# Reported issues for logicmonitor

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [logicmonitor](/mcp/logicmonitor).

## Most discussed

### create_sdt and bulk_create_device_sdt return 400 "Invalid type" — missing sdtType in request body

## Problem

Calling `create_sdt` returns a `400` error from the LogicMonitor API:

```

{"errorMessage":"Invalid type","errorCode":1400,"errorDetail":null}

````

Tested on:
- lm-mcp: 2.1.0
- LogicMonitor API: v3

## Steps to Reproduce

Example payload:

```json
{
  "sdt_type": "DeviceGroupSDT",
  "device_group_id": 51,
  "duration_minutes": 60,
  "comment": "test"
}
````

## Root Cause

The LogicMonitor REST API v3 appears to have transitioned from `Device*` to `Resource*` terminology for SDT t

[Read the thread](https://github.com/ryanmat/mcp-server-logicmonitor/issues/10) · 2026-03-17 · closed · external user · 1 comment

### docker-compose publishes plaintext 8080 even under the TLS profile

Found by an adversarial review of #53.

`deploy/docker-compose.yml` publishes `${LM_HTTP_PORT:-8080}:8080` unconditionally, so the plaintext port is bound on all interfaces even when the `tls` profile puts Caddy in front. An operator who follows the TLS instructions still exposes an unencrypted listener, and with #53 merged that means the new bearer token travels in cleartext to anyone who reaches 8080 directly.

Fix shape: bind the app port to loopback (`127.0.0.1:${LM_HTTP_PORT:-8080}:8080`) s

[Read the thread](https://github.com/ryanmat/mcp-server-logicmonitor/issues/57) · 2026-08-11 · closed · 0 comments

### Unauthenticated /readyz can burn LM API quota when connectivity checks are on

Found by an adversarial review of #53 and verified with a live repro.

`/readyz` is on the unauthenticated probe allowlist. With `LM_HEALTH_CHECK_CONNECTIVITY=true` (off by default), every request runs `client.get("/setting/admins", size=1)` against the customer portal using the server's stored credentials, with no caching and no throttle. Anyone who can reach the port can loop the probe and consume the portal's API quota — the exact party `LM_HTTP_AUTH_TOKEN` exists to stop.

Two amplifiers obs

[Read the thread](https://github.com/ryanmat/mcp-server-logicmonitor/issues/56) · 2026-08-11 · open · 0 comments

### Per-session multi-portal support for the HTTP transport

Multi-portal mode is stdio-only as of the #44/#45 hardening: the active portal and client are process globals, so the shared HTTP process would leak the active portal across concurrent callers.

Supporting multi-portal over HTTP properly means per-session portal binding: session identity (e.g. Mcp-Session-Id) plumbed to tool execution, a session-to-portal map replacing the global active pointer, and per-session (or per-portal, refcounted) client lifecycle. Session variables and history have the 

[Read the thread](https://github.com/ryanmat/mcp-server-logicmonitor/issues/48) · 2026-08-11 · open · 0 comments

### HTTP tools/list omits Terraform tools

`mcp_endpoint` in `src/lm_mcp/transport/http.py` extends the tools/list response with `AWX_TOOLS` and `WATSONX_TOOLS` but never `TF_TOOLS`, even though `create_http_server` initializes the Terraform runner and `execute_tool` dispatches Terraform tools over HTTP. The tools work but are invisible to HTTP clients.

One-line fix plus a count assertion in `tests/test_http_middleware.py`. Predates the multi-portal work.

[Read the thread](https://github.com/ryanmat/mcp-server-logicmonitor/issues/47) · 2026-08-11 · closed · 0 comments

### HTTP transport has no inbound authentication

The HTTP transport (`src/lm_mcp/transport/http.py`) applies only CORS middleware. `/mcp`, `/api/v1/analyze`, and `/api/v1/webhooks/alert` accept unauthenticated requests; `deploy/Caddyfile` is a bare reverse_proxy with security headers and no auth directive. Anyone who can reach the port can drive the full tool surface with the server's LM credentials.

Predates the multi-portal work; noted during its review. Options: bearer/API-key middleware in the ASGI app, an authenticated proxy documented a

[Read the thread](https://github.com/ryanmat/mcp-server-logicmonitor/issues/46) · 2026-08-11 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/ryanmat/mcp-server-logicmonitor/issues).