# Reported issues for mcp

Pod holds 18 of 22 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [mcp](/mcp/mcp-5).

## Most discussed

### Telemetry: better client identification + bot detection for monetization analytics

## Context

Currently the telemetry worker (`telemetry-worker/`) records each MCP event with a `client` field set to the MCP runtime name (e.g. `claude-code`, `cursor-vscode`, `codex-mcp-client`). This is the value the MCP runtime advertises during the handshake — see `mcp/src/telemetry.ts:194-211` (`recordClientInit`).

This is enough to know *which AI tool* talks to us, but not enough to:

1. **Distinguish two developers** using the same runtime (every `claude-code` user shows up as one bucket

[Read the thread](https://github.com/sceneview/sceneview/issues/2208) · 2026-05-26 · closed · outside contributor · 1 comment

### [v5] Route Sketchfab requests through mcp-gateway so the API key never ships in the binary

**Track for v5.** Long-term fix for #1909 (and ground for #977): route every Sketchfab call from the demo apps through `mcp-gateway` instead of bundling a Sketchfab token in the binary.

## Why

`SKETCHFAB_API_KEY` is currently injected at build time into:
- Android `BuildConfig.SKETCHFAB_API_KEY` (extractable from APK with `strings classes*.dex`)
- iOS `Info.plist` `SketchfabAPIKey` (extractable from any .ipa)

Consequences:
- A determined user can lift the key from the published store binary, 

[Read the thread](https://github.com/sceneview/sceneview/issues/1910) · 2026-05-21 · closed · outside contributor · 3 comments

### CLAUDE.md Version Location Map contradicts sync-versions.sh on mcp/package.json

## What

`CLAUDE.md`'s "Version Location Map" tells contributors and AI agents to bump `mcp/package.json` and `mcp/src/index.ts` in lockstep with `gradle.properties` `VERSION_NAME`, but `sync-versions.sh` deliberately does the opposite.

`CLAUDE.md` (lines 315–327):

> **Source of truth:** `gradle.properties` -> `VERSION_NAME=X.Y.Z`
> Every file below MUST be updated when bumping the version. Use `/version-bump` or `bash .claude/scripts/sync-versions.sh --fix`.

…and the table then lists:

| **n

[Read the thread](https://github.com/sceneview/sceneview/issues/1705) · 2026-05-17 · closed · outside contributor · 1 comment

### FU1: Sketchfab API key in APK extractable — route through mcp-gateway in V1.1

**Follow-up from v4.1.0 magical-lovelace 5-agent review.**

The Sketchfab integration shipped in v4.1.0 bakes \`BuildConfig.SKETCHFAB_API_KEY\` (Android) / \`SketchfabConfig\` env var (iOS) into the binary. Any user who APK-analyzes the demo can extract the master Sketchfab API key.

\`TODO V1.1\` markers are in place in:
- \`samples/android-demo/.../sketchfab/SketchfabConfig.kt\`
- \`samples/ios-demo/SceneViewDemo/Services/SketchfabConfig.swift\`
- \`samples/android-demo/build.gradle\` (Gradle 

[Read the thread](https://github.com/sceneview/sceneview/issues/977) · 2026-05-11 · closed · outside contributor · 1 comment

### Audit umbrella DEEP 2026-05-08 — 46 deep findings (#920-#965) — meta-issue

## Context

Second audit pass (deeper than the shallow 2026-05-07 audit tracked in #916). 9 parallel Opus agents + manual visual sweep + live URL/npm/Maven Central health checks + libs coverage measurement + KDoc completeness audit + cross-platform parity diff.

This umbrella tracks the **deeper findings** so the audit can serve as a recheck baseline for future passes.

## Findings by area

### 🚨 Consumer install paths broken on 4 of 5 platforms
- #920 — iOS SPM repo `sceneview-swift` only has v

[Read the thread](https://github.com/sceneview/sceneview/issues/966) · 2026-05-07 · closed · outside contributor · 1 comment

### MCP: autoDetectIssue misses common phrasings ("ar camera black")

[mcp/src/debug-issue.ts:696-739](mcp/src/debug-issue.ts#L696) — `autoDetectIssue("my AR camera is black")` returns `null`.

Match list is too narrow:
- "ar not", "ar doesn't", "arcore", "plane", "anchor", "camera permission" → branch
- "black screen" requires both words → branch

Common phrasings fall through.

**Fix:** add: `"ar camera black"`, `"ar feed black"`, `"camera black"`, `"ar black"`, `"no model"`, `"model not visible"`, `"arscene black"`, `"arsceneview black"` to the AR-not-working O

[Read the thread](https://github.com/sceneview/sceneview/issues/940) · 2026-05-07 · closed · outside contributor · 1 comment

### [Docs/MCP] Request for comprehensive Markdown guide on all Node types and their Compose lifecycles

### Platform

All platforms

### Description

As a developer using SceneView, the transition to the Compose-based declarative UI approach is fantastic, but there is currently a lack of in-depth documentation regarding the specific behaviors, parameters, and limitations of the various Node types. While the README provides an excellent high-level table of available nodes (e.g., ModelNode, LightNode, ViewNode, AnchorNode), there is no centralized Markdown documentation detailing how to effectively 

[Read the thread](https://github.com/sceneview/sceneview/issues/802) · 2026-04-10 · closed · external user · 1 comment

### Publishing is failing due to credentials not using sonatype user token

Sonatype now requires token-based authentication, and our upload-release.yml file is still using the old username and password credentials.

> Failed to stop service 'maven-central-build-service'.
> > Upload failed: {"error":{"message":"Invalid token"}}

[Read the thread](https://github.com/sceneview/sceneview/issues/654) · 2026-01-08 · closed · outside contributor · 5 comments

## Most recent

### MCP spec conformance: 6 requirement(s) violated (via @hasmcp/mcp-spec-test) — spec 2026-07-28

When `sceneview-mcp` is tested against the newest MCP spec revision (2026-07-28) with `@hasmcp/mcp-spec-test`, the server responds to `server/discover` with a JSON-RPC `-32601 Method not found` error. Because `server/discover` is the entry point the newer revision uses to negotiate capabilities/version, everything downstream that depends on it (22 further checks) can't be verified either. Note that the server tests fully clean (0 failures) against the older 2025-11-25 revision it also advertises

[Read the thread](https://github.com/sceneview/sceneview/issues/3349) · 2026-08-24 · closed · external user · 0 comments

### feedback-worker: minor cleanups deferred from the hardening review

Follow-up to #1930 / the feedback-worker security + correctness hardening PR. These MINOR findings from the 6-agent review were deliberately deferred to keep that PR scoped to the blockers/majors.

### Items

1. **`202` response conflates two distinct outcomes** — `src/index.ts` returns `202 { issue: null }` both when the global hourly issue quota skipped issue creation *and* when the GitHub API call failed. A caller (or the demo app) cannot tell "we deliberately throttled" from "GitHub errored"

[Read the thread](https://github.com/sceneview/sceneview/issues/2028) · 2026-05-21 · closed · outside contributor · 0 comments

### QA: tune web-perf-qa thresholds + add to release-gate (follow-up of #1879)

Follow-up of #1879 / PR #1897 (web-perf-qa.sh scaffold).

The Lighthouse-based web-perf scaffold landed as **advisory** — `web-perf-summary.json.verdict` is always `"advisory"` and `thresholds` is `null`. The `device-qa.sh` sub-leg is wired continue-on-error and the recorded \`web\` verdict is untouched. This issue tracks the promotion from advisory to enforce.

## Tasks

- [ ] **Baseline capture** — Run `bash .claude/scripts/web-perf-qa.sh` on every push to `main` for ~7 days (one workflow tick

[Read the thread](https://github.com/sceneview/sceneview/issues/1898) · 2026-05-20 · closed · outside contributor · 0 comments

### CI gates: wire llms.txt drift guard into quality-gate.sh (routing hole #1815 missed)

Part of #1754. Surfaced by Tier-2 Wave 4 DOCS review.

## Problem

The MCP/llms drift guard added by #1815 (and the mirror gate from #1809) is wired into `sync-versions.sh`, but `sync-versions.sh` is **NOT invoked by `quality-gate.sh`** (the PR-blocking CI gate; line 60-78 only checks individual version strings). 

Concrete miss: PR #1822 landed `DepthHitResultNode` docs in root `llms.txt` but NOT in mirror `docs/docs/llms.txt` + MCP bundle. The drift sat on `main` for 2 commits until #1817 (PR 

[Read the thread](https://github.com/sceneview/sceneview/issues/1847) · 2026-05-20 · closed · outside contributor · 0 comments

### Regenerate mcp/src/generated/llms-txt.ts for the May 2026 AR sprint APIs + add drift CI guard

Part of #1754. Surfaced by Tier-2 API consistency audit.

## Problem

`mcp/src/generated/llms-txt.ts` is stale — still shows SceneView `4.11.0` and contains **zero mentions** of any new public API shipped in the May 2026 AR sprint: `DepthMeshNode`, `rememberDepthMesh`, `rememberDepthCollider`, `DepthCollider`, `Frame.hitTestDepth`, `HostCloudAnchorFuture`, the Future-returning `CloudAnchorNode.host/resolve`, `TerrainAnchorNode.resolve`, `RooftopAnchorNode.resolve`. AI agents consuming `sceneview

[Read the thread](https://github.com/sceneview/sceneview/issues/1808) · 2026-05-20 · closed · outside contributor · 0 comments

### device-QA: workflow_dispatch (release-gate) runs get cancelled by subsequent push — need a non-cancellable concurrency group

## Problem

`.github/workflows/device-qa.yml` uses:
```yaml
concurrency:
  group: device-qa-${{ github.ref }}
  cancel-in-progress: true
```

Because the group is keyed only on `github.ref`, **every** `push` to `main` cancels any in-progress Device QA run on `main` — including a run that was started manually via `workflow_dispatch` as a **release gate**.

Observed 2026-05-17: 6+ consecutive Device QA runs cancelled within 25 min because device-qa PRs were merging in sequence. A Device QA run tak

[Read the thread](https://github.com/sceneview/sceneview/issues/1665) · 2026-05-17 · closed · outside contributor · 0 comments

### Docs staleness sweep: demo counts, version refs, renamed QA script

Audit findings — stale references to fix in one sweep:

1. `samples/android-demo/README.md` (~line 7) advertises **"19 interactive demos"** — `DemoRegistry.kt` `ALL_DEMOS` actually has 43 entries (`.maestro/android/catalog.yaml` says 42). Update to the correct count.
2. `DemoRegistry.kt` (43) vs `.maestro/android/catalog.yaml` header ("Total 42") — off-by-one. Reconcile: either a demo is missing from a Maestro category flow (untested gap) or the catalog count is stale. Confirm which and fix.
3. 

[Read the thread](https://github.com/sceneview/sceneview/issues/1600) · 2026-05-17 · closed · outside contributor · 0 comments

### Flaky: `npm pack --dry-run --json --ignore-scripts` returns EOF in quality-gate MCP tests

## Symptom

Run [25837847366](https://github.com/sceneview/sceneview/actions/runs/25837847366) on \`main\` failed quality-gate at the MCP-tests step with:

\`\`\`
Error: Command failed: npm pack --dry-run --json --ignore-scripts
[generate-llms-txt] wrote .../mcp/src/generated/llms-txt.ts (143318 chars from .../llms.txt)
{
  \"error\": {
    \"code\": \"EOF\",
    \"summary\": \"encountered unexpected EOF\",
    \"detail\": \"\"
  }
}
\`\`\`

The next main run (25844451687) passed → flaky, not de

[Read the thread](https://github.com/sceneview/sceneview/issues/1113) · 2026-05-14 · closed · outside contributor · 0 comments

### MCP: expose `android docs search` / `fetch` as MCP tools

Google's `android` CLI ships with `android docs search <query>` and `android docs fetch kb://<path>` — a knowledge base of 4 808 Android docs entries. Today `sceneview-mcp` has no way to surface stock Android API docs (Compose, Camera2, ARCore SDK, etc.) cross-referenced with SceneView code.

Wrapping `android docs` as MCP tools means any MCP-aware assistant can ask "How does `LazyColumn` paging work?" without leaving the SceneView chat.

## Scope

- [ ] Add `mcp/src/tools/android-docs.ts` expos

[Read the thread](https://github.com/sceneview/sceneview/issues/1083) · 2026-05-14 · closed · outside contributor · 0 comments

### MCP: hardcoded "4.0.0" in 16+ tool outputs + User-Agent says "3.5.4"

Tools whose body output ships stale version strings:
- `get_setup`, `get_ar_setup`, `get_ios_setup`, `get_platform_setup`, `list_platforms` — every entry hardcodes `version: "4.0.0"`
- `get_platform_roadmap` — header `## Current Status (v4.0.0)`
- `list_samples`, `get_sample` — every sample's dependency line + example prompt
- `analyze-project.ts:29` — `LATEST_SCENEVIEW_VERSION = "4.0.0"` constant
- `index.ts:84` — resource description `"Complete SceneView 4.0.0 API"`
- **`issues.ts:175` — `User

[Read the thread](https://github.com/sceneview/sceneview/issues/941) · 2026-05-07 · closed · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/sceneview/sceneview/issues).