Reported issues for mcp-seatbelt

Pod holds 13 of 13 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to mcp-seatbelt.

Most discussed

Add MCP server health check endpoint to proxy

Summary

Add a GET /:serverName/ping endpoint to the proxy's HTTP server that checks whether the named upstream MCP server is alive and reachable. Returns 200 when healthy, 503 when not.

Motivation

Orchestrators and monitoring tools need a cheap way to tell whether an agent's MCP servers are actually up through the proxy, without sending a real tool call. (Related to #5, which adds retry logic at registration time — this issue is about an ongoing, on-demand health endpoint.)

Read the thread · 2026-07-22 · open · 1 comment

Add --dry-run flag to proxy command

Summary

Add a --dry-run flag to mcp-seatbelt proxy that starts the proxy and prints every tool call that would be blocked by the active policy — without actually blocking anything. This lets users test policies safely before going live in enforce mode.

Motivation

Today the only way to see how a policy behaves is to run the proxy in enforce mode (risky — real calls get blocked) or to read the policy file by hand. A dry-run mode gives instant feedback: "these 3 calls from your age

Read the thread · 2026-07-22 · open · 1 comment

Add --watch flag auto-reload to proxy dashboard

The proxy already has --watch for policy hot reload. The dashboard at :9421 should auto-refresh when policy changes too.

What to do:

• In src/commands/dashboard.ts, add SSE endpoint that pushes updates when proxy stats change
• Dashboard page auto-refreshes without manual reload
• Bonus: show a notification when policy reloads

Difficulty: Medium. SSE + frontend JS. 3-4 hours. Files: src/commands/dashboard.ts, the inline HTML template.

Read the thread · 2026-07-17 · open · 1 comment

Add --output format flag to diff command

The mcp-seatbelt diff command currently outputs colored terminal text. Add --json and --markdown flags.

What to do:

• Add --json flag: outputs diff as JSON
• Add --markdown flag: outputs diff as markdown table
• Useful for CI/CD integration
• File: src/commands/diff.ts

Difficulty: Medium. Parse flags, format output. 2-3 hours.

Read the thread · 2026-07-17 · open · 1 comment

Add more MCP client detectors (JetBrains Fleet, Zed, Windsurf)

Seatbelt currently detects MCP configs for 8 clients. Let's add more.

What to do:

• Create src/detectors/fleet.ts for JetBrains Fleet
• Create src/detectors/zed.ts for Zed editor
• Follow the pattern in existing detectors (cursor.ts, vscode.ts, jetbrains.ts)
• Register in src/detectors/index.ts detectAll()

Difficulty: Easy. Copy existing detector, change paths. 1-2 hours. Tests: Add a test in tests/detectors.test.ts

Read the thread · 2026-07-17 · open · 1 comment

Add hotkeys to dashboard

Summary

Add keyboard shortcuts to the mcp-seatbelt dashboard UI so it can be driven without a mouse:

• R — refresh data now
• F — focus the filter input
• Space — pause/resume live updates

Motivation

The dashboard is often run in a terminal alongside the agent being watched. Hotkeys make it much faster to inspect a burst of blocked calls without reaching for the mouse.

Proposed behavior

• Keys work whenever the dashboard has focus.
• A small help footer (`R refresh · F fil

Read the thread · 2026-07-22 · open · 0 comments

Add JSON schema validation for policy.yml in CI

Summary

mcp-seatbelt check should fully validate the structure of policy.yml against a JSON Schema before doing anything else — unknown fields, wrong types, and missing required keys should fail fast with human-readable errors. Then wire that validation into CI so malformed policies never merge.

Motivation

Today a typo like defaultAction: denny or a rule missing action can slip through and only surface at proxy runtime. Structural validation at check time (and in CI) catches t

Read the thread · 2026-07-22 · closed · 0 comments

Add rate limit configuration to policy.yml

Summary

Rate limiting is currently only configurable via the --rate-limit CLI flag on mcp-seatbelt proxy. Add a rateLimitPerMinute field to PolicyConfig so the limit can live in policy.yml alongside the rest of the policy.

Motivation

Policies should be self-contained and version-controllable. A rate limit that only exists as a CLI flag is easy to forget, can't be shared through extends, and isn't part of the policy templates.

Proposed behavior

• PolicyConfig gains an

Read the thread · 2026-07-22 · open · 0 comments

Most recent

Add performance benchmark results to README

We have a mcp-seatbelt benchmark command but no published results.

What to do:

• Run mcp-seatbelt benchmark locally (or build a quick test)
• Document: requests/sec, p50/p95/p99 latency, throughput under load
• Add a "Performance" section to README.md with the numbers
• Include the benchmark command used

Difficulty: Easy. Run benchmark, write results. 1 hour.

Read the thread · 2026-07-17 · open · 0 comments

Add server-specific policy templates

mcp-firewall ships drop-in configs for common MCP servers. Let's do the same.

What to add to templates/:

• filesystem.yml — safe write paths, block /etc and ~/.ssh
• github.yml — block force-push, allow read-only operations
• shell.yml — strict: allow specific commands only
• playwright.yml — allow browser automation, block file system access

Each template should include:

• Appropriate defaultAction (deny for shell, allow for filesystem)
• 3-5 specific rules for that server

Read the thread · 2026-07-17 · open · 0 comments

Add CONTRIBUTING.md section for first-time contributors

The CONTRIBUTING.md exists but could use a more detailed first-time contributor walkthrough.

What to add:

• Step-by-step: clone → install → test → make change → PR
• Common gotchas (TypeScript strict mode, test conventions)
• How to run a single test file
• How to test the proxy locally
• Link to good-first-issue label

Difficulty: Easy. Documentation only. 1 hour.

Read the thread · 2026-07-17 · open · 0 comments

Add health check retry to proxy server registration

When the proxy starts, it spawns child processes for each registered MCP server. If a server takes >1s to start, the proxy fills the log with restart warnings.

What to do:

• Add a startupGracePeriod (default 5s) before starting the restart count
• Only count as failure if the process exits AFTER the grace period
• File: src/proxy/server.ts StdioClient

Difficulty: Medium. Timing logic + test. 2-3 hours.

Read the thread · 2026-07-17 · open · 0 comments

Add more secret patterns to DLP scanner

The response DLP scanner in src/proxy/intercept.ts scanResponse() currently checks 6 patterns (AWS keys, GitHub tokens, OpenAI keys, private keys, API keys, generic secrets).

What to add:

• GitLab tokens (glpat-)
• Slack bot tokens (xoxb-)
• JWT tokens (eyJ prefix)
• Stripe secret keys (sk_live_)
• Add tests in tests/proxy.test.ts

Difficulty: Easy. Add regex patterns + tests. 1-2 hours. File: src/proxy/intercept.ts scanResponse()

Read the thread · 2026-07-17 · open · 0 comments

The remaining reports are on the project's issue tracker.