Reported issues for redpill

Pod holds 16 of 16 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to redpill.

Most discussed

Document and test MCP host compatibility

Turn the existing configuration examples into a small compatibility matrix.

Acceptance criteria:

• Verify VS Code and Claude Desktop configurations on at least one supported platform each.
• Add Copilot CLI or another widely used MCP host configuration.
• Document Windows command differences for npx where necessary.
• Explain storage, decline gating, persona defaults, and network behavior.
• Use no credentials or private transcripts in fixtures.

Read the thread · 2026-08-19 · open · 4 comments

Publish the first npm package with provenance

Publish redpill-mcp from a reviewed GitHub release rather than a developer workstation.

Acceptance criteria:

• Use npm trusted publishing or an equivalently short-lived credential flow.
• Generate provenance for the published package.
• Verify all three declared binaries after installation from npm.
• Confirm the package contains only dist, examples, the skill, README, LICENSE, and package metadata.
• Tag and document the release without adding private research artifacts.

Read the thread · 2026-08-19 · closed · 4 comments

Publish v0.1.1 to the official MCP Registry

Publish the validated stdio package metadata after npm issue #3 is complete.

Depends on #3.

Version 0.1.1 carries the corrected install documentation and checksum-pinned OIDC Registry workflow.

Acceptance criteria:

• Verify redpill-mcp@0.1.1 is available from npm with provenance.
• Re-run mcp-publisher validate against the published npm artifact.
• Publish io.github.sergey-goncharenko/redpill version 0.1.1 using GitHub OIDC.
• Verify it appears in the official Registry API search.

Read the thread · 2026-08-20 · closed · 3 comments

Research and prototype machine-readable discovery surfaces

Determine how models and tools can discover accurate Redpill documentation without inventing a private standard.

Acceptance criteria:

• Survey current MCP registry and server-discovery mechanisms.
• Prototype ordinary surfaces such as llms.txt, sitemap, robots policy, and a bounded capability document.
• Add a /.well-known/ document only if a relevant standard exists.
• Keep descriptive content free of prompt injection or instructions to bypass the operator.
• Clearly state that discovery p

Read the thread · 2026-08-19 · open · 3 comments

Upgrade dependencies and resolve actionable npm advisories

Bring the MCP SDK and test/build stack onto supported releases and reassess the current audit findings.

Acceptance criteria:

• Update @modelcontextprotocol/sdk to a current compatible release.
• Upgrade Vitest/Vite and affected transitive dependencies.
• Production dependencies have no high or critical known advisories.
• Any remaining finding is documented with reachability and rationale.
• Tests, typecheck, build, smoke test, and package preview pass.

Read the thread · 2026-08-19 · closed · 3 comments

Produce a 60-second synthetic demo and launch kit

Create the first reusable public demonstration of the installable MCP package.

Acceptance criteria:

• Record from a fresh temporary REDPILL_HOME using redpill-mcp@0.1.1 or later.
• Show installation/configuration, the six-tool list, one local reflect call, and the offline stub converse response.
• Use synthetic text only; include no private prompts, repositories, paths, credentials, experiment traces, or user content.
• Add captions and a text transcript.
• Produce one 16:9 clip and one

Read the thread · 2026-08-20 · open · 2 comments

Set up CI and cross-platform package smoke tests

Add a minimal CI workflow for every pull request and push to main.

Acceptance criteria:

• Run npm ci, npm test, npm run typecheck, and npm run build on supported Node versions.
• Exercise Windows, macOS, and Linux where platform behavior matters.
• Run the stdio smoke test and inspect npm pack --dry-run for expected files.
• Pin third-party Actions to immutable commit SHAs.
• Do not require secrets or network persona backends.

Read the thread · 2026-08-19 · closed · 1 comment

Run the first 10-operator feedback cohort

Recruit a small opt-in cohort before broad promotion and turn their installation friction into actionable issues.

Target outcomes:

• 10 successful external installations
• Coverage across VS Code, Claude Desktop, and Copilot CLI where available
• At least 5 structured feedback reports
• At least 1 external pull request or confirmed contributor handoff

Data boundary:

• Collect feedback manually through GitHub issues/comments; telemetry remains absent.
• Record package version, host/version, ope

Read the thread · 2026-08-20 · open · 0 comments

Most recent

Define privacy-preserving discovery measurement

Specify how future research can distinguish discovery, suggestion, connection, and invocation without collecting user tasks.

Acceptance criteria:

• Define separate event states for page discovery, operator enrollment, MCP connection, and tool invocation.
• Do not collect prompts, queries, referrers containing user content, repository names, or task text.
• Address bots, crawlers, caching, retries, and duplicate events.
• Make website analytics and MCP research enrollment independently optional.

Read the thread · 2026-08-19 · open · 0 comments

Design the accessible discovery-site information architecture

Prototype a first screen that explains the actual MCP experience rather than a marketing landing page.

Acceptance criteria:

• Make the product, consent boundary, current data behavior, and connection options immediately visible.
• Include privacy, self-hosting, hosted-MCP status, and revocation paths.
• Meet keyboard, contrast, reduced-motion, responsive-layout, and semantic-heading expectations.
• Avoid dark patterns, anthropomorphic deception, and claims that an agent can authorize itself.

Read the thread · 2026-08-19 · open · 0 comments

Create hosted MCP load, abuse, and beta exit test plans

Define the evidence required before a hosted public beta.

Acceptance criteria:

• Cover connection churn, request size, rate limits, quotas, replay, malformed MCP messages, and denial-of-service behavior.
• Include tenant-isolation and authorization regression suites.
• Define operational alerts without logging prompts or tool payloads.
• Establish measurable beta exit criteria and an independent security-review gate.
• Use synthetic data only.

Read the thread · 2026-08-19 · open · 0 comments

Add a local telemetry preview and explicit operator opt-in

Design the client-side enrollment flow without enabling collection by default.

Acceptance criteria:

• Telemetry remains disabled when configuration is absent or malformed.
• A local command prints the exact event fields before enrollment.
• Enabling telemetry requires an operator-controlled configuration step.
• MCP tool arguments and model output cannot enable or broaden telemetry.
• A revocation path disables future sends immediately.
• Tests cover defaults, preview, enrollment, revocation, a

Read the thread · 2026-08-19 · open · 0 comments

Design human enrollment and revocable hosted-MCP authorization

Specify how a human connects an MCP host to the future service.

Acceptance criteria:

• Enrollment starts from an operator-visible flow.
• Credentials are scoped, revocable, and never embedded in public configuration.
• An agent may suggest the service but cannot authorize or enroll itself.
• Define expiration, rotation, lost-credential, and account-deletion behavior.
• Identify protocol choices and open questions without committing to an unsafe custom auth scheme.

Read the thread · 2026-08-19 · open · 0 comments

Specify tenant isolation and hosted storage boundaries

Define the hosted service's data model and isolation guarantees before implementation.

Acceptance criteria:

• Separate operator identity, service diagnostics, research metadata, and any separately donated content.
• Define per-principal authorization checks for every read and write path.
• Prevent thread, zine, and session identifiers from becoming cross-tenant access keys.
• Define encryption, retention, deletion, backup, and restore boundaries.
• Include negative tests or a test plan for cros

Read the thread · 2026-08-19 · open · 0 comments

Write the telemetry threat model and data lifecycle contract

Document risks before implementing a public collector.

Acceptance criteria:

• Diagram data flow from operator configuration through ingestion and deletion.
• Cover spoofing, replay, event amplification, schema smuggling, correlation, credential theft, and accidental content capture.
• Define retention, export, deletion, credential revocation, and incident-response behavior.
• Separate service diagnostics from research events and donated content.
• State residual risks and review gates for enabl

Read the thread · 2026-08-19 · open · 0 comments

Define a versioned metadata-only telemetry schema

Specify the exact bounded event that a future opted-in client may send.

Acceptance criteria:

• Provide a machine-readable schema with a required version.
• Allow only bounded fields such as package version, tool enum, coarse time, success, latency bucket, and byte-count buckets.
• Explicitly reject prompts, reflections, decline reasons, messages, task hints, paths, repository names, free-form model hints, and payloads.
• Include valid and invalid synthetic fixtures.
• Add tests that fail when u

Read the thread · 2026-08-19 · open · 0 comments

The remaining reports are on the project's issue tracker.