Reported issues for infra-lens-mcp

Pod holds 19 of 44 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to infra-lens-mcp.

Most discussed

[P0] Reconcile published 1.0.6 artifacts with GitHub release state

Summary

infra-lens-mcp@1.0.6 is available on npm and io.github.oaslananka/infra-lens-mcp@1.0.6 is active in the MCP Registry, but the repository does not contain a matching infra-lens-mcp-v1.0.6 Git tag or GitHub Release. The local release-state check therefore correctly reports the current version as blocked and unsafe to republish.

Release Please also generated PR #73 for 1.1.0, but that pull request was closed without merge. The project needs one canonical release lineage before

Read the thread · 2026-05-26 · closed · 8 comments

[P1] Replace Snyk PR signal with OSV-Scanner gates

Snyk was removed after plan limits made its PR signal unreliable.

• Add a blocking OSV-Scanner pull-request delta scan for pnpm-lock.yaml.
• Add full scans on main, weekly schedule, and manual dispatch with SARIF upload.
• Pin the official OSV reusable workflows to immutable commit SHAs.
• Keep Dependency Review, Trivy, Renovate/Dependabot alerts, Semgrep, CodeQL, Gitleaks, and GitHub secret scanning in their distinct roles.
• Remove Snyk references from tooling and repo

Read the thread · 2026-07-21 · closed · 4 comments

[P0] Patch newly disclosed OSV advisories before completing 1.4.x release

Summary

The infra-lens-mcp-v1.4.0 release commit passed the protected PR delta scan, but the subsequent full OSV scan detected two newly disclosed, fixable advisories after merge:

• GHSA-9mqv-5hh9-4cgg: @hono/node-server 2.0.5, fixed in 2.0.10
• GHSA-v2hh-gcrm-f6hx: fast-uri 3.1.3, fixed in 3.1.4

npm and MCP Registry publication for 1.4.0 completed before the failure was observed. GHCR publication and release reconciliation were cancelled. Immutable 1.4.0 artifacts must not be mo

Read the thread · 2026-07-22 · closed · 2 comments

[P0] Separate baseline samples from incident observations

Summary

The current persistence flow stores ordinary snapshots and sampled incident observations under the same default label used by anomaly baselines. In analyze_server, the newly collected incident snapshot is persisted before analyzeSnapshot loads the baseline. This allows the event being evaluated, and earlier unhealthy observations, to influence the baseline used to judge that event.

Impact

• Repeated incidents can gradually become normalized as expected behavior.
• CPU z-scor

Read the thread · 2026-07-20 · closed · 2 comments

[P2] Define Renovate, audit, and dependency override governance

Summary

The repository has a mature renovate.json policy and an active Renovate Dependency Dashboard, but docs/security.md still describes Dependabot as the canonical version-update automation. No .github/dependabot.yml file exists, and GitHub-native Dependabot security updates are currently disabled. The documented policy and operational implementation must identify one source of truth.

The 2026-07-20 local audit also reported one low-severity development-only advisory through Jest/B

Read the thread · 2026-06-24 · closed · 2 comments

[P1] Harden Docker image and publish signed multi-arch artifacts

Docker support exists, but public production adoption benefits from multi-arch images, attestations, signatures, and runtime hardening guidance.

• Add multi-arch image build path.
• Add OCI image labels.
• Attach SBOM and attestation artifacts.
• Add image signing strategy.
• Document read-only filesystem and volume examples.

Read the thread · 2026-06-24 · closed · 2 comments

[P0] Patch newly disclosed OSV advisories and repair 1.3.0 release drift

The first fail-closed OSV full scan after merging release 1.3.0 detected six newly disclosed, fixable advisories in existing lockfile resolutions:

• @hono/node-server 1.19.14 → 2.0.5
• hono 4.12.25 → 4.12.27
• fast-uri 3.1.2 → 3.1.3
• linkify-it 5.0.1 → 5.0.2

Runtime paths originate from @modelcontextprotocol/sdk@1.29.0; the dev-only path originates from typedoc@0.28.19. npm 1.3.0 completed before release cancellation, while GHCR and MCP Registry were cancelled.

Acceptance criteri

Read the thread · 2026-07-21 · closed · 1 comment

[P1] Verify npm Trusted Publishing provenance and release environment end-to-end

Release ADRs mention trusted publishing, provenance, SBOMs, and checksums. The full flow needs an end-to-end verification issue.

• Confirm npm trusted publisher settings for the exact workflow.
• Confirm OIDC permissions and release environment rules.
• Confirm provenance, SBOM, and checksum artifacts.
• Confirm repository metadata matches package provenance requirements.

Read the thread · 2026-06-24 · closed · 1 comment

Most recent

[CI] Add Codecov coverage and test analytics integration

Summary

Integrate Codecov with the repository's existing Jest coverage pipeline and expose failed-test reporting without weakening local coverage gates.

Scope

• Add a repository-level codecov.yml with conservative project and patch reporting.
• Upload coverage/lcov.info and coverage/cobertura-coverage.xml from the canonical Node 24 CI job.
• Generate JUnit XML from Jest and upload it through Codecov Test Analytics even when tests fail.
• Authenticate uploads with GitHub OIDC inste

Read the thread · 2026-07-20 · closed · 0 comments

[P1] Align MCP annotations, metadata, and client configuration with runtime behavior

Summary

Several public MCP contracts and client examples no longer match the actual runtime:

• analyze_server and snapshot declare readOnlyHint: true even though both persist SQLite records.
• Runtime registration exposes inspect_host_capabilities, but mcp.json does not list it.
• Client examples set INFRA_LENS_TRANSPORT, while documentation and Docker metadata refer to MCP_TRANSPORT; neither variable currently selects the entry point.
• .env.example advertises OpenTelemetry

Read the thread · 2026-07-20 · closed · 0 comments

[P1] Derive network and kernel anomalies from bounded collection windows

Summary

Network errors and drops are currently evaluated from cumulative /proc/net/dev counters. Any historical packet error can therefore continue producing an anomaly on every later run even when the interface is healthy. Kernel error collection similarly counts the last lines returned by dmesg without proving that the events occurred inside the requested analysis window.

Impact

• Stale network and kernel events can create persistent false positives.
• Severity is based on lifetim

Read the thread · 2026-07-20 · closed · 0 comments

[P2] Clarify Node support policy and compatibility matrix

Node support policy should be explicit and consistent across README, engines, version files, and CI.

• Document supported Node versions.
• Align type packages and CI matrix with the policy.
• Consider a non-blocking future-version compatibility job.

Read the thread · 2026-06-24 · closed · 0 comments

[P2] Add examples and golden-output fixtures for common incidents

Agents improve faster when the repo provides canonical examples and expected outputs for common operational incidents.

• Add high CPU example.
• Add memory pressure example.
• Add disk and inode pressure example.
• Add network pressure example.
• Add service or container pressure example.
• Keep fixtures stable and reviewed.

Read the thread · 2026-06-24 · closed · 0 comments

[P2] Add release governance checks for branch protection required CI and repo settings

Repository settings also determine release safety.

• Document required repo settings.
• Add branch protection checklist.
• Track required status checks by exact workflow names.
• Record external settings that cannot be verified automatically.

Read the thread · 2026-06-24 · closed · 0 comments

[P1] Build a security threat model and abuse-case regression suite

Summary

The server crosses multiple trust boundaries: MCP clients, HTTP gateways, local SQLite persistence, SSH identities, remote Linux hosts, collected process data, and model-visible tool output. A written threat model and executable abuse-case suite are required before public connector or multi-user deployment is considered production-ready.

Required work

• Document actors, assets, entry points, trust boundaries, and data flows for stdio, guarded HTTP, OAuth gateway, SQLite, and

Read the thread · 2026-06-24 · closed · 0 comments

[P2] Prepare MCP TypeScript SDK v2 migration spike

Prepare a controlled spike for the next major MCP SDK line without blocking current stable production use.

• Create an ADR for SDK migration strategy.
• Identify API and package split changes.
• Test tool schema and HTTP transport implications in a spike.
• Keep unstable APIs out of the production branch unless explicitly approved.

Read the thread · 2026-06-24 · closed · 0 comments

[P2] Add performance and resource budget gates for sampling and SSH execution

Long sampling, SSH execution, and output size can regress silently unless budgets are explicit.

• Define latency, memory, output-size, and command-count budgets.
• Add synthetic large-history tests.
• Add timeout and cleanup assertions.
• Document expected performance envelope.

Read the thread · 2026-06-24 · closed · 0 comments

[P2] Raise branch and entry-point coverage on critical runtime paths

Summary

Overall test coverage is strong, but critical-path branch coverage remains uneven. On 2026-07-20 the local coverage run reported approximately:

• Global branches: 74.65%
• collector.ts branches: 56.72%
• http-security.ts branches: 79.72%
• ssh.ts branches: 82.91%
• shutdown.ts branches: 0%

The executable entry points src/mcp.ts and src/server-http.ts are excluded from coverage, so process startup, real socket behavior, transport wiring, and signal handling are not valid

Read the thread · 2026-06-24 · closed · 0 comments

[P1] Add connector-ready documentation for ChatGPT Claude Cursor VS Code and local stdio

Each supported host or client needs exact install, configuration, security, and troubleshooting instructions.

• Add ChatGPT remote connector guide.
• Add Claude/local stdio guide.
• Add Cursor, Windsurf, VS Code examples.
• Add HTTP reverse-proxy examples.
• Add troubleshooting matrix.

Read the thread · 2026-06-24 · closed · 0 comments

The remaining reports are on the project's issue tracker.