Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/raxol/issues.md or /mcp/raxol/issues.json, or Pod over MCP.

Reported issues for raxol

Pod holds 8 of 8 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to raxol.

Most discussed

Harness runtime: adversarial review (integration/harness-endgame) — 2 HIGH + 4 MEDIUM

@merklebonsai — adversarial review of the harness runtime on integration/harness-endgame, plus the architecture mental model (folded at the bottom) so the atomic-PR chunks read in context.

Scope (stated honestly)

The branch is 838 files / +89k/−60k, mostly the Surface→TEA migration churn. Three hostile personas (Saboteur / New Hire / Security Auditor) deep-read the ~25 files that carry the actual runtime substance — the tty/pump, the TEA fold + view, the input/keymap/click paths, the mark

Read the thread · 2026-07-22 · closed · 2 comments

Accessibility: screen reader support across surfaces

Summary

Add screen reader / assistive technology support across Raxol's rendering surfaces.

Why this is tractable

The structured Component tree already carries type, label, and state metadata on every Component. That is semantically richer than a pixel buffer, so screen reader support is a serialization step on top of existing structure rather than a redesign.

Scope (to refine)

Read the thread · 2026-06-18 · open · 1 comment

shell_jail_allow/1 accepts Sandbox.Shell.none(), reopening a jailed shell

Raxol.Agent.Actions.Code.shell_jail_allow/1 (packages/raxol_agent/lib/raxol/agent/actions/code.ex:447) decides whether a jailed session may have the shell tool at all:

sandboxed? =
  match?(%Raxol.Agent.Sandbox.Shell{}, Map.get(context, :shell_sandbox))

if jailed? and not sandboxed?,
  do: {:error, :shell_disabled_in_jail},
  else: :ok

The check is match? on the STRUCT TYPE, so it reads "a struct is present" where it means "the struct restricts". `Raxol.Agent.Sandbox.Shell

Read the thread · 2026-08-27 · open · 0 comments

MCP tools run with authorizer: nil in :mcp and :full modes

Summary

Raxol.Application starts the MCP supervisor with an empty opts list, so every MCP tool runs with authorizer: nil in both the :mcp and :full startup modes. The authorization seam is fully built and wired -- it is simply never engaged.

This came out of an adversarial review of the open PR queue. The specific arbitrary-code-execution path it was found through (raxol_start's "path" argument) is being closed separately by confining that path to a configured root. This issue i

Read the thread · 2026-08-25 · open · 0 comments

Enforce agent tool context (authorizer/hooks/owner/in_cron) over the native MCP tool path

Summary (research / low priority)

Native (vendor-owns-loop) backends -- handles_tools_internally? == true, e.g. Backend.ClaudeCode / Backend.Cursor -- run their own tool loop and execute Raxol Actions out-of-process over MCP (native_react/1 in Raxol.Agent.Stream, tools injected via Harness.McpToolConfig). On that path the framework cannot thread run context into tool execution:

Read the thread · 2026-07-25 · open · 0 comments

Memory remainder: RecallMcp bridge, SQLite FTS5 store, raxol_memory/raxol_skills split

Part of the Hermes Fast-Follow P0 epic. Tag: RAILS-adjacent. A completion project: the loop mostly ships already.

Already shipped (do NOT rebuild)

Raxol.Agent.Memory behaviour + Store.Ets (ETS+DETS, BM25-lite + recency + tags), pre-turn recall injection, memory_remember/recall/forget, SKILL.md authoring + isolated post-turn reviewer (SelfImprove) + Curator, dialectic UserModel, full-text session_search. All in `packages/raxol_agent/lib/raxol/agent/{memory/,curator.

Read the thread · 2026-07-13 · open · 0 comments

Xochi origin-pull: bind pull recipient/spender to a verifiable solver set

Summary

Bounded residual from the Xochi origin-pull security pass. The origin pull adds a second EIP-712 the agent signs (ERC-3009 ReceiveWithAuthorization or Permit2 PermitWitnessTransferFrom) to authorize origin collection. validate_pull_authorization/3 (the finding-A fix) binds the signer, token, chain, and value (<= intended amount) before signing, but does not bind the pull recipient (to for ERC-3009) or spender (Permit2). A compromised or colluding quote endpoin

Read the thread · 2026-06-25 · closed · 0 comments

raxol_liveview: WebMCP declarative API integration

Goal

Expose any <.form> in a LiveView as an agent-callable tool via the WebMCP declarative API, with no separate tool registration step. The component tree IS the tool surface, same principle the terminal-side MCP integration already follows.

Spec reference (pin this commit, the API is moving): https://developer.chrome.com/docs/ai/webmcp/declarative-api

Scope

In:

Read the thread · 2026-05-23 · open · 0 comments

Most recent

The remaining reports are on the project's issue tracker.