# Reported issues for raxol

Pod holds 8 of 8 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [raxol](/mcp/raxol).

## Most discussed

### Harness runtime: adversarial review (integration/harness-endgame) — 2 HIGH + 4 MEDIUM

@merklebonsai — adversarial review of the harness runtime on `integration/harness-endgame`, plus the architecture mental model (folded at the bottom) so the atomic-PR chunks read in context.

## Scope (stated honestly)

The branch is 838 files / +89k/−60k, mostly the Surface→TEA migration churn. Three hostile personas (Saboteur / New Hire / Security Auditor) deep-read the ~25 files that carry the actual runtime substance — the tty/pump, the TEA fold + view, the input/keymap/click paths, the mark

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/687) · 2026-07-22 · closed · 2 comments

### Accessibility: screen reader support across surfaces

## Summary

Add screen reader / assistive technology support across Raxol's rendering surfaces.

## Why this is tractable

The structured Component tree already carries `type`, `label`, and `state`
metadata on every Component. That is semantically richer than a pixel buffer,
so screen reader support is a serialization step on top of existing structure
rather than a redesign.

## Scope (to refine)

- Serialize the Component tree's existing semantic metadata to an
  accessibility surface (ARIA-equ

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/305) · 2026-06-18 · open · 1 comment

### shell_jail_allow/1 accepts Sandbox.Shell.none(), reopening a jailed shell

`Raxol.Agent.Actions.Code.shell_jail_allow/1`
(`packages/raxol_agent/lib/raxol/agent/actions/code.ex:447`) decides whether a
jailed session may have the shell tool at all:

```elixir
sandboxed? =
  match?(%Raxol.Agent.Sandbox.Shell{}, Map.get(context, :shell_sandbox))

if jailed? and not sandboxed?,
  do: {:error, :shell_disabled_in_jail},
  else: :ok
```

The check is `match?` on the STRUCT TYPE, so it reads "a struct is present"
where it means "the struct restricts". `Raxol.Agent.Sandbox.Shell

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/919) · 2026-08-27 · open · 0 comments

### MCP tools run with authorizer: nil in :mcp and :full modes

## Summary

`Raxol.Application` starts the MCP supervisor with an empty opts list, so every
MCP tool runs with `authorizer: nil` in both the `:mcp` and `:full` startup
modes. The authorization seam is fully built and wired -- it is simply never
engaged.

This came out of an adversarial review of the open PR queue. The specific
arbitrary-code-execution path it was found through (`raxol_start`'s `"path"`
argument) is being closed separately by confining that path to a configured
root. This issue i

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/907) · 2026-08-25 · open · 0 comments

### Enforce agent tool context (authorizer/hooks/owner/in_cron) over the native MCP tool path

## Summary (research / low priority)

Native (vendor-owns-loop) backends -- `handles_tools_internally? == true`,
e.g. `Backend.ClaudeCode` / `Backend.Cursor` -- run their own tool loop and
execute Raxol Actions **out-of-process over MCP** (`native_react/1` in
`Raxol.Agent.Stream`, tools injected via `Harness.McpToolConfig`). On that path
the framework cannot thread run **context** into tool execution:

- `context[:tool_authorizer]` (the `ToolPolicy` that denies `sensitive: true`
  fund-mover Act

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/726) · 2026-07-25 · open · 0 comments

### Memory remainder: RecallMcp bridge, SQLite FTS5 store, raxol_memory/raxol_skills split

Part of the **Hermes Fast-Follow P0** epic. Tag: **RAILS-adjacent**. A completion project: the loop mostly ships already.

## Already shipped (do NOT rebuild)

`Raxol.Agent.Memory` behaviour + `Store.Ets` (ETS+DETS, BM25-lite + recency + tags), pre-turn recall injection, `memory_remember`/`recall`/`forget`, SKILL.md authoring + isolated post-turn reviewer (`SelfImprove`) + `Curator`, dialectic `UserModel`, full-text `session_search`. All in `packages/raxol_agent/lib/raxol/agent/{memory/,curator.

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/495) · 2026-07-13 · open · 0 comments

### Xochi origin-pull: bind pull recipient/spender to a verifiable solver set

## Summary

Bounded residual from the Xochi origin-pull security pass. The origin pull adds a
second EIP-712 the agent signs (ERC-3009 `ReceiveWithAuthorization` or Permit2
`PermitWitnessTransferFrom`) to authorize origin collection. `validate_pull_authorization/3`
(the finding-A fix) binds the **signer, token, chain, and value (<= intended amount)**
before signing, but does **not** bind the pull **recipient** (`to` for ERC-3009) or
**spender** (Permit2). A compromised or colluding quote endpoin

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/333) · 2026-06-25 · closed · 0 comments

### raxol_liveview: WebMCP declarative API integration

## Goal

Expose any `<.form>` in a LiveView as an agent-callable tool via the WebMCP declarative API, with no separate tool registration step. The component tree IS the tool surface, same principle the terminal-side MCP integration already follows.

Spec reference (pin this commit, the API is moving): https://developer.chrome.com/docs/ai/webmcp/declarative-api

## Scope

In:

- A `<.tool_form>` Phoenix.Component wrapping `<.form>` that emits the declarative WebMCP attributes.
- A `<.tool_field>`

[Read the thread](https://github.com/DROOdotFOO/raxol/issues/248) · 2026-05-23 · open · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/DROOdotFOO/raxol/issues).