Reported issues for Octocode MCP - AI Context Platform
Pod holds 22 of 28 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to Octocode MCP - AI Context Platform.
Most discussed
local* tools: misleading "Symlink target ... is outside allowed directories" error for non-symlink paths outside allowed roots
Environment: octocode v17.0.1 (MCP server via npx), Linux.
Repro: Call localSearchCode (other local* tools behave the same) with a path under /tmp — a plain directory inside a regular git worktree, no symlinks involved anywhere on the path:
{"queries": [{"path": "/tmp/scout-bench-17680v2/src/Core/Framework/DataAbstractionLayer", "keywords": "new \\ReflectionClass(", "fixedString": true}]}
Actual result:
status: error
error: Symlink target 'DataAbstractionL
[Read the thread](https://github.com/bgauryy/octocode/issues/450) · 2026-07-22 · closed · external user · 5 comments
### Security Audit: 5 finding(s) in octocode-mcp
## Security Audit Report
**Audit conducted by:** [AgentAudit](https://agentaudit.ai)
**Report ID:** 112
**Risk Score:** 27 / 100 (caution)
**Findings:** 6 total (5 actionable, 1 by-design)
---
### Finding 1 — HIGH: Shell injection via exec() bypasses safe spawn() pattern
- **File:** `packages/octocode-mcp/src/tools/lsp_find_references/lspReferencesPatterns.ts:317`
- **Pattern:** CMD_INJECT_001
- **Description:** `lspReferencesPatterns.ts` uses `child_process.exec()` with shell string interpol
[Read the thread](https://github.com/bgauryy/octocode/issues/321) · 2026-02-10 · closed · external user · 4 comments
### Antigravity: ‘Agent terminated due to error’ when using Claude/GPT models (Gemini works)
After enabling Antigravity in Google and running it with all Claude and GPT versions—except the Gemini versions—I get the following message:
Agent terminated due to error
You can prompt the model to try again or start a new conversation if the error persists.
See our [troubleshooting guide](https://antigravity.google/support) for more help.
<img width="1455" height="936" alt="Image" src="https://github.com/user-attachments/assets/734fed8c-90ec-4fc7-82dc-58fd5b817030" />
[Read the thread](https://github.com/bgauryy/octocode/issues/257) · 2025-12-28 · closed · external user · 4 comments
### Octocode bleeding through in final status messages
Recently it started to show me that octocode was used by the agent at in final status messages. While i love octocode, seeing this every time i do something is not really nice. Anything i can do to turn this off?
<img width="757" height="320" alt="Image" src="https://github.com/user-attachments/assets/0bea201e-6aff-4f6b-a0e9-f92bb5e10f98" />
[Read the thread](https://github.com/bgauryy/octocode/issues/194) · 2025-11-07 · closed · external user · 4 comments
### Otocode mcp has error with grok-4-fast in Cursor
when i use grok-4-fast model in Cursor with otocode mcp, my model response nothing. But after i turn off "otocode mcp", that model can reponse text. Others model when i turn on otocode it's still work and response text but except only grok-4-fast. So, that's problem of Cursor or Otocode mcp ?? Can you explain it for me
[Read the thread](https://github.com/bgauryy/octocode/issues/132) · 2025-09-25 · closed · external user · 6 comments
### Reduce MCP tooling context usage
Each of your MCP tools consumes over 1k tokens which is unnecessary and likely due to the highly verbose AI-generated descriptions for each tool. Please optimize the token usage of your MCP tools by greatly compacting and optimizing text based descriptions. Here is a context analysis report from Claude Code that shows specific numbers:
<img width="617" height="694" alt="Image" src="https://github.com/user-attachments/assets/9cd9bf40-6839-4022-b353-d50ecd2692a6" />
[Read the thread](https://github.com/bgauryy/octocode/issues/126) · 2025-08-29 · closed · external user · 7 comments
### 2.3.28 is broken
The 2.3.28 version of the package is broken. Upon running it via `npx`, this is the output:
```bash
$ npx octocode-mcp@2.3.28
sh: octocode-mcp: command not found
The previous version (2.3.27) is working fine.
Read the thread · 2025-07-21 · closed · external user · 3 comments
Error loading the tools
Hi, trying to set it up in cursor, but no tools detected and it looks like there's a syntax error:
2025-07-13 17:12:21.591 [info] user-octocode-mcp: Starting new stdio process with command: npx octocode-mcp
2025-07-13 17:12:22.423 [error] user-octocode-mcp: /Users/xxxx/.npm/_npx/7b9df76f961fac5c/node_modules/.bin/octocode-mcp: line 1: syntax error near unexpected token `('
2025-07-13 17:12:22.424 [error] user-octocode-mcp: /Users/xxx/.npm/_npx/7b9df76f961fac5c/node_modules/.bin/octocode-mcp
[Read the thread](https://github.com/bgauryy/octocode/issues/43) · 2025-07-13 · closed · external user · 5 comments
## Most recent
### 17.0.2 is an incomplete npm publish: @octocodeai/config and native engine platform packages missing at 17.0.2 → ETARGET, unusable install
## Summary
`octocode-mcp@17.0.2` (and the `17.0.2` release generally) cannot be installed from npm. The top-level packages published at `17.0.2`, but two sets of internal dependencies they hard-require are still only published at `17.0.1`, so npm resolution fails with `ETARGET`. This looks like a **partial multi-package publish** — the source tree on `main` is already at `17.0.2`, only the registry is out of sync.
## Broken dependency graph (verified on npm, 2026-07-23)
`octocode-mcp@17.0.2`
[Read the thread](https://github.com/bgauryy/octocode/issues/452) · 2026-07-23 · closed · external user · 1 comment
### Config to disable logs
I was monitoring Octocode and I noticed it generates a lot of logs that are written to the disk continuously. This constant writing reduces the life of SSDs
[Read the thread](https://github.com/bgauryy/octocode/issues/443) · 2026-07-11 · closed · external user · 1 comment
### Unable to install with "npx octocode install" command?
I am trying to set up Octocode as an MCP for my claude code instance following the github suggestions, however:
(.venv) PS C:\Users\...> npx octocode install
Need to install the following packages:
octocode@2.2.0
Ok to proceed? (y) y
npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/@octocodeai%2foctocode-engine - Not found
npm error 404
npm error 404 The requested resource '@octocodeai/octocode-engine@16.6.0' could not be found or you do not have permission to acce
[Read the thread](https://github.com/bgauryy/octocode/issues/429) · 2026-06-28 · closed · external user · 1 comment
### octocode-cli direct install runs curl | node (unpinned remote code execution) on each launch
The CLI can generate an MCP config whose direct method runs curl -fsSL https://octocodeai.com/octocode/latest/index.js | node (and a PowerShell equivalent) on every launch. That is effectively unpinned remote code execution with no integrity or version check, with the user's GITHUB_TOKEN in the child environment.
Is this a recommended or default install path? Would it be possible to pin it to a versioned, hash-verified artifact (or steer users toward npx octocode-mcp@latest)?
Refs: packages/oc
[Read the thread](https://github.com/bgauryy/octocode/issues/415) · 2026-06-03 · closed · external user · 1 comment
### Agent instructions fetched live from octocodeai.com/api/mcpContent (not version/hash-pinned)
The prebuilt bundle in @octocodeai/octocode-core (dist/latest/index.js) fetches its tool metadata, instructions, and prompts from https://octocodeai.com/api/mcpContent at runtime. The response is validated for shape (Zod) but not for authenticity, and is not pinned to a version or hash.
In effect, where an install path runs this bundle (e.g. the CLI direct method, see the related issue), the instructions the agent operates under are served live from a project-controlled endpoint and can change
[Read the thread](https://github.com/bgauryy/octocode/issues/414) · 2026-06-03 · closed · external user · 1 comment
### Is @octocodeai/octocode-core source-available, or distributed build-only?
@octocodeai/octocode-core is a hard dependency of the server that runs in-process with full privileges. The npm package ships only dist, has no repository field, and I couldn't find a public source repo for it.
Before treating it as closed-source: is there a source repository available somewhere, or is the package intentionally distributed build-only? If it is build-only, is there any plan to publish the source (or a reproducible build) so it can be independently reviewed?
Refs: pinned at pack
[Read the thread](https://github.com/bgauryy/octocode/issues/413) · 2026-06-03 · closed · external user · 0 comments
### rate_limit telemetry event can include the user's sensitive data as part of raw search query via api_url
PRIVACY.md states that code, environment variables, and PII are never collected, and that "your code stays on your machine."
On a default (telemetry-on) install, the rate_limit event carries an api_url field set from the Octokit request URL in the throttle callback. For code/repo/PR search, that URL contains the raw search query and the owner/repo/path.
Concretely: if a user searches their private repos for something like AWS_SECRET_ACCESS_KEY in:file and that request hits GitHub's rate limit
[Read the thread](https://github.com/bgauryy/octocode/issues/412) · 2026-06-03 · closed · external user · 1 comment
### Telemetry init beacon fires even when logging is disabled (no full opt-out)
Telemetry defaults to "on" and posts to https://octocode-mcp-host.onrender.com/log with a persistent per-install UUID.
PRIVACY.md documents this, along with the LOG=false opt-out.
However, the logging gate lets the init event through even when logging is disabled, so the startup ping fires regardless of the flag.
Is this intentional? Could this be part of the opt-out (or an environment switch be added) to suppress the init ping entirely, for users who want zero outbound telemetry?
Refs: defa
[Read the thread](https://github.com/bgauryy/octocode/issues/411) · 2026-06-03 · closed · external user · 1 comment
### prompts/get fails with MCP error -32602 when no arguments are provided (Zod validation error)
I am big fan of octocode. please check the issue hereinafter.
Description
When calling prompts/get for a prompt that does not require arguments (e.g., the help prompt), the server returns a validation error instead of the prompt content.
Error Message:
json
/
[unknown] failed to get prompt: failed to get prompt help from octocode: %!v(MISSING): calling "prompts/get": MCP error -32602: Invalid arguments for prompt help: [ { "expected": "object", "code": "invalid_type", "path": [], "message":
[Read the thread](https://github.com/bgauryy/octocode/issues/373) · 2026-04-06 · closed · external user · 1 comment
### npm error code EUNSUPPORTEDPROTOCOL
Hello 👋
I'm trying to install the latest version of octocode, but I have this issue:
npx octocode-cli
Need to install the following packages:
octocode-cli@1.2.8
Ok to proceed? (y) y
npm error code EUNSUPPORTEDPROTOCOL npm error Unsupported URL Type "workspace:": workspace:^
Log generated:
0 verbose cli /Users/
Read the thread · 2026-03-25 · closed · external user · 2 comments
octocode-pull-request-reviewer: support for local changes
Could you add support for local changes?
see https://github.com/google-gemini/gemini-cli/blob/main/.gemini/skills/code-reviewer/SKILL.md
Read the thread · 2026-02-20 · closed · external user · 1 comment
Agent terminated due to error
I’m seeing this frequently:
“Agent terminated due to error. You can prompt the model to try again or start a new conversation if the error persists. See our troubleshooting guide (https://antigravity.google/support) for more help.”
I’ve tried using multiple accounts and have also restarted my computer, but the issue persists.
Read the thread · 2026-02-19 · closed · external user · 0 comments
Not work on windows
❯ use octocode-research to analyze crawl4ai
● I'll use the octocode-research skill to analyze the crawl4ai library for you.
● Skill(octocode-research)
⎿ Successfully loaded skill
● I'll analyze the crawl4ai library for you. Let me start by initializing the server and loading the context.
● Bash(cd "D:\github_me\walltech\OctoMind\.claude\skills\octocode-research" && npm run server-init) timeout: 30s
⎿ (No content)
● Let me check if the server is running:
● Bash(curl -s http://loca
[Read the thread](https://github.com/bgauryy/octocode/issues/322) · 2026-02-11 · closed · external user · 0 comments
### Feature request: Add config option to disable prompts/slash commands
## Summary
Add a configuration option to disable MCP prompts (slash commands) registration.
## Use Case
Some users only want the tool functionality without the prompts being registered. Currently, prompts are always fetched from the remote API and registered unconditionally.
## Proposed Solution
Add a `prompts.enabled` option to `.octocoderc`:
```jsonc
{
"prompts": {
"enabled": false
}
}
And corresponding environment variable: ENABLE_PROMPTS=false
Implementation
In `src
Read the thread · 2026-02-01 · closed · external user · 1 comment
The remaining reports are on the project's issue tracker.