Reported issues for mcp-server-scf

Pod holds 17 of 31 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to mcp-server-scf.

Most discussed

Enhance update_scoped_control with all implementation tracking fields

Summary

The update_scoped_control MCP tool needs to expose all implementation tracking fields available on the platform API, plus two fields that are pending platform support.

Currently exposed in MCP tool

• status (implementation_status)
• owner
• notes (implementation_notes)
• justification

Fields to add (API already supports)

These fields exist in the platform's PATCH /scoped-controls/{id} endpoint but are not yet exposed in the MCP tool:

• priority — Contro

Read the thread · 2026-02-19 · closed · 2 comments

Add MCP Inspector quickstart to README

Priority: P3 (plan finding #25)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Acceptance criteria

• README "Try it" section shows npx @modelcontextprotocol/inspector npx -y mcp-server-scf with a screenshot
• Link to hosted Inspector playground if/when Anthropic publishes one

Read the thread · 2026-04-18 · closed · 1 comment

Tidy up README badges

Priority: P3 (plan finding #24)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Badges to add

• Smithery marketplace badge
• MCP registry badge (once listed — gated by the registry issue)
• Test coverage badge (once tests exist — gated by the test-suite issue)
• Bundle size badge

Badges to audit

• All badge links still resolve
• Grouped logically (CI / package / tech stack / community)

Read the thread · 2026-04-18 · closed · 1 comment

Add CODEOWNERS for review routing

Priority: P3 (plan finding #23)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Acceptance criteria

• .github/CODEOWNERS with per-path owners
• Branch protection updated to require CODEOWNERS review on protected files

Read the thread · 2026-04-18 · closed · 1 comment

403 self-heal silently reroutes writes into the key's sole accessible org

Summary

The 403 self-heal introduced in #186 (src/lib/api-client.ts) reroutes all HTTP methods — including POST/PATCH/PUT/DELETE — to the API key's sole accessible organization when the caller's org_id is denied. For a sole-org key, a write aimed at org A silently lands in org B. The only trace is a console.error to stderr, which MCP clients never surface to the user.

Reproduction (observed in production use, 2026-08-19)

1. Configure the MCP server with an API key whos

Read the thread · 2026-08-19 · closed · 0 comments

auto-release: bump commit is blocked by branch protection

Problem

The Update package.json and server.json versions step in .github/workflows/auto-release.yml tries to push the release-prep commit directly to the default branch. Branch protection rejects this every cycle:

remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: - Changes must be made through a pull request.
remote: - 5 of 5 required status checks are expected.
 ! [remote rejected] main -> main (protected branch 

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/104) · 2026-04-19 · closed · 0 comments

### Release health check: npm propagation + MCP registry publishing + server.json drift

## Context

Noticed while reviewing post-merge state of #99:

- npm latest is **1.0.4** (published by auto-release on PR #99 merge).
- [socket.dev](https://socket.dev/npm/package/mcp-server-scf) reportedly only shows up to **1.0.0** / **1.0.3** — meaning downstream security-analysis surfaces may be lagging days behind npm.
- [`server.json`](./server.json) is pinned at **`0.5.12`** for both the top-level `version` and `packages[0].version`. It has never been bumped alongside `package.json`, so th

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/100) · 2026-04-19 · closed · 0 comments

### Migrate to TypeScript 6 (tsconfig types field + ecosystem compat check)

## Problem

Dependabot opened #39 to bump TypeScript `5.9.3 → 6.0.2`. The build fails on every Node matrix version with TS2591 errors:

src/index.ts(3,31): error TS2591: Cannot find name 'node:module'. Do you need to install type definitions for node? src/index.ts(49,3): error TS2591: Cannot find name 'process'. Do you need to install type definitions for node? src/lib/api-client.ts(106,20): error TS2591: Cannot find name 'process'. Do you need to install type definitions for node? src/lib/a

Read the thread · 2026-04-18 · closed · 0 comments

Most recent

Add FUNDING.yml (optional)

Priority: P3 (plan finding #22)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Only if Compliance Genie wants GitHub Sponsors, Open Collective, or external funding links.

Acceptance criteria

• Decision made (yes / no). If yes: .github/FUNDING.yml committed with appropriate links.

Read the thread · 2026-04-18 · closed · 0 comments

Tool description quality pass (read-cold test)

Priority: P2 (plan section: Tool description quality pass)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Anthropic guidance Each tool description should: front-load the action; note side effects, auth requirements, rate limits; stay within ~200 chars.

Acceptance criteria

• Every .describe() on every tool passes the read-cold test: an agent with zero project context picks the right tool from description alone
• [

Read the thread · 2026-04-18 · closed · 0 comments

Evaluate streamable HTTP transport for hosted / web-IDE use

Priority: P2 (plan finding #21)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Not committed. Scoping issue to evaluate demand.

Inputs for decision

• Customer asks (enterprise, hosted)
• Web-IDE integration opportunities
• Cost of OAuth 2.1 + PKCE (gated by the OAuth 2.1 issue)

Output

• Design doc: transport selection, auth, rate limiting, observability
• Go/no-go decision with date

Read the thread · 2026-04-18 · open · 0 comments

OAuth 2.1 design constraint (deferred until HTTP transport)

Priority: P2 (plan finding #20)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Status: capture-only. stdio transport doesn't need OAuth. Record the design constraint so nobody ships remote HTTP without it.

Acceptance criteria

• Architecture doc notes: "If HTTP transport is added, OAuth 2.1 + PKCE is mandatory per MCP 2025-11-25 spec"
• Any future HTTP transport PR must link back to this issue

Read the thread · 2026-04-18 · open · 0 comments

Add .github issue and PR templates

Priority: P1 (plan finding #9)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Current state Workflows present, templates absent.

Acceptance criteria

• .github/ISSUE_TEMPLATE/bug.yml — form with env (OS, client, server version), repro, expected / actual, logs (redacted)
• .github/ISSUE_TEMPLATE/feature.yml — form with use-case, proposed API
• .github/ISSUE_TEMPLATE/tool-request.yml — form for "please add

Read the thread · 2026-04-18 · closed · 0 comments

Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1)

Priority: P1 (plan finding #8)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Acceptance criteria

• CODE_OF_CONDUCT.md at repo root — Contributor Covenant 2.1 text
• Point of contact for reports (email or security@)
• Linked from README and CONTRIBUTING.md

Read the thread · 2026-04-18 · closed · 0 comments

Add Prettier config + CI format check

Priority: P1 (plan finding #6)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Current state No Prettier. No formatting standard. Risk of whitespace / style drift between contributors.

Acceptance criteria

• .prettierrc committed (2-space indent, single quotes, trailing commas, 100-col print width — adjust if team prefers)
• .prettierignore committed (build/, dist/, node_modules/, *.md if we want to exclude)
• [

Read the thread · 2026-04-18 · closed · 0 comments

Add test suite (vitest + MCP Inspector conformance)

Priority: P1 (plan finding #4)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Current state No test script. No tests/ directory. CI builds + type-checks only. Zero regression safety for a product sold to compliance teams.

Expected state Vitest wired up; one test file per tool group; MCP Inspector smoke test in CI.

Acceptance criteria

• vitest + @modelcontextprotocol/inspector added to devDependencies
• [

Read the thread · 2026-04-18 · closed · 0 comments

Fix README tool count (claims 38, actually 67)

Priority: P0 (plan finding #2)

See Plans/this-repo-is-for-keen-russell.md for full audit context.

Current state README.md:29 advertises "38 tools across 7 domains". Actual registration is 67 tools across 8 domains. The per-domain table at lines 32–39 is out of date (Webhooks domain missing).

Expected state README matches reality; future drift is caught by CI.

Acceptance criteria

• Domain table recounted and update

Read the thread · 2026-04-18 · closed · 0 comments

The remaining reports are on the project's issue tracker.