Reported issues for mcp-funnel

Pod holds 24 of 44 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to mcp-funnel.

Most discussed

[OAUTH] [ISSUE-SUPERVISOR-006] [IMPLEMENTATION] DRY Violations Throughout Codebase

Problem Summary

Extensive code duplication violating DRY principle has been confirmed by all reviewing agents. The main violations are:

Bearer Token Extraction: Pattern .replace('Bearer ', '') duplicated 36 times across codebase
Test Server Setup: Nearly identical setup blocks duplicated across multiple test files

Specific Files and Locations

Bearer Token Extraction Duplication (36 occurrences)

Test Files:

`packages/mcp/test/integration/oauth-websocket-e2

Read the thread · 2025-09-19 · closed · 11 comments

[OAUTH] [ISSUE-SUPERVISOR-002] [IMPLEMENTATION] Auto-Consent Security Bypass

Problem Summary

The OAuth provider currently auto-grants all consent requests without user interaction, violating OAuth 2.0 security principles and allowing unauthorized access to user resources.

Key Files & Changes Required

1. Remove Auto-Consent (`packages/server/src/oauth/oauth-provider.ts:158-166`)

Current: Automatically calls recordUserConsent() when consent not found
Required: Return consent_required error instead of auto-granting
Line 160-165: Repl

Read the thread · 2025-09-19 · closed · 10 comments

[OAUTH] [ISSUE-SUPERVISOR-003] [IMPLEMENTATION] Never-Expiring Security Tokens

Problem Summary

Consensus

All 3 reviewing agents (codex, claude, gemini) confirmed that client secrets and refresh tokens never expire, creating critical security vulnerabilities.

Core Issue

Never-expiring tokens: Client secrets (client_secret_expires_at: 0) and refresh tokens (expires_at: 0) are hardcoded to never expire.

Key Evidence

Client secrets: packages/server/src/oauth/oauth-provider.ts:70
```
client_secret_expires_at: 0, // Never expires f
```

Read the thread · 2025-09-19 · closed · 9 comments

[OAUTH] [ISSUE-SUPERVISOR-005] [IMPLEMENTATION] Missing Reconnection Logic

Problem Summary

The system lacks automatic reconnection logic for dropped MCP server connections. While manual reconnection methods exist, automatic recovery with exponential backoff is not implemented.

Current State

✅ Manual reconnection API: MCPProxy.reconnectServer(name) - packages/mcp/src/index.ts:760
✅ Manual disconnection API: MCPProxy.disconnectServer(name) - packages/mcp/src/index.ts:799
✅ Server status tracking via connectedServers and disconnectedServers maps
❌

Read the thread · 2025-09-19 · closed · 8 comments

[OAUTH] [ISSUE-SUPERVISOR-004] [IMPLEMENTATION] Mock Data in Production API

Problem Summary

Issue: Mock Data in Production API
Status: CONFIRMED by 3/3 agents
Severity: 🟠 Medium
Component: Server API - /api/servers endpoint

Problem

The /api/servers endpoint returns partially mocked data instead of real server status:

✅ Real: Server names from mcpProxy.clients
❌ Mock: Status always "connected" (hardcoded)
❌ Mock: Timestamp always current time (not actual connection time)
❌ Unimplemented: Reconnect/disconnect endpoints are no

Read the thread · 2025-09-19 · closed · 8 comments

[OAUTH] [ISSUE-SUPERVISOR-001] [IMPLEMENTATION] Fix Timing Attack Vulnerability in Bearer Token Validation

Implementation Task

This is the implementation issue for fixing the timing attack vulnerability in bearer token validation identified in parent issue #17.

Problem

The bearer token validator uses Set.has() for token comparison, which is vulnerable to timing attacks. This allows attackers to potentially enumerate valid tokens through timing analysis.

Solution

Implement constant-time comparison using crypto.timingSafeEqual for all bearer token validation.

Implementation Steps

Read the thread · 2025-09-19 · closed · 8 comments

[OAUTH] [ISSUE-SUPERVISOR-007] Flaky Test Indicates Race Condition

MUST-FOLLOW POLICY: NO EXCEPTIONS!

This is a GitHub-based process, so use issues and comments after your review
Load .haino/personas/review.md from your local codebase - you MUST follow the instructions and protocol described there

Global Rules for All Agents

Scope: Findings relate to code, tests, build/release, security, performance, and behavior.
Append-only: Never remove or rewrite prior findings; add updates as new “Agent Notes” or “Validation Updates”.
**Evi

Read the thread · 2025-09-19 · closed · 6 comments

[OAUTH] [ISSUE-SUPERVISOR-003] Never-Expiring Security Tokens

MUST-FOLLOW POLICY: NO EXCEPTIONS!

This is a GitHub-based process, so use issues and comments after your review
Load .haino/personas/review.md from your local codebase - you MUST follow the instructions and protocol described there

Global Rules for All Agents

Scope: Findings relate to code, tests, build/release, security, performance, and behavior.
Append-only: Never remove or rewrite prior findings; add updates as new “Agent Notes” or “Validation Updates”.
**Evi

Read the thread · 2025-09-19 · closed · 5 comments

Most recent

npm bundle v0.0.8 is stale (predates PR #93 fix) — needs republish

Symptom

mcp-funnel@0.0.8 installed via npm install mcp-funnel / npx mcp-funnel silently fails to register tools from any Python/FastMCP-based MCP server. Confirmed cases:

Server	Tools through `mcp-funnel@0.0.8` (npm)	Tools through funnel rebuilt from current `develop`
`mcp-server-qdrant` (FastMCP)	0	2 (`qdrant-find`, `qdrant-store`)
`redis-mcp-server` (FastMCP)	0	47
Cloudflare `observability.mcp.cloudflare.com` (FastMCP)	0	10

Read the thread · 2026-04-27 · open · external user · 0 comments

Bug: Environment variables in server `env` field not expanded

Problem

Environment variable patterns (${VAR}) in the env field of server configurations are not being expanded through EnvVarPatternResolver, even though defaultSecretProviders are configured.

Expected Behavior

When a server is configured with:

{
  "defaultSecretProviders": [
    { "type": "dotenv", "config": { "path": ".env" } }
  ],
  "servers": {
    "playwright": {
      "command": "npx",
      "args": ["@playwright/mcp@latest"],
      "env": {
        "PLAYWRI

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/91) · 2025-11-14 · closed · external user · 1 comment

### [Feature] Is it possible to delegate filtering to LLM?

Hello, excited to see this project and appreciate for open sourcing it! I'm wondering if any plan to expand the flexible filter by using LLM as well? I've been thinking about dynamic tool discovery and it seems allowing a LLM (or cheaper SLM) exclusively for the filtering a viable solution.

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/87) · 2025-10-09 · closed · external user · 2 comments

### [SPARK] 3.11: Fix TSR analysis test fixture

# SPARK 3.11: Fix TSR analysis test fixture

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command  
**Dependencies**: SPARKs 3.1-3.8 completed

## Objective
Fix the test "should correctly identify unused exports" to properly detect unused code in the test fixtures.

## Issue
The test expects to find specific unused exports (unusedInUsedFile, isolated.ts) but the analysis isn't finding them. This could be because:
1. The test fixtures aren't set up correctly

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/73) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.10: Fix monorepo tsconfig detection

# SPARK 3.10: Fix monorepo tsconfig detection  

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: SPARKs 3.1-3.8 completed

## Objective
Fix the monorepo test by adjusting tsconfig validation for monorepo structures.

## Issue
The test "should handle monorepo project" fails because the tsconfig validation looks for tsconfig.json in the project root, but monorepos often have tsconfig files in package subdirectories, not the root.

## Sol

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/72) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.9: Fix tsconfig validation test expectations

# SPARK 3.9: Fix tsconfig validation test expectations

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: SPARKs 3.1-3.8 completed

## Objective
Fix the processor test that expects TSR to be called even when tsconfig is missing.

## Issue
The test "should handle missing tsconfig.json" expects TSR to be called with a non-existent tsconfig path. However, the new validation in processor.ts returns early when tsconfig is missing, so TSR is n

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/71) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.8: Fix Entry Point Pattern Handling

# SPARK 3.8: Fix Entry Point Pattern Handling

## Parent Context  
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: SPARKs 3.1-3.5 completed

## Objective
Fix the entry point pattern handling to properly process multiple patterns and handle errors.

## Issues Identified
1. "should handle different entry point patterns" test expects false but gets true for isError
2. Entry point resolution may be throwing errors for valid patterns

## Implementation Requi

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/70) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.7: Fix CLI Interface Implementation

# SPARK 3.7: Fix CLI Interface Implementation  

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: SPARKs 3.1-3.5 completed

## Objective
Fix the CLI interface implementation to properly handle help display and exit codes.

## Issues Identified
1. "should display help" test expects exit code 0 but gets 1
2. CLI help display mechanism may not be working correctly

## Implementation Requirements

### Files to Modify

#### `packages/command

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/69) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.6: Fix MCP Interface Implementation

# SPARK 3.6: Fix MCP Interface Implementation

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: SPARKs 3.1-3.5 completed

## Objective
Fix the MCP interface implementation to ensure proper return values and error handling.

## Issues Identified
1. `executeToolViaMCP` doesn't set `isError: false` for successful executions
2. The `formatForAI` method doesn't return the expected "Warning: False Positives" text
3. Error handling for missing

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/68) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.5: Validate Real-World Functionality

# SPARK 3.5: Validate Real-World Functionality

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: Spark 3.4 (Fix Test Mocks) should be completed first

## Objective
Validate that the ts-unused-code command works correctly on real TypeScript projects and integrates properly with MCP Funnel.

## Implementation Requirements

### Manual Testing Required

#### Test on Real Projects
1. **Simple TypeScript Project**
   ```bash
   # Create a tes

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/66) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.4: Fix Test Mocks and Expectations

# SPARK 3.4: Fix Test Mocks and Expectations

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: Sparks 3.1, 3.2, 3.3 are completed but tests are failing

## Objective
Fix the failing unit and integration tests by correcting TSR mock data and test expectations to match actual TSR output format.

## Implementation Requirements

### Reference Files to Study

#### TSR Output Format
- Run `npx tsr 'src/index\.ts'` in a test project to underst

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/65) · 2025-09-23 · closed · 2 comments

### [SPARK] 3.3: Add Command Discovery Support

# SPARK 3.3: Add Command Discovery Support

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: Core implementation (#57) must be completed
**Can work in parallel with**: Sparks 3.1 and 3.2 (testing)

## Objective
Ensure the ts-unused-code command is properly discovered and loadable by the MCP Funnel command discovery system, making it available for use through the proxy.

## Implementation Requirements

### Reference Files to Study

#### 

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/63) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.2: Create Integration Tests

# SPARK 3.2: Create Integration Tests

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: Spark 3.1 (Unit Tests) should be completed or in progress

## Objective
Create integration tests that validate the full command flow from both MCP tool invocation and CLI execution, using real TSR analysis on test fixtures.

## Implementation Requirements

### Reference Files to Study

#### Integration Testing Patterns
- `packages/mcp/test/integratio

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/62) · 2025-09-23 · closed · 0 comments

### [SPARK] 3.1: Create Unit Tests

# SPARK 3.1: Create Unit Tests

## Parent Context
**Parent Burst**: #60 - Testing and Integration - ts-unused-code Command
**Dependencies**: Core implementation (#57) must be completed

## Objective
Create comprehensive unit tests for the TsUnusedCodeCommand and TsrProcessor classes, ensuring robust test coverage and proper error handling validation.

## Implementation Requirements

### Reference Files to Study

#### Testing Patterns
- `packages/commands/ts-validate/src/validator.test.ts` - Stud

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/61) · 2025-09-23 · closed · 0 comments

### [BURST] 3: Testing and Integration - ts-unused-code Command

# BURST 3: Testing and Integration

## Parent Context
**Parent Plan**: #53 - ts-unused-code Command Implementation
**Previous Burst**: #57 - Core Implementation (COMPLETED)
**Dependencies**: Burst 1 (Package Setup) and Burst 2 (Core Implementation) are completed

## Objective
Create comprehensive test coverage for the ts-unused-code command and integrate it properly into the MCP Funnel ecosystem. This burst ensures the command is production-ready with proper testing and integration points.

## S

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/60) · 2025-09-23 · closed · 3 comments

### [SPARK] 2.2: Implement Command Class

# SPARK 2.2: Implement Command Class

## Parent Context
**Parent Burst**: #57 - Core Implementation - ts-unused-code Command
**Dependencies**: #55 and #56 must be completed (package structure and types)
**Can work in parallel with**: #58 (Spark 2.1 - processor implementation)

## Objective
Implement the command class that provides MCP tool interface and CLI execution for the ts-unused-code functionality.

## Implementation Requirements

### Reference Files to Study

#### Command Patterns
- `pack

[Read the thread](https://github.com/chris-schra/mcp-funnel/issues/59) · 2025-09-23 · closed · 2 comments

The remaining reports are on [the project's issue tracker](https://github.com/chris-schra/mcp-funnel/issues).

Reported issues for mcp-funnel

Most discussed

[OAUTH] [ISSUE-SUPERVISOR-006] [IMPLEMENTATION] DRY Violations Throughout Codebase

Problem Summary

Specific Files and Locations

Bearer Token Extraction Duplication (36 occurrences)

[OAUTH] [ISSUE-SUPERVISOR-002] [IMPLEMENTATION] Auto-Consent Security Bypass

Problem Summary

Key Files & Changes Required

1. Remove Auto-Consent (packages/server/src/oauth/oauth-provider.ts:158-166)

[OAUTH] [ISSUE-SUPERVISOR-003] [IMPLEMENTATION] Never-Expiring Security Tokens

Problem Summary

Consensus

Core Issue

Key Evidence

[OAUTH] [ISSUE-SUPERVISOR-005] [IMPLEMENTATION] Missing Reconnection Logic

Problem Summary

Current State

[OAUTH] [ISSUE-SUPERVISOR-004] [IMPLEMENTATION] Mock Data in Production API

Problem Summary

Problem

[OAUTH] [ISSUE-SUPERVISOR-001] [IMPLEMENTATION] Fix Timing Attack Vulnerability in Bearer Token Validation

Implementation Task

Problem

Solution

Implementation Steps

[OAUTH] [ISSUE-SUPERVISOR-007] Flaky Test Indicates Race Condition

MUST-FOLLOW POLICY: NO EXCEPTIONS!

Global Rules for All Agents

[OAUTH] [ISSUE-SUPERVISOR-003] Never-Expiring Security Tokens

MUST-FOLLOW POLICY: NO EXCEPTIONS!

Global Rules for All Agents

Most recent

npm bundle v0.0.8 is stale (predates PR #93 fix) — needs republish

Symptom

Bug: Environment variables in server env field not expanded

Problem

Expected Behavior

1. Remove Auto-Consent (`packages/server/src/oauth/oauth-provider.ts:158-166`)

Bug: Environment variables in server `env` field not expanded