# Reported issues for mcp-server-scf

Pod holds 17 of 31 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [mcp-server-scf](/mcp/mcp-server-scf).

## Most discussed

### Enhance update_scoped_control with all implementation tracking fields

## Summary

The `update_scoped_control` MCP tool needs to expose all implementation tracking fields available on the platform API, plus two fields that are pending platform support.

### Currently exposed in MCP tool

- `status` (implementation_status)
- `owner`
- `notes` (implementation_notes)
- `justification`

### Fields to add (API already supports)

These fields exist in the platform's `PATCH /scoped-controls/{id}` endpoint but are not yet exposed in the MCP tool:

- [ ] `priority` — Contro

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/9) · 2026-02-19 · closed · 2 comments

### Add MCP Inspector quickstart to README

## Priority: P3 (plan finding #25)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Acceptance criteria**
- [ ] README "Try it" section shows `npx @modelcontextprotocol/inspector npx -y mcp-server-scf` with a screenshot
- [ ] Link to hosted Inspector playground if/when Anthropic publishes one

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/78) · 2026-04-18 · closed · 1 comment

### Tidy up README badges

## Priority: P3 (plan finding #24)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Badges to add**
- [ ] Smithery marketplace badge
- [ ] MCP registry badge (once listed — gated by the registry issue)
- [ ] Test coverage badge (once tests exist — gated by the test-suite issue)
- [ ] Bundle size badge

**Badges to audit**
- [ ] All badge links still resolve
- [ ] Grouped logically (CI / package / tech stack / community)

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/77) · 2026-04-18 · closed · 1 comment

### Add CODEOWNERS for review routing

## Priority: P3 (plan finding #23)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Acceptance criteria**
- [ ] `.github/CODEOWNERS` with per-path owners
- [ ] Branch protection updated to require CODEOWNERS review on protected files

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/76) · 2026-04-18 · closed · 1 comment

### 403 self-heal silently reroutes writes into the key's sole accessible org

## Summary

The 403 self-heal introduced in #186 (`src/lib/api-client.ts`) reroutes **all** HTTP methods — including `POST`/`PATCH`/`PUT`/`DELETE` — to the API key's sole accessible organization when the caller's `org_id` is denied. For a sole-org key, a write aimed at org A silently lands in org B. The only trace is a `console.error` to stderr, which MCP clients never surface to the user.

## Reproduction (observed in production use, 2026-08-19)

1. Configure the MCP server with an API key whos

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/189) · 2026-08-19 · closed · 0 comments

### auto-release: bump commit is blocked by branch protection

## Problem

The `Update package.json and server.json versions` step in [`.github/workflows/auto-release.yml`](.github/workflows/auto-release.yml) tries to push the release-prep commit directly to the default branch. Branch protection rejects this every cycle:

```
remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: - Changes must be made through a pull request.
remote: - 5 of 5 required status checks are expected.
 ! [remote rejected] main -> main (protected branch 

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/104) · 2026-04-19 · closed · 0 comments

### Release health check: npm propagation + MCP registry publishing + server.json drift

## Context

Noticed while reviewing post-merge state of #99:

- npm latest is **1.0.4** (published by auto-release on PR #99 merge).
- [socket.dev](https://socket.dev/npm/package/mcp-server-scf) reportedly only shows up to **1.0.0** / **1.0.3** — meaning downstream security-analysis surfaces may be lagging days behind npm.
- [`server.json`](./server.json) is pinned at **`0.5.12`** for both the top-level `version` and `packages[0].version`. It has never been bumped alongside `package.json`, so th

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/100) · 2026-04-19 · closed · 0 comments

### Migrate to TypeScript 6 (tsconfig types field + ecosystem compat check)

## Problem

Dependabot opened #39 to bump TypeScript `5.9.3 → 6.0.2`. The build fails on every Node matrix version with TS2591 errors:

```
src/index.ts(3,31): error TS2591: Cannot find name 'node:module'. Do you need to install type definitions for node?
src/index.ts(49,3): error TS2591: Cannot find name 'process'. Do you need to install type definitions for node?
src/lib/api-client.ts(106,20): error TS2591: Cannot find name 'process'. Do you need to install type definitions for node?
src/lib/a

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/90) · 2026-04-18 · closed · 0 comments

## Most recent

### Add FUNDING.yml (optional)

## Priority: P3 (plan finding #22)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

Only if Compliance Genie wants GitHub Sponsors, Open Collective, or external funding links.

**Acceptance criteria**
- [ ] Decision made (yes / no). If yes: `.github/FUNDING.yml` committed with appropriate links.

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/75) · 2026-04-18 · closed · 0 comments

### Tool description quality pass (read-cold test)

## Priority: P2 (plan section: *Tool description quality pass*)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Anthropic guidance**
Each tool description should: front-load the action; note side effects, auth requirements, rate limits; stay within ~200 chars.

**Acceptance criteria**
- [ ] Every `.describe()` on every tool passes the read-cold test: an agent with zero project context picks the right tool from description alone
- [ 

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/74) · 2026-04-18 · closed · 0 comments

### Evaluate streamable HTTP transport for hosted / web-IDE use

## Priority: P2 (plan finding #21)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Not committed.** Scoping issue to evaluate demand.

**Inputs for decision**
- Customer asks (enterprise, hosted)
- Web-IDE integration opportunities
- Cost of OAuth 2.1 + PKCE (gated by the OAuth 2.1 issue)

**Output**
- [ ] Design doc: transport selection, auth, rate limiting, observability
- [ ] Go/no-go decision with date

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/73) · 2026-04-18 · open · 0 comments

### OAuth 2.1 design constraint (deferred until HTTP transport)

## Priority: P2 (plan finding #20)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Status:** capture-only. stdio transport doesn't need OAuth. Record the design constraint so nobody ships remote HTTP without it.

**Acceptance criteria**
- [ ] Architecture doc notes: "If HTTP transport is added, OAuth 2.1 + PKCE is mandatory per MCP 2025-11-25 spec"
- [ ] Any future HTTP transport PR must link back to this issue

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/72) · 2026-04-18 · open · 0 comments

### Add .github issue and PR templates

## Priority: P1 (plan finding #9)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Current state**
Workflows present, templates absent.

**Acceptance criteria**
- [ ] `.github/ISSUE_TEMPLATE/bug.yml` — form with env (OS, client, server version), repro, expected / actual, logs (redacted)
- [ ] `.github/ISSUE_TEMPLATE/feature.yml` — form with use-case, proposed API
- [ ] `.github/ISSUE_TEMPLATE/tool-request.yml` — form for "please add 

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/71) · 2026-04-18 · closed · 0 comments

### Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1)

## Priority: P1 (plan finding #8)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Acceptance criteria**
- [ ] `CODE_OF_CONDUCT.md` at repo root — Contributor Covenant 2.1 text
- [ ] Point of contact for reports (email or security@)
- [ ] Linked from README and CONTRIBUTING.md

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/70) · 2026-04-18 · closed · 0 comments

### Add Prettier config + CI format check

## Priority: P1 (plan finding #6)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Current state**
No Prettier. No formatting standard. Risk of whitespace / style drift between contributors.

**Acceptance criteria**
- [ ] `.prettierrc` committed (2-space indent, single quotes, trailing commas, 100-col print width — adjust if team prefers)
- [ ] `.prettierignore` committed (build/, dist/, node_modules/, *.md if we want to exclude)
- [

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/68) · 2026-04-18 · closed · 0 comments

### Add test suite (vitest + MCP Inspector conformance)

## Priority: P1 (plan finding #4)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Current state**
No `test` script. No `tests/` directory. CI builds + type-checks only. Zero regression safety for a product sold to compliance teams.

**Expected state**
Vitest wired up; one test file per tool group; MCP Inspector smoke test in CI.

**Acceptance criteria**
- [ ] `vitest` + `@modelcontextprotocol/inspector` added to devDependencies
- [ 

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/66) · 2026-04-18 · closed · 0 comments

### Fix README tool count (claims 38, actually 67)

## Priority: P0 (plan finding #2)
See [Plans/this-repo-is-for-keen-russell.md](Plans/this-repo-is-for-keen-russell.md) for full audit context.

**Current state**
[README.md:29](README.md#L29) advertises *"38 tools across 7 domains"*. Actual registration is 67 tools across 8 domains. The per-domain table at lines 32–39 is out of date (Webhooks domain missing).

**Expected state**
README matches reality; future drift is caught by CI.

**Acceptance criteria**
- [ ] Domain table recounted and update

[Read the thread](https://github.com/MarkAC007/mcp-server-scf/issues/64) · 2026-04-18 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/MarkAC007/mcp-server-scf/issues).