover reliably (small model -- DeepSeek). ## What's actually happening That error string is raised by Galaxy core (`lib/galaxy/tools/parameters/basic.py`, the `not legal_values` branch in `SelectToolParameter.from_json`). It's only reached when a value *was* submitted and the resolved legal-value set is empt [Read the thread](https://github.com/galaxyproject/galaxy-mcp/issues/62) · 2026-06-07 · open · 0 comments ### file upload from remote MCP clients (binary + text) Hi when using the Galaxy MCP server in **remote/HTTP mode** (i.e., `"type": "http"` in the MCP config), the `upload_file(path)` tool cannot upload files from the client's local filesystem. It seems the `path` parameter is resolved on the **server side**, so it fails with: ``` File not found: 'C:\Users\...\myfile.bam' (absolute: '/app/C:\Users\...\myfile.bam') ``` This effectively means that **any AI agent connected to a remote Galaxy MCP server cannot upload local user files** — which is a co [Read the thread](https://github.com/galaxyproject/galaxy-mcp/issues/43) · 2026-04-15 · open · external user · 0 comments ### When encountering dataset collections in history, agents use get_dataset_details with unexpected outputs I have histories with datasets collections, when I ask for the agent using the MCP to get information about the contents of that dataset collection, it uses its collection id directly on the get_dataset_details method (at the absence of something else I suspect), as if it was the id of a dataset. What I would like is that the agent can navigate through the members of the dataset collection. [Read the thread](https://github.com/galaxyproject/galaxy-mcp/issues/19) · 2025-10-23 · closed · 0 comments The remaining reports are on [the project's issue tracker](https://github.com/galaxyproject/galaxy-mcp/issues).