Reported issues for MCP Gateway

Pod holds 23 of 114 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to MCP Gateway.

Most discussed

On-Chain Market Intelligence Co-Pilot with 4× Faster Insights

Source: https://panteracapital.com/blockchain-letter/navigating-crypto-in-2026/

Innovation

Pantera highlights consumer AI platforms like Surf.ai delivering "on-chain-backed market insights 4× faster" than alternatives. AI as crypto co-pilot for real-time blockchain analytics.

100× Supercharge: MCP On-Chain Intelligence Agent

from dataclasses import dataclass
from typing import Literal
import asyncio

@dataclass
class MarketInsight:
    """On-chain derived market insight."""
  

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/38) · 2026-02-02 · closed · 5 comments

### [BUG] gateway.yaml: permission 0600 causes infinite restart loop with misleading error + state-file data loss

# gateway.yaml permission 0600 causes infinite restart loop with misleading error

**Version**: mcp-gateway 3.4.0 (ghcr.io/mikkoparkkola/mcp-gateway:latest)

## Summary

When the mounted `gateway.yaml` is not readable by the in-container user, the gateway enters an **infinite restart loop** and logs a misleading error that gives no hint about the actual cause.

## Environment

- Container: `ghcr.io/mikkoparkkola/mcp-gateway:latest` (3.4.0)
- Started with read-only bind mount of config:

Read the thread · 2026-08-21 · open · external user · 4 comments

[FEATURE] support setting client host, client port and client secret for Oauth flows

Problem

Slack and Figma have specific needs: Figma requires the host to be "localhost" instead of ip address, Slack requires a specific port and a specific callback path.

Proposed Solution

Provide fields that can be filled in the yaml file, and fallback to defaults if there is none.

Alternatives Considered

Additional Context

Read the thread · 2026-04-20 · closed · external user · 3 comments

security: migrate JWT from RS256 to PQC-safe algorithm + enforce TLS 1.3 minimum

Summary

Two PQC gaps:

1. JWT uses RS256 (RSA-2048)

RSA-2048 broken by Shor's algorithm. Migration: short-term switch internal tokens to HS256 (HMAC-SHA256, already PQC-safe). Medium-term adopt ML-DSA when available in Rust. aws_lc_rs backend already used (good).

2. TLS 1.2 still allowed

Enforce TLS 1.3 minimum. Track rustls PQC cipher suite support (ML-KEM/Kyber) for adoption when available.

Acceptance Criteria

Internal JWT tokens use HS256 where asymmetric not required

Read the thread · 2026-04-11 · closed · 3 comments

MCP security audit: tool poisoning, gateway bypass, scope collision (Doyensec research)

Source

Doyensec — The MCP AuthN/Z Nightmare | Sponsored by Teleport

Problem

Doyensec's MCP security research explicitly identifies MCP Proxies/Gateways as an attack surface:

"MCP Proxies/Gateways: Intermediary systems (like MCP proxies) used for routing and authorization of MCP. These could alter passing MCP messages or simply be vulnerable to policy bypasses."

mcp-gateway is a meta-MCP proxy routing 178+ tools across mu

Read the thread · 2026-03-11 · closed · 3 comments

Add Gemini Embedding 2 multimodal embedding capability

Context

Google released Gemini Embedding 2 Preview (gemini-embedding-2-preview) — the first multimodal embedding model in the Gemini API. It maps text, images, video, audio, and documents into a unified embedding space.

Source: https://ai.google.dev/gemini-api/docs/embeddings (via Google Developer notification)

Key features

Multimodal: text + images + video + audio + documents in one embedding space
**Cross-modal search

Read the thread · 2026-03-11 · closed · 3 comments

Add OpenPencil capability: 90 MCP tools for design file operations

Context

OpenPencil is an open-source design editor with a 90-tool MCP server for reading, writing, querying, and exporting Figma .fig files. It supports both stdio and HTTP transports.

Source: https://github.com/open-pencil/open-pencil

Tool Categories (90 tools)

File management (3): open, create, save .fig files
Node operations (~30): create shapes, frames, text; set fills, strokes, effects; manage auto-layout
**Compone

Read the thread · 2026-03-11 · closed · 3 comments

Safe Code Execution MCP Server

Overview

Containerized Python/JavaScript runtime for safe code execution - a core gateway capability for AI agents that need to run untrusted code.

Why This Matters

AI agents frequently need to:

Execute user-provided code snippets
Run generated code for validation
Process data transformations
Test implementations before deployment

Without sandboxing, this is a critical security risk.

Proposed Implementation

Sandboxed Execution Service

class SafeCodeExecutor:
  

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/49) · 2026-02-02 · closed · 3 comments

## Most recent

### Reload refusal message can state that nothing was applied, once env files stop being applied early

## Problem

The network-posture refusal message at `src/config_reload/mod.rs:1478-1482` deliberately
states two bounded facts and no summary of what is still in force. The comment above it
(`:1483-1492`) says why: `Config::load` applies the candidate's `env_files` to the process
environment before returning, so at the moment the refusal is computed the environment has
already been mutated, and a later capability call can resolve an `env:` credential to a
value the refused file supplied. The mess

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/463) · 2026-08-29 · open · 2 comments

### An unparseable config is replaced with defaults, then written back to disk

## Problem

`load_config_or_default` turns any `Config::load` failure into `Config::default()` after a
warn-level log (`src/config_persistence.rs:13-22`). One of its callers is the admin-UI
read-modify-write path, which then writes the result straight back to disk:

```rust
let mut config = crate::config_persistence::load_config_or_default(path);   // :1405
let value = match mutate(&mut config) { ... };
crate::config_persistence::write_config(path, &config)?;                    // :1410

(`s

Read the thread · 2026-08-29 · open · 2 comments

Config watcher misses a symlink retargeted across directories

Problem

The config watcher resolves a symlinked config path per event, so a retarget within an already-watched directory is picked up. A retarget to a file in a directory that was not watched at startup is not: notify watches are added once, before the event loop starts (src/config_reload/mod.rs:1066-1085), and the callback cannot add more.

Result: after such a retarget, writes to the new target produce no reload and the gateway keeps serving the previous configuration, silently.

This

Read the thread · 2026-08-28 · open · 2 comments

DELETE /mcp terminates a session without checking the caller owns it

Reported by an independent review of PR #450 and confirmed at source. Out of scope for that PR: the handler is untouched by it.

Problem. DELETE /mcp at src/gateway/router/handlers.rs:249 removes the session named by the mcp-session-id header without resolving the caller principal, so it never applies the owner binding that GET and POST enforce via session_owner (src/gateway/router/handlers.rs:135). A caller who knows another session's id can terminate that session's stream.

Read the thread · 2026-08-28 · open · 2 comments

Pending sampling responses are resolved without checking session ownership

Reported by an independent review of PR #450 and confirmed at source. Out of scope for that PR: the lines are untouched by it (git diff origin/main...HEAD covers no hunk at this location).

Problem. resolve_pending in src/gateway/router/handlers.rs:487 routes a sampling/elicitation response purely by request id. The pending map (src/gateway/proxy.rs:74) stores no owner, so any session that learns a prompt id can answer another session's prompt — including a destructive-action confirm

Read the thread · 2026-08-28 · open · 2 comments

[FEATURE] Allow operators to trim the exposed gateway_* meta-tool surface (reduce AI distraction)

Summary

When mcp-gateway is used as the backend in front of an AI agent (OpenClaw / Claude / Gemini, etc.), every authenticated client sees all 17 gateway_* meta-tools in tools/list, regardless of role or actual need. Most deployments only need a small subset; the rest (stats, cost report, playbook, kill/revive server, profile management, reload, set_state, etc.) are either irrelevant or outright dangerous to expose to a general-purpose agent.

A bloated tool surface measurably hu

Read the thread · 2026-08-25 · open · external user · 2 comments

surfaced_tools is parsed and then ignored: config accepted, tools never appear in tools/list

Summary

meta_mcp.surfaced_tools is accepted by the config loader and has no effect at runtime on build 3.4.0-f30539af. The tool never appears in tools/list, and nothing is logged at any level to say why.

Reproduction

meta_mcp:
  warm_start:
    - vault-operator
  surfaced_tools:
    - server: vault-operator
      tool: search_vault

initialize -> 200
tools/list -> ["gateway_search", "gateway_execute"]

Expected search_vault alongside the meta-tools.

Why i

Read the thread · 2026-08-23 · open · 2 comments

Transport errors are flattened into a string, so callers cannot tell permanent from transient

Problem: the stdio transport maps every spawn failure to Error::Transport(format!("Failed to spawn: {e}")). The io::ErrorKind is destroyed at that boundary, so a mistyped command path (NotFound) and a non-executable binary (PermissionDenied) are indistinguishable from a port that is not listening yet.

Warm-start (#424) retries while a backend's tool cache is empty, so a typo in a backend command produces a respawn attempt once a minute for the process lifetime, with nothing saying the c

Read the thread · 2026-08-16 · closed · 0 comments

Concurrent config reloads can orphan a started backend

Problem

BackendRegistry::register uses DashMap::insert, which silently replaces a same-name entry and discards the displaced backend. If that backend had been started, nothing stops it — its process outlives the gateway.

Evidence it is reachable

ReloadContext::reload_outcome has no serialization, and it is called from three concurrent HTTP paths:

gateway_reload_config meta-tool — src/gateway/meta_mcp/invoke.rs:2101
admin UI reload — src/gateway/ui/mod.rs:647
every adm

Read the thread · 2026-07-26 · closed · 0 comments

backends: stop_when_idle_for - release gateway-owned backend processes after inactivity

What this is

Stop a gateway-started backend process after it has been unused for a configured time, and restart it automatically on the next request.

backends:
  tavily:
    command: "npx -y tavily-mcp@0.1.4"
    stop_when_idle_for: 5m

Why

The gateway starts backends lazily, so it never holds 24 resident children. But once a backend is started it is never stopped. Measured on a real 6-day-uptime machine:

backend	resident	age	CPU used
`code

Read the thread · 2026-07-26 · closed · 2 comments

Security: Exposed API Key Detected (openai)

Security Notice: Exposed API Key Detected

Hi there! This is an automated, good-faith security notification.

This repository appears to contain an exposed OPENAI API key that could lead to unauthorized charges on your account.

Details

Field	Value
File	`src/security/firewall/redactor.rs`
Key Type	OpenAI Project Key
Severity	CRITICAL
Cost Risk	GPT-4 calls can cost $0.01-0.10+ per request. Drains fast.
Detected	re

Read the thread · 2026-07-15 · closed · external user · 1 comment

Security: Exposed API Key Detected (openai)

Security Notice: Exposed API Key Detected

Hi there! This is an automated, good-faith security notification.

This repository appears to contain an exposed OPENAI API key that could lead to unauthorized charges on your account.

Details

Field	Value
File	`src/security/firewall/redactor.rs`
Key Type	OpenAI Project Key
Severity	CRITICAL
Cost Risk	GPT-4 calls can cost $0.01-0.10+ per request. Drains fast.
Detected	20

Read the thread · 2026-07-15 · closed · external user · 1 comment

[BUG] OAuth URL misses resources (maybe?)

Description

For https://influxdb-docs.mcp.kapa.ai/ the OAuth login flow fails.

Steps to Reproduce

backends:
  influxdb-docs:
    http_url: "https://influxdb-docs.mcp.kapa.ai"
    oauth:
      enabled: true

Then try to log in using Google.

Expected Behavior

This should work, other MCP clients can handle that.

Actual Behavior

It fails, funnily with an upstream server error (I think on the google side). Then mcp-gateway gets this callback:

`http://localhost:/o

Read the thread · 2026-07-13 · closed · external user · 1 comment

[BUG] OAuth discovery -- wrong path construction

Description

For https://influxdb-docs.mcp.kapa.ai/ the OAuth login flow fails.

Steps to Reproduce

backends:
  influxdb-docs:
    http_url: "https://influxdb-docs.mcp.kapa.ai"
    oauth:
      enabled: true

Expected Behavior

This should work, other MCP clients can handle that.

Actual Behavior

It fails with:

2026-07-09T16:00:34.754215Z  INFO mcp_gateway::gateway::server::warmstart: Warm-starting ALL 1 backends (tool prefetch)
2026-07-09T16:00:34.754239Z  INFO 

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/346) · 2026-07-09 · closed · external user · 1 comment

### [bug] fulcrum search backends fail output-schema validation on valid upstream fields (brave 'mixed'/'type', exa 'costDollars'/'searchTime')

## DoR: PASS

### Problem
The fulcrum capability backend's output-schema validation is too strict: it rejects valid extra fields that upstream search APIs return, so the tool **errors after a successful, authenticated API call**. Observed 2026-06-14 against `fulcrum:brave_search` and `fulcrum:exa_search`:

- `brave_search` → `Parameter 'mixed': unknown parameter`, `Parameter 'type': unknown parameter` (valid: discussions, faq, infobox, locations, news, query, summarizer, videos, web).
- `exa_sea

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/250) · 2026-06-14 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/MikkoParkkola/mcp-gateway/issues).