# Reported issues for infra-lens-mcp Pod holds 19 of 44 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [infra-lens-mcp](/mcp/infra-lens-mcp). ## Most discussed ### [P0] Reconcile published 1.0.6 artifacts with GitHub release state ## Summary `infra-lens-mcp@1.0.6` is available on npm and `io.github.oaslananka/infra-lens-mcp@1.0.6` is active in the MCP Registry, but the repository does not contain a matching `infra-lens-mcp-v1.0.6` Git tag or GitHub Release. The local release-state check therefore correctly reports the current version as blocked and unsafe to republish. Release Please also generated PR #73 for `1.1.0`, but that pull request was closed without merge. The project needs one canonical release lineage before [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/1) · 2026-05-26 · closed · 8 comments ### [P1] Replace Snyk PR signal with OSV-Scanner gates Snyk was removed after plan limits made its PR signal unreliable. - [ ] Add a blocking OSV-Scanner pull-request delta scan for `pnpm-lock.yaml`. - [ ] Add full scans on `main`, weekly schedule, and manual dispatch with SARIF upload. - [ ] Pin the official OSV reusable workflows to immutable commit SHAs. - [ ] Keep Dependency Review, Trivy, Renovate/Dependabot alerts, Semgrep, CodeQL, Gitleaks, and GitHub secret scanning in their distinct roles. - [ ] Remove Snyk references from tooling and repo [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/112) · 2026-07-21 · closed · 4 comments ### [P0] Patch newly disclosed OSV advisories before completing 1.4.x release ## Summary The `infra-lens-mcp-v1.4.0` release commit passed the protected PR delta scan, but the subsequent full OSV scan detected two newly disclosed, fixable advisories after merge: - `GHSA-9mqv-5hh9-4cgg`: `@hono/node-server` 2.0.5, fixed in 2.0.10 - `GHSA-v2hh-gcrm-f6hx`: `fast-uri` 3.1.3, fixed in 3.1.4 npm and MCP Registry publication for 1.4.0 completed before the failure was observed. GHCR publication and release reconciliation were cancelled. Immutable 1.4.0 artifacts must not be mo [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/119) · 2026-07-22 · closed · 2 comments ### [P0] Separate baseline samples from incident observations ## Summary The current persistence flow stores ordinary snapshots and sampled incident observations under the same default label used by anomaly baselines. In `analyze_server`, the newly collected incident snapshot is persisted before `analyzeSnapshot` loads the baseline. This allows the event being evaluated, and earlier unhealthy observations, to influence the baseline used to judge that event. ## Impact - Repeated incidents can gradually become normalized as expected behavior. - CPU z-scor [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/81) · 2026-07-20 · closed · 2 comments ### [P2] Define Renovate, audit, and dependency override governance ## Summary The repository has a mature `renovate.json` policy and an active Renovate Dependency Dashboard, but `docs/security.md` still describes Dependabot as the canonical version-update automation. No `.github/dependabot.yml` file exists, and GitHub-native Dependabot security updates are currently disabled. The documented policy and operational implementation must identify one source of truth. The 2026-07-20 local audit also reported one low-severity development-only advisory through Jest/B [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/69) · 2026-06-24 · closed · 2 comments ### [P1] Harden Docker image and publish signed multi-arch artifacts Docker support exists, but public production adoption benefits from multi-arch images, attestations, signatures, and runtime hardening guidance. - [ ] Add multi-arch image build path. - [ ] Add OCI image labels. - [ ] Attach SBOM and attestation artifacts. - [ ] Add image signing strategy. - [ ] Document read-only filesystem and volume examples. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/61) · 2026-06-24 · closed · 2 comments ### [P0] Patch newly disclosed OSV advisories and repair 1.3.0 release drift The first fail-closed OSV full scan after merging release 1.3.0 detected six newly disclosed, fixable advisories in existing lockfile resolutions: - `@hono/node-server` 1.19.14 → 2.0.5 - `hono` 4.12.25 → 4.12.27 - `fast-uri` 3.1.2 → 3.1.3 - `linkify-it` 5.0.1 → 5.0.2 Runtime paths originate from `@modelcontextprotocol/sdk@1.29.0`; the dev-only path originates from `typedoc@0.28.19`. npm 1.3.0 completed before release cancellation, while GHCR and MCP Registry were cancelled. Acceptance criteri [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/114) · 2026-07-21 · closed · 1 comment ### [P1] Verify npm Trusted Publishing provenance and release environment end-to-end Release ADRs mention trusted publishing, provenance, SBOMs, and checksums. The full flow needs an end-to-end verification issue. - [ ] Confirm npm trusted publisher settings for the exact workflow. - [ ] Confirm OIDC permissions and release environment rules. - [ ] Confirm provenance, SBOM, and checksum artifacts. - [ ] Confirm repository metadata matches package provenance requirements. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/62) · 2026-06-24 · closed · 1 comment ## Most recent ### [CI] Add Codecov coverage and test analytics integration ## Summary Integrate Codecov with the repository's existing Jest coverage pipeline and expose failed-test reporting without weakening local coverage gates. ## Scope - Add a repository-level `codecov.yml` with conservative project and patch reporting. - Upload `coverage/lcov.info` and `coverage/cobertura-coverage.xml` from the canonical Node 24 CI job. - Generate JUnit XML from Jest and upload it through Codecov Test Analytics even when tests fail. - Authenticate uploads with GitHub OIDC inste [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/104) · 2026-07-20 · closed · 0 comments ### [P1] Align MCP annotations, metadata, and client configuration with runtime behavior ## Summary Several public MCP contracts and client examples no longer match the actual runtime: - `analyze_server` and `snapshot` declare `readOnlyHint: true` even though both persist SQLite records. - Runtime registration exposes `inspect_host_capabilities`, but `mcp.json` does not list it. - Client examples set `INFRA_LENS_TRANSPORT`, while documentation and Docker metadata refer to `MCP_TRANSPORT`; neither variable currently selects the entry point. - `.env.example` advertises OpenTelemetry [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/83) · 2026-07-20 · closed · 0 comments ### [P1] Derive network and kernel anomalies from bounded collection windows ## Summary Network errors and drops are currently evaluated from cumulative `/proc/net/dev` counters. Any historical packet error can therefore continue producing an anomaly on every later run even when the interface is healthy. Kernel error collection similarly counts the last lines returned by `dmesg` without proving that the events occurred inside the requested analysis window. ## Impact - Stale network and kernel events can create persistent false positives. - Severity is based on lifetim [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/82) · 2026-07-20 · closed · 0 comments ### [P2] Clarify Node support policy and compatibility matrix Node support policy should be explicit and consistent across README, engines, version files, and CI. - [ ] Document supported Node versions. - [ ] Align type packages and CI matrix with the policy. - [ ] Consider a non-blocking future-version compatibility job. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/72) · 2026-06-24 · closed · 0 comments ### [P2] Add examples and golden-output fixtures for common incidents Agents improve faster when the repo provides canonical examples and expected outputs for common operational incidents. - [ ] Add high CPU example. - [ ] Add memory pressure example. - [ ] Add disk and inode pressure example. - [ ] Add network pressure example. - [ ] Add service or container pressure example. - [ ] Keep fixtures stable and reviewed. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/70) · 2026-06-24 · closed · 0 comments ### [P2] Add release governance checks for branch protection required CI and repo settings Repository settings also determine release safety. - [ ] Document required repo settings. - [ ] Add branch protection checklist. - [ ] Track required status checks by exact workflow names. - [ ] Record external settings that cannot be verified automatically. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/68) · 2026-06-24 · closed · 0 comments ### [P1] Build a security threat model and abuse-case regression suite ## Summary The server crosses multiple trust boundaries: MCP clients, HTTP gateways, local SQLite persistence, SSH identities, remote Linux hosts, collected process data, and model-visible tool output. A written threat model and executable abuse-case suite are required before public connector or multi-user deployment is considered production-ready. ## Required work - [ ] Document actors, assets, entry points, trust boundaries, and data flows for stdio, guarded HTTP, OAuth gateway, SQLite, and [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/67) · 2026-06-24 · closed · 0 comments ### [P2] Prepare MCP TypeScript SDK v2 migration spike Prepare a controlled spike for the next major MCP SDK line without blocking current stable production use. - [ ] Create an ADR for SDK migration strategy. - [ ] Identify API and package split changes. - [ ] Test tool schema and HTTP transport implications in a spike. - [ ] Keep unstable APIs out of the production branch unless explicitly approved. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/66) · 2026-06-24 · closed · 0 comments ### [P2] Add performance and resource budget gates for sampling and SSH execution Long sampling, SSH execution, and output size can regress silently unless budgets are explicit. - [ ] Define latency, memory, output-size, and command-count budgets. - [ ] Add synthetic large-history tests. - [ ] Add timeout and cleanup assertions. - [ ] Document expected performance envelope. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/65) · 2026-06-24 · closed · 0 comments ### [P2] Raise branch and entry-point coverage on critical runtime paths ## Summary Overall test coverage is strong, but critical-path branch coverage remains uneven. On 2026-07-20 the local coverage run reported approximately: - Global branches: 74.65% - `collector.ts` branches: 56.72% - `http-security.ts` branches: 79.72% - `ssh.ts` branches: 82.91% - `shutdown.ts` branches: 0% The executable entry points `src/mcp.ts` and `src/server-http.ts` are excluded from coverage, so process startup, real socket behavior, transport wiring, and signal handling are not valid [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/64) · 2026-06-24 · closed · 0 comments ### [P1] Add connector-ready documentation for ChatGPT Claude Cursor VS Code and local stdio Each supported host or client needs exact install, configuration, security, and troubleshooting instructions. - [ ] Add ChatGPT remote connector guide. - [ ] Add Claude/local stdio guide. - [ ] Add Cursor, Windsurf, VS Code examples. - [ ] Add HTTP reverse-proxy examples. - [ ] Add troubleshooting matrix. [Read the thread](https://github.com/oaslananka/infra-lens-mcp/issues/63) · 2026-06-24 · closed · 0 comments The remaining reports are on [the project's issue tracker](https://github.com/oaslananka/infra-lens-mcp/issues).