Reported issues for Kody
Pod holds 17 of 26 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to Kody.
Most discussed
PLAN: heykody.app → kody.codes cutover (awaiting explicit GO from Kent)
[!IMPORTANT]
⛔ GATE: PLAN ONLY — nothing below executes until Kent comments "go" (or tells the agent directly)
No DNS changes, no Cloudflare changes, no OAuth console changes, no variable flips, no merges to
main. Branch prep marked [preparable] may be built and CI'd but stays unmerged. Everything marked [blocking-Kent] or [flip] waits for the gate.
Decision: the public apex moves heykody.app → kody.codes. heykody.app keeps working as a redirect indefinitely. This is
Read the thread · 2026-08-13 · closed · 3 comments
Future work: untangle MCP from the Remix app; nightly test-suite cleanup automation
Tracking issue for two deferred items from the mono-worker extraction program (ADR 0016).
1. Untangle MCP from the Remix app
Today the MCP server and the Remix app live in the same worker (packages/worker) and share auth/session/D1 plumbing. ADR 0016 deliberately stopped the extraction at the runtime and jobs lanes because MCP↔app coupling is the tightest seam — but it remains worth investigating.
Motivations:
- Independent deploy/rollback for the MCP surface (the fastest-evolving protoc
Read the thread · 2026-08-12 · closed · outside contributor · 3 comments
Repro needed: opaque Spotify device ID rejected as sensitive by a safety guard
From platform feedback aea5c250: passing an opaque Spotify device ID to
@kentcdodds/spotify/play-context triggered a safety rejection ("classified as a
credential / sensitive personal identifier"); retrying without the device ID succeeded.
I could not locate a platform-side classifier that would reject an opaque provider
resource ID — nothing in the secrets or capability-input path
(packages/worker/src/mcp/secrets/…) does content classification of argument values.
So this is either packag
Read the thread · 2026-08-12 · closed · outside contributor · 2 comments
Cleanup: remove MCP agent session one-shot backfill tooling after production marker
Context
Migration 0086 + the operator sweep (npm run backfill:mcp-agent-sessions / 🧭 Backfill MCP agent sessions workflow) index dormant MCP Agent Durable Objects into mcp_agent_sessions and write deployment_backfill_markers key mcp_agent_sessions version 1. Account deletion fails closed until that marker exists.
Once production dry-run is clean and mode=execute has written the marker, the one-shot operator surface is dead weight. Steady-state indexing already happens via `r
Read the thread · 2026-07-30 · closed · 2 comments
MCP readiness observation: MCP handshake did not return a valid tool list
SaSame MCP Factory — automated observation notice (MCP handshake did not return a valid tool list)
- MCP name (per official MCP registry):
io.github.kentcdodds/kody - Endpoint observed:
https://heykody.dev/mcp - Observed at: 2026-07-28T13:05:06.938Z (UTC)
- Observed behavior: grade D (0/10 criteria), including a failed
tools/liststep (C1 — Protocol handshake conformance). - Top gap: C1 Protocol handshake conformance — initialize result keys: (none, status 401)
**
Read the thread · 2026-07-28 · closed · external user · 2 comments
feat: add secret_set capability so codemode skills can persist refreshed OAuth tokens
Problem
Skills that call OAuth-protected APIs (e.g. Spotify) need to refresh access tokens when they expire. Currently:
- Skills can read secrets via
{{secret:name}}placeholders in fetch calls - Skills can list secret metadata via
secret_list - Skills cannot write/update secrets from codemode
This means a skill can do a token refresh via fetch to the token endpoint, get a new access token back, but has no way to persist it. The next skill invocation has to refresh again, a
Read the thread · 2026-03-29 · closed · 2 comments
MCP server listed on ATX - claim or correct the record
Hi - I run ATX, an independent registry that records evidence about publicly reachable MCP servers. This server is listed:
Nothing is needed from you. Flagging it in case you'd like to correct anything, or claim the domain to get a verified-operator badge and trigger rescans after a change - one DNS TXT record, no account.
Collection is unauthenticated initialize + tools/list only, no tool is ever
invoked, robots.txt is honoured,
Read the thread · 2026-08-25 · closed · external user · 1 comment
Adopt Agents MCP SDK v2 / agents/mcp/server path
Context
We upgraded to agents@0.20.1 and installed required peers @modelcontextprotocol/client@2.0.0 + @modelcontextprotocol/server@2.0.0, while continuing to serve MCP via the legacy McpAgent + @modelcontextprotocol/sdk@1.30.0 path.
agents@0.20 adds:
- MCP SDK v2 client/server support
agents/mcp/serverentry that can serve stateless MCP without retaining McpAgent / WorkerTransport / SDK v1 modules- Client discovery via
server/discoverwith legacyinitializefall
Read the thread · 2026-08-03 · closed · 1 comment
Most recent
Home connector observability gaps can hide disconnects and tool-snapshot failures
Summary
We investigated why scheduled shade automation events were failing with Tool "home_bond_shade_set_position" not found around 2026-04-26 02:09-02:16 UTC and 03:30 UTC, while the kody-home-connector Sentry project had no new events after 2026-03-25.
A source review found multiple observability gaps that can make home-connector websocket disconnects or capability-registration problems effectively silent.
Findings
1) Containerized production can bypass home-connector Sentry
Read the thread · 2026-04-26 · closed · outside contributor · 0 comments
Follow up package-first terminology in talk deck and examples
The package-first PR is merged, but the talk deck still teaches the pre-package-first model in several places.
Follow-up cleanup:
docs/talks/kody-mcp-runtime/slides.mdstill referencessaved skills,saved apps, and the old async-function framing forexecute.- The deck should be updated to match the merged package-first architecture: packages as the top-level saved primitive, package-owned app/jobs/exports, and module-oriented execute semantics.
Examples from the merged tree:
- `docs
Read the thread · 2026-04-20 · closed · 0 comments
Fresh repo-backed skill creation can fail with 401 Unauthorized while existing migrated skills run
Summary
Existing migrated repo-backed skills run successfully, but creating a brand-new repo-backed skill in production can still fail during the save path with 401 Unauthorized.
Production observations
Using production Kody MCP after the repo-backed source migration deploy:
- Existing migrated skills run successfully. Example:
weather-forecastruns and returns a valid result. - Creating a fresh test skill with a new name via
meta_save_skillfailed on the create/save step with:
Read the thread · 2026-04-18 · closed · 1 comment
Remove legacy D1 source storage after repo-backed backfill completes
Summary
This issue tracks the final cleanup PR that should land after the repo-backed source backfill is completed and verified in production.
The migration foundation landed in #181, and the production backfill path is being added in #187. Once production data is migrated and verified, we should remove the legacy D1 source-storage and fallback code so repo-backed sources become the only canonical source of truth.
Goal
After this issue is complete:
- saved apps, saved skills,
Read the thread · 2026-04-17 · closed · 0 comments
feat: first-class scheduler — run codemode code on cron or datetime
Overview
Add a SchedulerDO (Durable Object) to Kody that allows codemode skills/code to be scheduled for one-shot or recurring (cron) execution, with full lifecycle management via codemode capabilities.
Motivation
Today codemode.execute is purely synchronous and on-demand. There's no way to say "run this skill every morning at 7am" or "run this code once on Friday at 3pm." This feature makes that a first-class primitive.
Architecture
Durable Object: SchedulerDO
A single
Read the thread · 2026-04-12 · closed · 0 comments
docs: add raw-content-blocks guide and reference it from execute tool description
What
The __mcpContent sentinel was added in #148 but is completely undocumented. Agents have no way to know it exists.
Changes needed
1. New file: docs/use/raw-content-blocks.md
Create a concise guide explaining the feature. Something like:
# Raw MCP content blocks
By default, `execute` serialises its return value as a single `text` content
block. When you need to return a non-text block — most commonly an `image` for
screenshots or charts — return an object with a `__m
[Read the thread](https://github.com/kentcdodds/kody/issues/150) · 2026-04-11 · closed · 0 comments
### execute tool: support returning raw MCP content blocks via __mcpContent sentinel
## Problem
The `execute` tool always serializes its return value as a single `text` content block via `formatExecutionOutput`. This means execute sandbox code cannot return image (or other non-text) MCP content blocks — base64 image data just ends up embedded in a JSON string, not as a real `image` content block that Claude can visually process.
## Proposed Solution
Add a sentinel shape that execute sandbox code can return to opt into raw MCP content blocks:
```ts
return {
__mcpContent: [
[Read the thread](https://github.com/kentcdodds/kody/issues/148) · 2026-04-11 · closed · 0 comments
### Plan: Progressive disclosure of contextual facts for MCP agents
## Goal
**Create a plan (NOT an implementation) for progressive disclosure of contextual facts to agents interacting with Kody's MCP server.**
The owner (Kent) will review and discuss the plan with the agent before any code is written.
## Problem
Kody's MCP tool descriptions currently front-load a large amount of information that agents may never need. This wastes context window space and makes the initial tool descriptions harder to parse. Agents need to absorb everything up front — OAuth p
[Read the thread](https://github.com/kentcdodds/kody/issues/127) · 2026-04-01 · closed · 0 comments
### createAuthenticatedFetch does not persist rotated refresh tokens
## Bug
`refreshAccessTokenWithConnector` in `packages/worker/src/mcp/execute-modules/codemode-utils.ts` does not persist rotated refresh tokens from the token endpoint response.
## Problem
Many OAuth providers (notably Spotify PKCE) rotate the refresh token on every use — the response includes a new `refresh_token` and the old one is immediately revoked. The current implementation only reads `payload.access_token` and returns it, discarding `payload.refresh_token`. This means:
1. First refre
[Read the thread](https://github.com/kentcdodds/kody/issues/124) · 2026-03-31 · closed · 1 comment
The remaining reports are on [the project's issue tracker](https://github.com/kentcdodds/kody/issues).