# Reported issues for MCP Gateway

Pod holds 23 of 114 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [MCP Gateway](/mcp/mcp-gateway).

## Most discussed

### On-Chain Market Intelligence Co-Pilot with 4× Faster Insights

Source: https://panteracapital.com/blockchain-letter/navigating-crypto-in-2026/

## Innovation
Pantera highlights consumer AI platforms like Surf.ai delivering "on-chain-backed market insights 4× faster" than alternatives. AI as crypto co-pilot for real-time blockchain analytics.

## 100× Supercharge: MCP On-Chain Intelligence Agent

```python
from dataclasses import dataclass
from typing import Literal
import asyncio

@dataclass
class MarketInsight:
    """On-chain derived market insight."""
  

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/38) · 2026-02-02 · closed · 5 comments

### [BUG] gateway.yaml: permission 0600 causes infinite restart loop with misleading error + state-file data loss

# gateway.yaml permission 0600 causes infinite restart loop with misleading error

**Version**: mcp-gateway 3.4.0 (ghcr.io/mikkoparkkola/mcp-gateway:latest)

## Summary

When the mounted `gateway.yaml` is not readable by the in-container user, the gateway enters an **infinite restart loop** and logs a misleading error that gives no hint about the actual cause.

## Environment

- Container: `ghcr.io/mikkoparkkola/mcp-gateway:latest` (3.4.0)
- Started with read-only bind mount of config:
  ```
  -

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/437) · 2026-08-21 · open · external user · 4 comments

### [FEATURE] support setting client host, client port and client secret for Oauth flows

## Problem
<!-- What problem does this solve? -->
Slack and Figma have specific needs: Figma requires the host to be "localhost" instead of ip address, Slack requires a specific port and a specific callback path.

## Proposed Solution
<!-- How should it work? -->
Provide fields that can be filled in the yaml file, and fallback to defaults if there is none. 

## Alternatives Considered
<!-- Other approaches you've thought about -->

## Additional Context
<!-- Any other relevant information -->
I 

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/140) · 2026-04-20 · closed · external user · 3 comments

### security: migrate JWT from RS256 to PQC-safe algorithm + enforce TLS 1.3 minimum

## Summary

Two PQC gaps:

### 1. JWT uses RS256 (RSA-2048)
RSA-2048 broken by Shor's algorithm. Migration: short-term switch internal tokens to HS256 (HMAC-SHA256, already PQC-safe). Medium-term adopt ML-DSA when available in Rust. aws_lc_rs backend already used (good).

### 2. TLS 1.2 still allowed
Enforce TLS 1.3 minimum. Track rustls PQC cipher suite support (ML-KEM/Kyber) for adoption when available.

## Acceptance Criteria

- [ ] Internal JWT tokens use HS256 where asymmetric not required

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/116) · 2026-04-11 · closed · 3 comments

### MCP security audit: tool poisoning, gateway bypass, scope collision (Doyensec research)

## Source

[Doyensec — The MCP AuthN/Z Nightmare](https://blog.doyensec.com/2026/03/05/mcp-nightmare.html) | Sponsored by Teleport

## Problem

Doyensec's MCP security research explicitly identifies **MCP Proxies/Gateways** as an attack surface:

> "MCP Proxies/Gateways: Intermediary systems (like MCP proxies) used for routing and authorization of MCP. These could alter passing MCP messages or simply be vulnerable to policy bypasses."

mcp-gateway is a meta-MCP proxy routing 178+ tools across mu

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/100) · 2026-03-11 · closed · 3 comments

### Add Gemini Embedding 2 multimodal embedding capability

## Context

Google released [Gemini Embedding 2 Preview](https://ai.google.dev/gemini-api/docs/embeddings) (`gemini-embedding-2-preview`) — the first multimodal embedding model in the Gemini API. It maps text, images, video, audio, and documents into a unified embedding space.

**Source**: https://ai.google.dev/gemini-api/docs/embeddings (via Google Developer notification)

### Key features

- **Multimodal**: text + images + video + audio + documents in one embedding space
- **Cross-modal search

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/97) · 2026-03-11 · closed · 3 comments

### Add OpenPencil capability: 90 MCP tools for design file operations

## Context

[OpenPencil](https://github.com/open-pencil/open-pencil) is an open-source design editor with a 90-tool MCP server for reading, writing, querying, and exporting Figma `.fig` files. It supports both stdio and HTTP transports.

**Source**: https://github.com/open-pencil/open-pencil

### Tool Categories (90 tools)

- **File management** (3): open, create, save .fig files
- **Node operations** (~30): create shapes, frames, text; set fills, strokes, effects; manage auto-layout
- **Compone

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/95) · 2026-03-11 · closed · 3 comments

### Safe Code Execution MCP Server

## Overview
Containerized Python/JavaScript runtime for safe code execution - a core gateway capability for AI agents that need to run untrusted code.

## Why This Matters
AI agents frequently need to:
- Execute user-provided code snippets
- Run generated code for validation
- Process data transformations
- Test implementations before deployment

Without sandboxing, this is a critical security risk.

## Proposed Implementation

### Sandboxed Execution Service
```python
class SafeCodeExecutor:
  

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/49) · 2026-02-02 · closed · 3 comments

## Most recent

### Reload refusal message can state that nothing was applied, once env files stop being applied early

## Problem

The network-posture refusal message at `src/config_reload/mod.rs:1478-1482` deliberately
states two bounded facts and no summary of what is still in force. The comment above it
(`:1483-1492`) says why: `Config::load` applies the candidate's `env_files` to the process
environment before returning, so at the moment the refusal is computed the environment has
already been mutated, and a later capability call can resolve an `env:` credential to a
value the refused file supplied. The mess

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/463) · 2026-08-29 · open · 2 comments

### An unparseable config is replaced with defaults, then written back to disk

## Problem

`load_config_or_default` turns any `Config::load` failure into `Config::default()` after a
warn-level log (`src/config_persistence.rs:13-22`). One of its callers is the admin-UI
read-modify-write path, which then writes the result straight back to disk:

```rust
let mut config = crate::config_persistence::load_config_or_default(path);   // :1405
let value = match mutate(&mut config) { ... };
crate::config_persistence::write_config(path, &config)?;                    // :1410
```

(`s

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/462) · 2026-08-29 · open · 2 comments

### Config watcher misses a symlink retargeted across directories

## Problem

The config watcher resolves a symlinked config path per event, so a retarget within an
already-watched directory is picked up. A retarget to a file in a directory that was not
watched at startup is not: `notify` watches are added once, before the event loop starts
(`src/config_reload/mod.rs:1066-1085`), and the callback cannot add more.

Result: after such a retarget, writes to the new target produce no reload and the gateway
keeps serving the previous configuration, silently.

This 

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/453) · 2026-08-28 · open · 2 comments

### DELETE /mcp terminates a session without checking the caller owns it

Reported by an independent review of PR #450 and confirmed at source. Out of scope for that PR: the handler is untouched by it.

**Problem.** `DELETE /mcp` at `src/gateway/router/handlers.rs:249` removes the session named by the `mcp-session-id` header without resolving the caller principal, so it never applies the owner binding that `GET` and `POST` enforce via `session_owner` (`src/gateway/router/handlers.rs:135`). A caller who knows another session's id can terminate that session's stream.

S

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/452) · 2026-08-28 · open · 2 comments

### Pending sampling responses are resolved without checking session ownership

Reported by an independent review of PR #450 and confirmed at source. Out of scope for that PR: the lines are untouched by it (`git diff origin/main...HEAD` covers no hunk at this location).

**Problem.** `resolve_pending` in `src/gateway/router/handlers.rs:487` routes a sampling/elicitation response purely by request id. The pending map (`src/gateway/proxy.rs:74`) stores no owner, so any session that learns a prompt id can answer another session's prompt — including a destructive-action confirm

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/451) · 2026-08-28 · open · 2 comments

### [FEATURE] Allow operators to trim the exposed gateway_* meta-tool surface (reduce AI distraction)

### Summary

When `mcp-gateway` is used as the backend in front of an AI agent (OpenClaw / Claude / Gemini, etc.), **every authenticated client sees all 17 `gateway_*` meta-tools in `tools/list`, regardless of role or actual need.** Most deployments only need a small subset; the rest (stats, cost report, playbook, kill/revive server, profile management, reload, set_state, etc.) are either irrelevant or outright dangerous to expose to a general-purpose agent.

A bloated tool surface measurably hu

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/449) · 2026-08-25 · open · external user · 2 comments

### surfaced_tools is parsed and then ignored: config accepted, tools never appear in tools/list

## Summary

`meta_mcp.surfaced_tools` is accepted by the config loader and has no effect at runtime on build `3.4.0-f30539af`. The tool never appears in `tools/list`, and nothing is logged at any level to say why.

## Reproduction

```yaml
meta_mcp:
  warm_start:
    - vault-operator
  surfaced_tools:
    - server: vault-operator
      tool: search_vault
```

```
initialize -> 200
tools/list -> ["gateway_search", "gateway_execute"]
```

Expected `search_vault` alongside the meta-tools.

## Why i

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/440) · 2026-08-23 · open · 2 comments

### Transport errors are flattened into a string, so callers cannot tell permanent from transient

**Problem**: the stdio transport maps every spawn failure to `Error::Transport(format!("Failed to spawn: {e}"))`. The `io::ErrorKind` is destroyed at that boundary, so a mistyped command path (NotFound) and a non-executable binary (PermissionDenied) are indistinguishable from a port that is not listening yet.

Warm-start (#424) retries while a backend's tool cache is empty, so a typo in a backend command produces a respawn attempt once a minute for the process lifetime, with nothing saying the c

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/425) · 2026-08-16 · closed · 0 comments

### Concurrent config reloads can orphan a started backend

## Problem

`BackendRegistry::register` uses `DashMap::insert`, which silently replaces a same-name entry and discards the displaced backend. If that backend had been started, nothing stops it — its process outlives the gateway.

## Evidence it is reachable

`ReloadContext::reload_outcome` has no serialization, and it is called from three concurrent HTTP paths:

- `gateway_reload_config` meta-tool — `src/gateway/meta_mcp/invoke.rs:2101`
- admin UI reload — `src/gateway/ui/mod.rs:647`
- every adm

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/397) · 2026-07-26 · closed · 0 comments

### backends: stop_when_idle_for - release gateway-owned backend processes after inactivity

## What this is

Stop a gateway-started backend process after it has been unused for a configured time, and restart it automatically on the next request.

```yaml
backends:
  tavily:
    command: "npx -y tavily-mcp@0.1.4"
    stop_when_idle_for: 5m
```

## Why

The gateway starts backends lazily, so it never holds 24 resident children. But **once a backend is started it is never stopped.** Measured on a real 6-day-uptime machine:

| backend | resident | age | CPU used |
|---|---|---|---|
| `code

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/392) · 2026-07-26 · closed · 2 comments

### Security: Exposed API Key Detected (openai)

## Security Notice: Exposed API Key Detected

Hi there! This is an automated, good-faith security notification.

This repository appears to contain an **exposed OPENAI API key** that could lead to unauthorized charges on your account.

### Details

| Field | Value |
|-------|-------|
| **File** | `src/security/firewall/redactor.rs` |
| **Key Type** | OpenAI Project Key |
| **Severity** | CRITICAL |
| **Cost Risk** | GPT-4 calls can cost $0.01-0.10+ per request. Drains fast. |
| **Detected** | re

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/377) · 2026-07-15 · closed · external user · 1 comment

### Security: Exposed API Key Detected (openai)

## Security Notice: Exposed API Key Detected

Hi there! This is an automated, good-faith security notification.

This repository appears to contain an **exposed OPENAI API key** that could lead to unauthorized charges on your account.

### Details

| Field | Value |
|-------|-------|
| **File** | `src/security/firewall/redactor.rs` |
| **Key Type** | OpenAI Project Key |
| **Severity** | CRITICAL |
| **Cost Risk** | GPT-4 calls can cost $0.01-0.10+ per request. Drains fast. |
| **Detected** | 20

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/376) · 2026-07-15 · closed · external user · 1 comment

### [BUG] OAuth URL misses resources (maybe?)

## Description
For <https://influxdb-docs.mcp.kapa.ai/> the OAuth login flow fails.

## Steps to Reproduce
```yaml
backends:
  influxdb-docs:
    http_url: "https://influxdb-docs.mcp.kapa.ai"
    oauth:
      enabled: true
```

Then try to log in using Google.

## Expected Behavior
This should work, other MCP clients can handle that.

## Actual Behavior
It fails, funnily with an upstream server error (I think on the google side). Then `mcp-gateway` gets this callback:

`http://localhost:<PORT>/o

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/369) · 2026-07-13 · closed · external user · 1 comment

### [BUG] OAuth discovery -- wrong path construction

## Description
For <https://influxdb-docs.mcp.kapa.ai/> the OAuth login flow fails.

## Steps to Reproduce
```yaml
backends:
  influxdb-docs:
    http_url: "https://influxdb-docs.mcp.kapa.ai"
    oauth:
      enabled: true
```

## Expected Behavior
This should work, other MCP clients can handle that.

## Actual Behavior
It fails with:

```text
2026-07-09T16:00:34.754215Z  INFO mcp_gateway::gateway::server::warmstart: Warm-starting ALL 1 backends (tool prefetch)
2026-07-09T16:00:34.754239Z  INFO 

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/346) · 2026-07-09 · closed · external user · 1 comment

### [bug] fulcrum search backends fail output-schema validation on valid upstream fields (brave 'mixed'/'type', exa 'costDollars'/'searchTime')

## DoR: PASS

### Problem
The fulcrum capability backend's output-schema validation is too strict: it rejects valid extra fields that upstream search APIs return, so the tool **errors after a successful, authenticated API call**. Observed 2026-06-14 against `fulcrum:brave_search` and `fulcrum:exa_search`:

- `brave_search` → `Parameter 'mixed': unknown parameter`, `Parameter 'type': unknown parameter` (valid: discussions, faq, infobox, locations, news, query, summarizer, videos, web).
- `exa_sea

[Read the thread](https://github.com/MikkoParkkola/mcp-gateway/issues/250) · 2026-06-14 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/MikkoParkkola/mcp-gateway/issues).