# Reported issues for MCP Gateway by MikkoParkkola

Pod holds 23 of 114 GitHub reports that passed its relevance review. This can include external user reports, maintainer-confirmed bugs, and concrete feature gaps. Treat them as evidence to inspect, not a count of distinct defects.

Back to [MCP Gateway by MikkoParkkola](/mcp/mcp-gateway-by-mikkoparkkola).

## Most discussed

### On-Chain Market Intelligence Co-Pilot with 4× Faster Insights

Source: https://panteracapital.com/blockchain-letter/navigating-crypto-in-2026/

## Innovation
Pantera highlights consumer AI platforms like Surf.ai delivering "on-chain-backed market insights 4× faster" than alternatives. AI as crypto co-pilot for real-time blockchain analytics.

## 100× Supercharge: MCP On-Chain Intelligence Agent

```python
from dataclasses import dataclass
from typing import Literal
import asyncio

@dataclass
class MarketInsight:
    """On-chain derived market insight."""
  

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/38) · 2026-02-02 · closed · 5 comments

### [BUG] gateway.yaml: permission 0600 causes infinite restart loop with misleading error + state-file data loss

# gateway.yaml permission 0600 causes infinite restart loop with misleading error

**Version**: mcp-gateway 3.4.0 (ghcr.io/mikkoparkkola/mcp-gateway:latest)

## Summary

When the mounted `gateway.yaml` is not readable by the in-container user, the gateway enters an **infinite restart loop** and logs a misleading error that gives no hint about the actual cause.

## Environment

- Container: `ghcr.io/mikkoparkkola/mcp-gateway:latest` (3.4.0)
- Started with read-only bind mount of config:
  ```
  -

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/437) · 2026-08-21 · open · external user · 4 comments

### [FEATURE] support setting client host, client port and client secret for Oauth flows

## Problem
<!-- What problem does this solve? -->
Slack and Figma have specific needs: Figma requires the host to be "localhost" instead of ip address, Slack requires a specific port and a specific callback path.

## Proposed Solution
<!-- How should it work? -->
Provide fields that can be filled in the yaml file, and fallback to defaults if there is none. 

## Alternatives Considered
<!-- Other approaches you've thought about -->

## Additional Context
<!-- Any other relevant information -->
I 

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/140) · 2026-04-20 · closed · external user · 3 comments

### security: migrate JWT from RS256 to PQC-safe algorithm + enforce TLS 1.3 minimum

## Summary

Two PQC gaps:

### 1. JWT uses RS256 (RSA-2048)
RSA-2048 broken by Shor's algorithm. Migration: short-term switch internal tokens to HS256 (HMAC-SHA256, already PQC-safe). Medium-term adopt ML-DSA when available in Rust. aws_lc_rs backend already used (good).

### 2. TLS 1.2 still allowed
Enforce TLS 1.3 minimum. Track rustls PQC cipher suite support (ML-KEM/Kyber) for adoption when available.

## Acceptance Criteria

- [ ] Internal JWT tokens use HS256 where asymmetric not required

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/116) · 2026-04-11 · closed · 3 comments

### MCP security audit: tool poisoning, gateway bypass, scope collision (Doyensec research)

## Source

[Doyensec — The MCP AuthN/Z Nightmare](https://blog.doyensec.com/2026/03/05/mcp-nightmare.html) | Sponsored by Teleport

## Problem

Doyensec's MCP security research explicitly identifies **MCP Proxies/Gateways** as an attack surface:

> "MCP Proxies/Gateways: Intermediary systems (like MCP proxies) used for routing and authorization of MCP. These could alter passing MCP messages or simply be vulnerable to policy bypasses."

mcp-gateway is a meta-MCP proxy routing 178+ tools across mu

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/100) · 2026-03-11 · closed · 3 comments

### Add Gemini Embedding 2 multimodal embedding capability

## Context

Google released [Gemini Embedding 2 Preview](https://ai.google.dev/gemini-api/docs/embeddings) (`gemini-embedding-2-preview`) — the first multimodal embedding model in the Gemini API. It maps text, images, video, audio, and documents into a unified embedding space.

**Source**: https://ai.google.dev/gemini-api/docs/embeddings (via Google Developer notification)

### Key features

- **Multimodal**: text + images + video + audio + documents in one embedding space
- **Cross-modal search

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/97) · 2026-03-11 · closed · 3 comments

### Add OpenPencil capability: 90 MCP tools for design file operations

## Context

[OpenPencil](https://github.com/open-pencil/open-pencil) is an open-source design editor with a 90-tool MCP server for reading, writing, querying, and exporting Figma `.fig` files. It supports both stdio and HTTP transports.

**Source**: https://github.com/open-pencil/open-pencil

### Tool Categories (90 tools)

- **File management** (3): open, create, save .fig files
- **Node operations** (~30): create shapes, frames, text; set fills, strokes, effects; manage auto-layout
- **Compone

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/95) · 2026-03-11 · closed · 3 comments

### Safe Code Execution MCP Server

## Overview
Containerized Python/JavaScript runtime for safe code execution - a core gateway capability for AI agents that need to run untrusted code.

## Why This Matters
AI agents frequently need to:
- Execute user-provided code snippets
- Run generated code for validation
- Process data transformations
- Test implementations before deployment

Without sandboxing, this is a critical security risk.

## Proposed Implementation

### Sandboxed Execution Service
```python
class SafeCodeExecutor:
  

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/49) · 2026-02-02 · closed · 3 comments

## Most recent

### Reload refusal message can state that nothing was applied, once env files stop being applied early

## Problem

The network-posture refusal message at `src/config_reload/mod.rs:1478-1482` deliberately
states two bounded facts and no summary of what is still in force. The comment above it
(`:1483-1492`) says why: `Config::load` applies the candidate's `env_files` to the process
environment before returning, so at the moment the refusal is computed the environment has
already been mutated, and a later capability call can resolve an `env:` credential to a
value the refused file supplied. The mess

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/463) · 2026-08-29 · open · 2 comments

### An unparseable config is replaced with defaults, then written back to disk

## Problem

`load_config_or_default` turns any `Config::load` failure into `Config::default()` after a
warn-level log (`src/config_persistence.rs:13-22`). One of its callers is the admin-UI
read-modify-write path, which then writes the result straight back to disk:

```rust
let mut config = crate::config_persistence::load_config_or_default(path);   // :1405
let value = match mutate(&mut config) { ... };
crate::config_persistence::write_config(path, &config)?;                    // :1410
```

(`s

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/462) · 2026-08-29 · open · 2 comments

### Config watcher misses a symlink retargeted across directories

## Problem

The config watcher resolves a symlinked config path per event, so a retarget within an
already-watched directory is picked up. A retarget to a file in a directory that was not
watched at startup is not: `notify` watches are added once, before the event loop starts
(`src/config_reload/mod.rs:1066-1085`), and the callback cannot add more.

Result: after such a retarget, writes to the new target produce no reload and the gateway
keeps serving the previous configuration, silently.

This 

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/453) · 2026-08-28 · open · 2 comments

### DELETE /mcp terminates a session without checking the caller owns it

Reported by an independent review of PR #450 and confirmed at source. Out of scope for that PR: the handler is untouched by it.

**Problem.** `DELETE /mcp` at `src/gateway/router/handlers.rs:249` removes the session named by the `mcp-session-id` header without resolving the caller principal, so it never applies the owner binding that `GET` and `POST` enforce via `session_owner` (`src/gateway/router/handlers.rs:135`). A caller who knows another session's id can terminate that session's stream.

S

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/452) · 2026-08-28 · open · 2 comments

### Pending sampling responses are resolved without checking session ownership

Reported by an independent review of PR #450 and confirmed at source. Out of scope for that PR: the lines are untouched by it (`git diff origin/main...HEAD` covers no hunk at this location).

**Problem.** `resolve_pending` in `src/gateway/router/handlers.rs:487` routes a sampling/elicitation response purely by request id. The pending map (`src/gateway/proxy.rs:74`) stores no owner, so any session that learns a prompt id can answer another session's prompt — including a destructive-action confirm

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/451) · 2026-08-28 · open · 2 comments

### [FEATURE] Allow operators to trim the exposed gateway_* meta-tool surface (reduce AI distraction)

### Summary

When `mcp-gateway` is used as the backend in front of an AI agent (OpenClaw / Claude / Gemini, etc.), **every authenticated client sees all 17 `gateway_*` meta-tools in `tools/list`, regardless of role or actual need.** Most deployments only need a small subset; the rest (stats, cost report, playbook, kill/revive server, profile management, reload, set_state, etc.) are either irrelevant or outright dangerous to expose to a general-purpose agent.

A bloated tool surface measurably hu

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/449) · 2026-08-25 · open · external user · 2 comments

### surfaced_tools is parsed and then ignored: config accepted, tools never appear in tools/list

## Summary

`meta_mcp.surfaced_tools` is accepted by the config loader and has no effect at runtime on build `3.4.0-f30539af`. The tool never appears in `tools/list`, and nothing is logged at any level to say why.

## Reproduction

```yaml
meta_mcp:
  warm_start:
    - vault-operator
  surfaced_tools:
    - server: vault-operator
      tool: search_vault
```

```
initialize -> 200
tools/list -> ["gateway_search", "gateway_execute"]
```

Expected `search_vault` alongside the meta-tools.

## Why i

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/440) · 2026-08-23 · open · 2 comments

### Transport errors are flattened into a string, so callers cannot tell permanent from transient

**Problem**: the stdio transport maps every spawn failure to `Error::Transport(format!("Failed to spawn: {e}"))`. The `io::ErrorKind` is destroyed at that boundary, so a mistyped command path (NotFound) and a non-executable binary (PermissionDenied) are indistinguishable from a port that is not listening yet.

Warm-start (#424) retries while a backend's tool cache is empty, so a typo in a backend command produces a respawn attempt once a minute for the process lifetime, with nothing saying the c

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/425) · 2026-08-16 · closed · 0 comments

### Concurrent config reloads can orphan a started backend

## Problem

`BackendRegistry::register` uses `DashMap::insert`, which silently replaces a same-name entry and discards the displaced backend. If that backend had been started, nothing stops it — its process outlives the gateway.

## Evidence it is reachable

`ReloadContext::reload_outcome` has no serialization, and it is called from three concurrent HTTP paths:

- `gateway_reload_config` meta-tool — `src/gateway/meta_mcp/invoke.rs:2101`
- admin UI reload — `src/gateway/ui/mod.rs:647`
- every adm

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/397) · 2026-07-26 · closed · 0 comments

### backends: stop_when_idle_for - release gateway-owned backend processes after inactivity

## What this is

Stop a gateway-started backend process after it has been unused for a configured time, and restart it automatically on the next request.

```yaml
backends:
  tavily:
    command: "npx -y tavily-mcp@0.1.4"
    stop_when_idle_for: 5m
```

## Why

The gateway starts backends lazily, so it never holds 24 resident children. But **once a backend is started it is never stopped.** Measured on a real 6-day-uptime machine:

| backend | resident | age | CPU used |
|---|---|---|---|
| `code

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/392) · 2026-07-26 · closed · 2 comments

### Security: Exposed API Key Detected (openai)

## Security Notice: Exposed API Key Detected

Hi there! This is an automated, good-faith security notification.

This repository appears to contain an **exposed OPENAI API key** that could lead to unauthorized charges on your account.

### Details

| Field | Value |
|-------|-------|
| **File** | `src/security/firewall/redactor.rs` |
| **Key Type** | OpenAI Project Key |
| **Severity** | CRITICAL |
| **Cost Risk** | GPT-4 calls can cost $0.01-0.10+ per request. Drains fast. |
| **Detected** | re

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/377) · 2026-07-15 · closed · external user · 1 comment

### Security: Exposed API Key Detected (openai)

## Security Notice: Exposed API Key Detected

Hi there! This is an automated, good-faith security notification.

This repository appears to contain an **exposed OPENAI API key** that could lead to unauthorized charges on your account.

### Details

| Field | Value |
|-------|-------|
| **File** | `src/security/firewall/redactor.rs` |
| **Key Type** | OpenAI Project Key |
| **Severity** | CRITICAL |
| **Cost Risk** | GPT-4 calls can cost $0.01-0.10+ per request. Drains fast. |
| **Detected** | 20

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/376) · 2026-07-15 · closed · external user · 1 comment

### [BUG] OAuth URL misses resources (maybe?)

## Description
For <https://influxdb-docs.mcp.kapa.ai/> the OAuth login flow fails.

## Steps to Reproduce
```yaml
backends:
  influxdb-docs:
    http_url: "https://influxdb-docs.mcp.kapa.ai"
    oauth:
      enabled: true
```

Then try to log in using Google.

## Expected Behavior
This should work, other MCP clients can handle that.

## Actual Behavior
It fails, funnily with an upstream server error (I think on the google side). Then `mcp-gateway` gets this callback:

`http://localhost:<PORT>/o

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/369) · 2026-07-13 · closed · external user · 1 comment

### [BUG] OAuth discovery -- wrong path construction

## Description
For <https://influxdb-docs.mcp.kapa.ai/> the OAuth login flow fails.

## Steps to Reproduce
```yaml
backends:
  influxdb-docs:
    http_url: "https://influxdb-docs.mcp.kapa.ai"
    oauth:
      enabled: true
```

## Expected Behavior
This should work, other MCP clients can handle that.

## Actual Behavior
It fails with:

```text
2026-07-09T16:00:34.754215Z  INFO mcp_gateway::gateway::server::warmstart: Warm-starting ALL 1 backends (tool prefetch)
2026-07-09T16:00:34.754239Z  INFO 

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/346) · 2026-07-09 · closed · external user · 1 comment

### [bug] fulcrum search backends fail output-schema validation on valid upstream fields (brave 'mixed'/'type', exa 'costDollars'/'searchTime')

## DoR: PASS

### Problem
The fulcrum capability backend's output-schema validation is too strict: it rejects valid extra fields that upstream search APIs return, so the tool **errors after a successful, authenticated API call**. Observed 2026-06-14 against `fulcrum:brave_search` and `fulcrum:exa_search`:

- `brave_search` → `Parameter 'mixed': unknown parameter`, `Parameter 'type': unknown parameter` (valid: discussions, faq, infobox, locations, news, query, summarizer, videos, web).
- `exa_sea

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/250) · 2026-06-14 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/MikkoParkkola/mcp-gateway/issues).