pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for logicmonitor

Pod holds 6 of 6 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to logicmonitor.

Most discussed

create_sdt and bulk_create_device_sdt return 400 "Invalid type" — missing sdtType in request body

Problem

Calling create_sdt returns a 400 error from the LogicMonitor API:


{"errorMessage":"Invalid type","errorCode":1400,"errorDetail":null}

Tested on:

  • lm-mcp: 2.1.0
  • LogicMonitor API: v3

Steps to Reproduce

Example payload:

{
  "sdt_type": "DeviceGroupSDT",
  "device_group_id": 51,
  "duration_minutes": 60,
  "comment": "test"
}

Root Cause

The LogicMonitor REST API v3 appears to have transitioned from Device* to Resource* terminology for SDT t

Read the thread · 2026-03-17 · closed · external user · 1 comment

docker-compose publishes plaintext 8080 even under the TLS profile

Found by an adversarial review of #53.

deploy/docker-compose.yml publishes ${LM_HTTP_PORT:-8080}:8080 unconditionally, so the plaintext port is bound on all interfaces even when the tls profile puts Caddy in front. An operator who follows the TLS instructions still exposes an unencrypted listener, and with #53 merged that means the new bearer token travels in cleartext to anyone who reaches 8080 directly.

Fix shape: bind the app port to loopback (127.0.0.1:${LM_HTTP_PORT:-8080}:8080) s

Read the thread · 2026-08-11 · closed · 0 comments

Unauthenticated /readyz can burn LM API quota when connectivity checks are on

Found by an adversarial review of #53 and verified with a live repro.

/readyz is on the unauthenticated probe allowlist. With LM_HEALTH_CHECK_CONNECTIVITY=true (off by default), every request runs client.get("/setting/admins", size=1) against the customer portal using the server's stored credentials, with no caching and no throttle. Anyone who can reach the port can loop the probe and consume the portal's API quota — the exact party LM_HTTP_AUTH_TOKEN exists to stop.

Two amplifiers obs

Read the thread · 2026-08-11 · open · 0 comments

Per-session multi-portal support for the HTTP transport

Multi-portal mode is stdio-only as of the #44/#45 hardening: the active portal and client are process globals, so the shared HTTP process would leak the active portal across concurrent callers.

Supporting multi-portal over HTTP properly means per-session portal binding: session identity (e.g. Mcp-Session-Id) plumbed to tool execution, a session-to-portal map replacing the global active pointer, and per-session (or per-portal, refcounted) client lifecycle. Session variables and history have the

Read the thread · 2026-08-11 · open · 0 comments

HTTP tools/list omits Terraform tools

mcp_endpoint in src/lm_mcp/transport/http.py extends the tools/list response with AWX_TOOLS and WATSONX_TOOLS but never TF_TOOLS, even though create_http_server initializes the Terraform runner and execute_tool dispatches Terraform tools over HTTP. The tools work but are invisible to HTTP clients.

One-line fix plus a count assertion in tests/test_http_middleware.py. Predates the multi-portal work.

Read the thread · 2026-08-11 · closed · 0 comments

HTTP transport has no inbound authentication

The HTTP transport (src/lm_mcp/transport/http.py) applies only CORS middleware. /mcp, /api/v1/analyze, and /api/v1/webhooks/alert accept unauthenticated requests; deploy/Caddyfile is a bare reverse_proxy with security headers and no auth directive. Anyone who can reach the port can drive the full tool surface with the server's LM credentials.

Predates the multi-portal work; noted during its review. Options: bearer/API-key middleware in the ASGI app, an authenticated proxy documented a

Read the thread · 2026-08-11 · closed · 0 comments

Most recent

The remaining reports are on the project's issue tracker.