# Reported issues for mcp-server-malcolm

Pod holds 8 of 8 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [mcp-server-malcolm](/mcp/mcp-server-malcolm).

## Most discussed

### Publish to PyPI

The package is release-ready (CI green, unit-tested). Publishing is blocked on PyPI account/token setup.

Once the token exists: build sdist/wheel, upload, verify `pip install mcp-server-malcolm` from a clean environment, then add install instructions to the README.

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/3) · 2026-07-17 · closed · 2 comments

### §1 install check uses `timeout`, which macOS does not ship (and macOS/arm64 is now verified)

## What happened

Two things in §1 Install that a macOS reader hits, one of them on the very first
command they run.

### 1. The install check uses `timeout`, which macOS does not ship

```bash
timeout 3 mcp-server-malcolm < /dev/null
```

`timeout` is GNU coreutils. It is not part of the BSD userland macOS ships, so on a
stock Mac this is `command not found` — on the one command whose entire job is to tell
the reader the install worked. It only ran here because Homebrew coreutils is installed
(

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/45) · 2026-08-14 · closed · 1 comment

### Design: opt-in write capabilities

The server is read-only by design, and read-only should stay the default posture. Some workflows would benefit from writes (e.g. tagging sessions, pcap upload — the upload endpoint is already exercised in the client code but not exposed as a tool).

Task: design what an opt-in write layer should look like — explicit per-tool allowlist, off by default, separate configuration flag — before any implementation.

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/2) · 2026-07-17 · closed · 1 comment

### Survey Malcolm API for additional read-only tool coverage

The server deliberately exposes a small read-only surface (OpenSearch DSL via the /mapi/opensearch proxy, field caps, pcap payload). Malcolm's API has more read-only endpoints that could be cheap wins (index/health introspection, Arkime session helpers, etc.).

Task: survey the Malcolm API surface, list read-only endpoints worth exposing as MCP tools, and rank them by value vs. effort. Implementation follows as separate PRs.

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/1) · 2026-07-17 · closed · 1 comment

### Per-tool disable list layered on the read groups

## The problem

`MALCOLM_MCP_DISABLE_READ_GROUPS` trims at group granularity, and one group cannot be
trimmed at all in practice. `arkime` is 11 tools and roughly 8,450 schema tokens, the
largest block of the 51, and it is also the one nobody can drop: `arkime_sessions` is the
only search that returns a session ID, so disabling the group takes every
`arkime-content` tool down with it.

So the most expensive part of the read surface is the part group granularity cannot touch.
A deployment that wa

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/52) · 2026-08-14 · open · 0 comments

### §2 should warn that the password on the `claude mcp add` line reaches shell history, ps, and ~/.claude.json

## What happened

README §2 shows registration as:

```bash
claude mcp add malcolm \
  -e MALCOLM_PASSWORD='your-password' \
  …
```

and later warns that `claude mcp get malcolm` prints `MALCOLM_PASSWORD` in cleartext.
That warning covers reading the value back, but not the two exposures the command itself
creates:

1. **Shell history.** The literal password is typed on the command line, so it lands in
   `~/.zsh_history` / `~/.bash_history` and stays there.
2. **`ps` output.** While `claude mc

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/47) · 2026-08-14 · closed · 0 comments

### Accept MALCOLM_BASE_URL as a fallback for MALCOLM_URL

## The problem

`from_env` reads `MALCOLM_URL` (`client.py:316`) and falls back to `https://localhost`
when it is unset. That default is a sensible one, but combined with how people arrive at
this server it produces a confusing first failure.

The path I took, which I suspect is common: I already had a Malcolm `.env` from another
project, so I reused it. It names the variable `MALCOLM_BASE_URL` (alongside
`MALCOLM_USERNAME` / `MALCOLM_PASSWORD` / `MALCOLM_SSL_VERIFY`, which all match this
server

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/46) · 2026-08-14 · open · 0 comments

### README documents 1.0.2 while PyPI, pyproject and server.json are at 1.1.0

## What happened

`pyproject.toml`, `server.json` and PyPI are all at **1.1.0**, but the README still
shows **1.0.2** everywhere it prints a version. A first-time reader compares the two
and cannot tell whether they installed the wrong thing or the README is stale.

Places that carry the old number:

- §1 Install — the `uv build` transcript (`mcp_server_malcolm-1.0.2.tar.gz`, `…-1.0.2-py3-none-any.whl`)
  and the `pip install` line that follows it
- §2 Register it with your client — the `initial

[Read the thread](https://github.com/nagameTW/mcp-server-malcolm/issues/44) · 2026-08-14 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/nagameTW/mcp-server-malcolm/issues).