# Reported issues for mcp-server

Pod holds 19 of 52 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [mcp-server](/mcp/mcp-server-telleroutlook).

## Most discussed

### [milestone Milestone 5 ] Add retention and compaction policies (time-bound and count-bound) with safe pru...

🤖 Auto-filed from milestone doc bullet — enriched for implementation.

**Repo**: WasmAgent/wasmagent-js
**Milestone**: Milestone 5 — Durable Evidence Ledger & Chain Verification
**Blocked-by**: #222 (introduces the durable ledger + chain verification that this issue governs)

> Add retention and compaction policies (time-bound and count-bound) with safe pruning of verified record tails

## Problem

The durable evidence ledger introduced by #222 is an append-only, hash-chained log. Without a boun

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/229) · 2026-07-26 · closed · 53 comments

### [milestone Milestone 2] Add integration tests covering denied calls, consent-required calls, allowed cal...

🤖 Auto-filed from milestone doc bullet.

**Repo**: WasmAgent/wasmagent-js
**Milestone**: Milestone 2: MCP Firewall Protection Layer
**Bullet**: Add integration tests covering denied calls, consent-required calls, allowed calls, and tainted results

Blocked by #169, #172, #170 (the firewall surface itself). Do not start until those merge — this issue adds **tests only** and must not redefine the firewall API.

## Problem

The MCP Firewall Protection Layer gates outbound tool/MCP calls into one of

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/173) · 2026-07-23 · closed · 17 comments

### code-review: Wire MCP gateway dependencies into the published CLI

<!-- patrol: code-review -->
<!-- confidence: 0.60 -->
<!-- rationale:  -->

Filed by the patrol daemon (sweep: code-review). This finding did not meet the 0.8 confidence threshold for an autonomous fix issue; opening for deliberation instead.

## Observation
**Feature area**: CLI / MCP integrations | **Confidence**: 96%

README presents `npm install -g @wasmagent/cli` followed by `scan-mcp` and `guard`. Those commands dynamically import `@wasmagent/mcp-gateway`, but the CLI package does not dec

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/351) · 2026-08-01 · closed · 9 comments

### [milestone Milestone 8 ] Implement a versioned run registry for discovering agents, runtimes, capabilitie...

🤖 Auto-filed from milestone doc bullet.

**Repo**: WasmAgent/wasmagent-js
**Milestone**: Milestone 8 — Federated Agent Operations & Reliability
**Bullet**:

> Implement a versioned run registry for discovering agents, runtimes, capabilities, and health status across deployments

## Relevant code context (from worktree)

```
contains 'versioned': packages/mcp-policy/src/bundle.ts
contains 'registry': examples/owasp-demo/scenarios.ts
contains 'registry': packages/aisdk/src/index.ts
contains 'regis

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/368) · 2026-08-02 · closed · 3 comments

### code-review: Make `wasmagent guard --config` enforce the policy YAML

<!-- patrol: code-review -->
<!-- confidence: 0.60 -->
<!-- rationale:  -->

Filed by the patrol daemon (sweep: code-review). This finding did not meet the 0.8 confidence threshold for an autonomous fix issue; opening for deliberation instead.

## Observation
**Feature area**: CLI / MCP security | **Confidence**: 99%

README promises `wasmagent guard --config wasmagent.policy.yaml` policy enforcement, but the CLI only records the config path and evaluates built-in defaults. It never reads or par

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/350) · 2026-08-01 · closed · 3 comments

### Stop shipping a forked aep-record schema; consume canonical aep/v0.3 from @wasmagent/protocol

## Context

`packages/aep/schemas/aep-record.schema.json` is generated from the Zod `AEPRecordSchema` (`packages/aep/scripts/export-json-schema.ts`) and has **drifted ahead of** the canonical `@wasmagent/protocol` `aep-record` (`aep/v0.2`): it adds `user_id`, `subject_id`, `run_side_effect_class_max`, reaches `aep/v0.3`, and makes `signature` required.

Issue #147 ("Strip local AEP/compliance schemas") was closed once `@wasmagent/protocol` shipped, and the **compliance family + rollout-wire were

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/238) · 2026-07-26 · closed · 2 comments

### [shared-state 6/9] Affordance projection (reduce illegal tool calls)

> Part of #133 (shared-state epic)

**Depends on:** #134
**Blocks:** none
**Part of:** the shared-state epic (link added on creation)
**Note:** independent of STORE — can be developed against a `StateModel` alone, so it may land early in parallel.

## Motivation

Tell the agent not just *what the state is* but *what it can legally do next*. E.g. *"detailMode is 'view', so `OPEN_FORM` is available but `SET_FORM_FIELDS` is not (no form is open)."* This brings a statechart-style guard (XState-inspi

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/139) · 2026-07-22 · closed · 2 comments

### aep/types: no schema signal for 'system permission layer gated this action' (paired with open-agent-audit false-positive)

# No AEP event / adapter mapping for "system permission layer already gated this action"

**Repo:** `packages/aep` (paired with an open-agent-audit issue on the adapter side)

## Problem

When the platform's permission layer denies (or automatically approves) a high-risk tool call, the wasmagent AEP emitter records `action.capability_decision.decision = 'deny'` (or 'allow'), and that's all. Downstream, open-agent-audit's canonical schema does have a `human_approval` event type, but no adapter ma

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/21) · 2026-07-04 · closed · 2 comments

## Most recent

### [milestone Milestone 11] Implement `analyzeRun()` to surface unauthorized access, policy violations, and ...

🤖 Auto-filed from milestone doc bullet.

**Repo**: WasmAgent/wasmagent-js
**Milestone**: Milestone 11 — Run Replay & Forensic Investigation
**Bullet**:

> Implement `analyzeRun()` to surface unauthorized access, policy violations, and anomalous tool sequences

## Relevant code context (from worktree)

```
contains 'surface': examples/benchmarks/judge/judge.py
contains 'surface': packages/capability-compiler/src/mcpSchema.ts
contains 'surface': packages/aisdk/src/index.ts
contains 'unauthorized':

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/395) · 2026-08-09 · closed · 1 comment

### [milestone Milestone 10] Provide conformance tests for interoperability between browser, Node.js, edge, a...

🤖 Auto-filed from milestone doc bullet.

**Repo**: WasmAgent/wasmagent-js
**Milestone**: Milestone 10 — Federated Agent Operations & Reliability
**Bullet**:

> Provide conformance tests for interoperability between browser, Node.js, edge, and server-side runtimes

## Relevant code context (from worktree)

```
contains 'provide': examples/owasp-demo/scenarios.ts
contains 'provide': docs/.vitepress/config.ts
contains 'provide': packages/aisdk/src/codemodeExecutor.test.ts
contains 'conformance': pa

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/391) · 2026-08-03 · closed · 0 comments

### Document key architecture decisions to reduce bus factor: AEP v0.4, trust-cli, Milestone 5 trace archival

## Problem

Core architectural decisions are currently implicit in code and commit messages. With 1-2 primary authors, loss of context is a real risk. Three areas need documented design rationale:

## Tasks

### 1. AEP v0.4 design doc (`docs/aep-v0.4-design.md`)
- Why DSSE/in-toto envelope was chosen over HMAC-only
- `recording_mode` semantics and privacy tradeoffs
- `taint_labels` / `output_taint_labels` propagation rules
- Relationship to in-toto `agent-decision` predicate

### 2. MCP Firewall

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/341) · 2026-07-31 · closed · 0 comments

### [milestone Milestone 7 ] Implement alert emission via pluggable channels (webhook, SSE stream, log sink) ...

🤖 Auto-filed from milestone doc bullet.

**Repo**: WasmAgent/wasmagent-js
**Milestone**: Milestone 7 — Realtime Monitoring & Anomaly Detection
**Bullet**:

> Implement alert emission via pluggable channels (webhook, SSE stream, log sink) for policy violations and chain integrity issues

## Relevant code context (from worktree)

```
contains 'alert': packages/cloudflare-worker/src/webhooks.ts
contains 'alert': packages/mcp-posture/src/index.ts
contains 'alert': packages/mcp-posture/src/index.test

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/320) · 2026-07-30 · closed · 1 comment

### @wasmagent/aep: provide registerStatefulVerbs() to avoid parallel MUTATING set + isStateChangingTool

## Problem

Backends that use `@wasmagent/aep` for audit logging need to know which tools are state-changing at two different call sites:

1. `isStateChangingTool(name)` — used by AEP to classify evidence records
2. A hand-maintained `MUTATING` Set — used by the chat service to trigger `logEvent()` and set `stateChanging: true` on `ChatToolLog`

These two must be kept in sync manually. When a new tool is added (e.g. `approve_vendor`), it's easy to update one and forget the other. The bug is sile

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/304) · 2026-07-30 · closed · 1 comment

### @wasmagent/core: promote injectHistoryIntoAssembler as a first-class exported API

## Problem

Every Express/Node.js backend that uses `ToolCallingAgent` in a stateless HTTP handler needs to replay prior conversation turns into the assembler before each request. The logic is non-trivial — it must handle three message shapes:

1. Pure text turns (`role: assistant, content: string`)
2. Single tool use (`tool_use` + `tool_result` block pair)
3. Parallel tool calls (multiple `tool_use` blocks + multiple `tool_result` blocks)

This mapping from Anthropic wire format → wasmagent ass

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/303) · 2026-07-30 · closed · 1 comment

### @wasmagent/compliance: add verifyObject() API for in-memory validation without a WorkspaceReader

## Problem

`ComplianceVerifier` requires a `WorkspaceReader` (file-system adapter) even when the data to validate is already in memory. For backends that verify domain objects (e.g. a PR draft struct) rather than files, this forces callers to construct a fake filesystem shim:

```ts
// Current — must fake a WorkspaceReader
const reader = {
  readFile: async (path: string) => {
    if (path === 'draft.json') return JSON.stringify(draft)
    throw new Error('not found')
  },
  listFiles: async ()

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/302) · 2026-07-30 · closed · 1 comment

### useAgentRun hardcodes ev.event field name — incompatible with backends that use ev.type

## Problem

`useAgentRun` from `@wasmagent/react` hardcodes `ev.event` as the event discriminator throughout the SSE parser:

```ts
if (ev.event === 'tool_call' && ev.channel === 'tool') { ... }
if (ev.event === 'final_answer' && ev.channel === 'text') { ... }
```

This means the hook's built-in message accumulation **only works with the Cloudflare Worker /run endpoint** which emits `AgentEvent` objects. Any other compatible backend that emits `{ type: 'tool_start', ... }` (including the standar

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/288) · 2026-07-29 · closed · 0 comments

### detectRugPull crashes with TypeError when called with a new tool entry (no prior snapshot)

## Bug

`detectRugPull` from `@wasmagent/mcp-firewall` throws `TypeError: Cannot read properties of undefined (reading 'description')` when the `prev` argument is a freshly-created snapshot object (i.e., when called without a prior snapshot to compare against).

## Reproduction

```ts
import { detectRugPull, snapshotTool } from '@wasmagent/mcp-firewall'

const entry = { name: 'submit_pr', description: 'Submit a PR', inputSchema: {} }
const snap = snapshotTool(entry, 'my-server')
// snap has { se

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/281) · 2026-07-29 · closed · 0 comments

### Fix WasmAgent/wasmagent-js#276 ([milestone Milestone 7 ] Implement real-time evidence streaming with `EvidencePublisher`

Auto-filed as sub-issue of #276 ([milestone Milestone 7 ] Implement real-time evidence streaming with `EvidencePublisher` for live monitor...).

Fix WasmAgent/wasmagent-js#276 ([milestone Milestone 7 ] Implement real-time evidence streaming with `EvidencePublisher` for live monitor...): implement changes in package src

Files to change:
- evidencePublisher.ts
- index.ts
- index.ts

## Acceptance criteria

- `go build ./...` passes
- The specific changes described above are implemented
- No unrel

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/279) · 2026-07-29 · closed · 1 comment

### [milestone Milestone 6 ] Implement `EvidenceStream` pub/sub interface for real-time AEP record broadcasti...

🤖 Auto-filed from milestone doc bullet.

**Repo**: WasmAgent/wasmagent-js
**Milestone**: Milestone 6 — Distributed Evidence Stream & Multi-Agent Scenarios
**Bullet**:

> Implement `EvidenceStream` pub/sub interface for real-time AEP record broadcasting across agent processes and network boundaries

## Relevant code context (from worktree)

```
new (does not exist yet): pub/sub
contains 'interface': examples/owasp-demo/scenarios.ts
contains 'interface': packages/capability-compiler/src/mcpSchema.

[Read the thread](https://github.com/WasmAgent/wasmagent-js/issues/252) · 2026-07-27 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/WasmAgent/wasmagent-js/issues).