Reported issues for humane-proxy

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to humane-proxy.

Most discussed

[Backend] Upgrade Redis Backend for Multi-Process / Distributed Environments

🎯 Objective

Refactor the current Redis storage backend to properly support multi-process (e.g., multiple Uvicorn workers) and distributed environments using atomic operations or distributed locks.

💡 Why this matters

Currently, HumaneProxy supports Redis as a backend, but the rate-limiting and trajectory window logic relies on in-memory state or non-atomic Redis operations. If an enterprise deploys HumaneProxy behind a load balancer with 4 Gunicorn/Uvicorn workers, race conditions can oc

Read the thread · 2026-04-04 · open · 10 comments

[BUG] Direct SQLite Bypass in Admin API, CLI, and MCP

Describe the Bug

The Admin API endpoints, CLI query tools hp escalations/hp session, and the MCP tool list_recent_escalations bypass the active swappable storage backend (Postgres/Redis) and query a local SQLite database directly using sqlite3.connect().

To Reproduce

Steps to reproduce the behaviour:

Configure humane_proxy.yaml to use a non-default storage backend:

storage:
  backend: "redis"
  redis:
    url: "redis://localhost:6379/0"

Log an escala

Read the thread · 2026-05-29 · closed · external user · 7 comments

[Feature] Add --dry-run flag to humane-proxy start

hey @Vishisht16 , Operators have no way to validate a full deployment config before going live. A --dry-run flag on humane-proxy start should: parse humane_proxy.yaml, verify Stage 3 API keys with a lightweight probe, send a test ping to configured webhooks, and print the resolved active pipeline config — then exit without binding a port. Lives depend on correct configuration; this makes misconfiguration visible before it matters.

Read the thread · 2026-05-21 · open · external user · 7 comments

Security hardening: protect HTTP MCP tools and make risk snapshot reads side-effect free

Description

While reviewing the MCP and agent-integration surfaces, I noticed that HumaneProxy's HTTP MCP mode can expose sensitive safety/audit tools without an authentication boundary, and the session-risk read path appears to mutate trajectory state.

The MCP server exposes tools such as check_message_safety, get_session_risk, and list_recent_escalations. This is useful for agent workflows, but the HTTP transport currently binds broadly and does not appear to require a token before

Read the thread · 2026-05-15 · closed · external user · 3 comments

Insecure Default / Unauthenticated MCP Server Exposure

File: humane_proxy/mcp_server.py Description: In serve_http(), the code checks if the server is binding to a public host (e.g., 0.0.0.0) via _is_public_bind_host(host). If it is public and no authentication token (HUMANE_PROXY_ADMIN_KEY) is provided, it only logs a warning instead of raising an error or enforcing authentication. It then proceeds to call mcp.run(...) without the auth provider. Impact: This exposes the MCP server unauthenticated to the public internet by default if an admin misses

Read the thread · 2026-06-02 · closed · outside contributor · 2 comments

No audit log for blocked requests: safety decisions are unverifiable and unmonitorable

Summary

When the pipeline blocks a message, there is no persistent record of:

Which stage triggered the block (heuristics, embeddings, or LLM)
The input that was blocked (even in hashed form)
A timestamp and the requester's identifier

Without audit logs, it is impossible to:

Measure the false positive rate.
Investigate reports of incorrect blocks.
Demonstrate compliance to auditors.
Detect if the proxy is being systematically bypassed.

Impact

Operators cannot improve th

Read the thread · 2026-07-31 · open · external user · 1 comment

Most recent

The remaining reports are on the project's issue tracker.