Reported issues for loki-mode

Pod holds 10 of 10 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to loki-mode.

Most discussed

Outreach: MCP registry submission + Glama claim + awesome-list PR follow-ups

Status: technically fire-ready; the remaining steps are founder browser actions + maintainer merges.

MCP registry (FIRE-READY, needs founder browser ~2 min)

Published loki-mode@7.34.x has mcpName: io.github.asklokesh/loki-mode (the registry ownership marker). VERIFIED.
Published-package MCP handshake verified: fresh install + project venv + full `initialize -> notifications/initialized -> tools/list

Read the thread · 2026-06-12 · open · 2 comments

The repo's mcp/ package shadows the installed MCP SDK, permanently skipping a test suite

Found during the 2026-08-06 CI workflow audit. Verified by execution, not inspection.

Symptom

tests/test_mcp_agent_metrics_honesty.py skips on every Python version in CI:

SKIPPED [1] tests/test_mcp_agent_metrics_honesty.py:59: MCP SDK unavailable on this interpreter (SystemExit); mcp/server.py exits at import without it

A skip reads as success in the pytest summary line, so seven real assertions have been green-by-skip with nothing reporting the lost coverage.

The cause

Read the thread · 2026-08-06 · closed · 1 comment

mcp: path validation doesn't prevent symlink chain escapes

validate_path() resolves all symlinks but doesn't prevent chains that escape allowed dirs through intermediate hops.\n\nLocation: mcp/server.py:109-153

Read the thread · 2026-03-19 · closed · 1 comment

mcp: module-level singletons leak on server restart

_state_manager and _learning_collector are module-level singletons never cleaned up. If MCP server restarts in same process, old instances persist with file handle leaks.\n\nLocation: mcp/server.py:57-88

Read the thread · 2026-03-19 · closed · 1 comment

memory: namespace validation allows path traversal characters

with_namespace() accepts any string including ../../. Can write to unintended filesystem paths.\n\nLocation: memory/storage.py:89-104

Read the thread · 2026-03-19 · closed · 1 comment

dashboard: token file permissions not enforced on update, only on creation

Description

Token file permissions set to 0o600 only on initial creation. Subsequent json.dump() doesn't re-set permissions. If file exists with wrong permissions from previous run, it stays readable by other users.

Location

dashboard/auth.py:103

Read the thread · 2026-03-19 · closed · 1 comment

dashboard: OIDC JWT signature verification not implemented

Description

CRITICAL: The OIDC token validation only checks claims without cryptographic signature verification. Code explicitly states "JWT signatures are NOT cryptographically verified" (auth.py:68-71). An attacker can forge JWTs claiming any identity. Production OIDC deployments are completely insecure without PyJWT + cryptography.

Location

dashboard/auth.py:459-540

Suggested Fix

Require PyJWT with cryptography backend, fetch JWKS from issuer, verify RS256/ES256 signatures.

Read the thread · 2026-03-19 · closed · 1 comment

cli: telemetry has no persistent opt-out across sessions

Description

cmd_telemetry start/stop is temporary. On next run, telemetry re-enables. No persistent config file. User expecting privacy may not realize telemetry is back on.

Location

autonomy/loki:13603-13710

Read the thread · 2026-03-19 · closed · 1 comment

Most recent

Add --json flag to loki status for machine-readable output

Description

The `loki status` command currently outputs colored, human-readable text only. Add a `--json` flag that outputs structured JSON, making it easy to parse in scripts and CI/CD pipelines.

Files to Modify

`autonomy/loki` -- modify the `status` subcommand to accept `--json` flag and output JSON when set

Expected Behavior

Without `--json` (existing behavior, unchanged): ``` $ loki status Loki Mode: RUNNING Session: abc123 Iteration: 5/10 Provider: claude Queu

Read the thread · 2026-02-07 · closed · 0 comments

Add architecture diagram to README

Description

The README and docs lack a visual representation of how Loki Mode works. Add an architecture diagram that shows:

The RARV cycle (Reason -> Act -> Reflect -> Verify)
The agent flow from PRD input to deployed product
How the dashboard, CLI, and autonomy runtime connect
The multi-provider support (Claude/Codex/Gemini) and degraded mode paths

Use Mermaid diagram syntax so it renders natively on GitHub.

Files to Modify

README.md -- add a new "Architecture" secti

Read the thread · 2026-02-07 · closed · 0 comments

The remaining reports are on the project's issue tracker.