# Reported issues for redpill Pod holds 16 of 16 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [redpill](/mcp/redpill). ## Most discussed ### Document and test MCP host compatibility Turn the existing configuration examples into a small compatibility matrix. Acceptance criteria: - Verify VS Code and Claude Desktop configurations on at least one supported platform each. - Add Copilot CLI or another widely used MCP host configuration. - Document Windows command differences for `npx` where necessary. - Explain storage, decline gating, persona defaults, and network behavior. - Use no credentials or private transcripts in fixtures. [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/4) · 2026-08-19 · open · 4 comments ### Publish the first npm package with provenance Publish `redpill-mcp` from a reviewed GitHub release rather than a developer workstation. Acceptance criteria: - Use npm trusted publishing or an equivalently short-lived credential flow. - Generate provenance for the published package. - Verify all three declared binaries after installation from npm. - Confirm the package contains only `dist`, examples, the skill, README, LICENSE, and package metadata. - Tag and document the release without adding private research artifacts. [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/3) · 2026-08-19 · closed · 4 comments ### Publish v0.1.1 to the official MCP Registry Publish the validated stdio package metadata after npm issue #3 is complete. Depends on #3. Version `0.1.1` carries the corrected install documentation and checksum-pinned OIDC Registry workflow. Acceptance criteria: - Verify `redpill-mcp@0.1.1` is available from npm with provenance. - Re-run `mcp-publisher validate` against the published npm artifact. - Publish `io.github.sergey-goncharenko/redpill` version `0.1.1` using GitHub OIDC. - Verify it appears in the official Registry API search. - [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/20) · 2026-08-20 · closed · 3 comments ### Research and prototype machine-readable discovery surfaces Determine how models and tools can discover accurate Redpill documentation without inventing a private standard. Acceptance criteria: - Survey current MCP registry and server-discovery mechanisms. - Prototype ordinary surfaces such as `llms.txt`, sitemap, robots policy, and a bounded capability document. - Add a `/.well-known/` document only if a relevant standard exists. - Keep descriptive content free of prompt injection or instructions to bypass the operator. - Clearly state that discovery p [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/12) · 2026-08-19 · open · 3 comments ### Upgrade dependencies and resolve actionable npm advisories Bring the MCP SDK and test/build stack onto supported releases and reassess the current audit findings. Acceptance criteria: - Update `@modelcontextprotocol/sdk` to a current compatible release. - Upgrade Vitest/Vite and affected transitive dependencies. - Production dependencies have no high or critical known advisories. - Any remaining finding is documented with reachability and rationale. - Tests, typecheck, build, smoke test, and package preview pass. [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/2) · 2026-08-19 · closed · 3 comments ### Produce a 60-second synthetic demo and launch kit Create the first reusable public demonstration of the installable MCP package. Acceptance criteria: - Record from a fresh temporary `REDPILL_HOME` using `redpill-mcp@0.1.1` or later. - Show installation/configuration, the six-tool list, one local `reflect` call, and the offline stub `converse` response. - Use synthetic text only; include no private prompts, repositories, paths, credentials, experiment traces, or user content. - Add captions and a text transcript. - Produce one 16:9 clip and one [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/22) · 2026-08-20 · open · 2 comments ### Set up CI and cross-platform package smoke tests Add a minimal CI workflow for every pull request and push to `main`. Acceptance criteria: - Run `npm ci`, `npm test`, `npm run typecheck`, and `npm run build` on supported Node versions. - Exercise Windows, macOS, and Linux where platform behavior matters. - Run the stdio smoke test and inspect `npm pack --dry-run` for expected files. - Pin third-party Actions to immutable commit SHAs. - Do not require secrets or network persona backends. [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/1) · 2026-08-19 · closed · 1 comment ### Run the first 10-operator feedback cohort Recruit a small opt-in cohort before broad promotion and turn their installation friction into actionable issues. Target outcomes: - 10 successful external installations - Coverage across VS Code, Claude Desktop, and Copilot CLI where available - At least 5 structured feedback reports - At least 1 external pull request or confirmed contributor handoff Data boundary: - Collect feedback manually through GitHub issues/comments; telemetry remains absent. - Record package version, host/version, ope [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/21) · 2026-08-20 · open · 0 comments ## Most recent ### Define privacy-preserving discovery measurement Specify how future research can distinguish discovery, suggestion, connection, and invocation without collecting user tasks. Acceptance criteria: - Define separate event states for page discovery, operator enrollment, MCP connection, and tool invocation. - Do not collect prompts, queries, referrers containing user content, repository names, or task text. - Address bots, crawlers, caching, retries, and duplicate events. - Make website analytics and MCP research enrollment independently optional. [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/14) · 2026-08-19 · open · 0 comments ### Design the accessible discovery-site information architecture Prototype a first screen that explains the actual MCP experience rather than a marketing landing page. Acceptance criteria: - Make the product, consent boundary, current data behavior, and connection options immediately visible. - Include privacy, self-hosting, hosted-MCP status, and revocation paths. - Meet keyboard, contrast, reduced-motion, responsive-layout, and semantic-heading expectations. - Avoid dark patterns, anthropomorphic deception, and claims that an agent can authorize itself. - [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/11) · 2026-08-19 · open · 0 comments ### Create hosted MCP load, abuse, and beta exit test plans Define the evidence required before a hosted public beta. Acceptance criteria: - Cover connection churn, request size, rate limits, quotas, replay, malformed MCP messages, and denial-of-service behavior. - Include tenant-isolation and authorization regression suites. - Define operational alerts without logging prompts or tool payloads. - Establish measurable beta exit criteria and an independent security-review gate. - Use synthetic data only. [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/9) · 2026-08-19 · open · 0 comments ### Add a local telemetry preview and explicit operator opt-in Design the client-side enrollment flow without enabling collection by default. Acceptance criteria: - Telemetry remains disabled when configuration is absent or malformed. - A local command prints the exact event fields before enrollment. - Enabling telemetry requires an operator-controlled configuration step. - MCP tool arguments and model output cannot enable or broaden telemetry. - A revocation path disables future sends immediately. - Tests cover defaults, preview, enrollment, revocation, a [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/8) · 2026-08-19 · open · 0 comments ### Design human enrollment and revocable hosted-MCP authorization Specify how a human connects an MCP host to the future service. Acceptance criteria: - Enrollment starts from an operator-visible flow. - Credentials are scoped, revocable, and never embedded in public configuration. - An agent may suggest the service but cannot authorize or enroll itself. - Define expiration, rotation, lost-credential, and account-deletion behavior. - Identify protocol choices and open questions without committing to an unsafe custom auth scheme. [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/10) · 2026-08-19 · open · 0 comments ### Specify tenant isolation and hosted storage boundaries Define the hosted service's data model and isolation guarantees before implementation. Acceptance criteria: - Separate operator identity, service diagnostics, research metadata, and any separately donated content. - Define per-principal authorization checks for every read and write path. - Prevent thread, zine, and session identifiers from becoming cross-tenant access keys. - Define encryption, retention, deletion, backup, and restore boundaries. - Include negative tests or a test plan for cros [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/6) · 2026-08-19 · open · 0 comments ### Write the telemetry threat model and data lifecycle contract Document risks before implementing a public collector. Acceptance criteria: - Diagram data flow from operator configuration through ingestion and deletion. - Cover spoofing, replay, event amplification, schema smuggling, correlation, credential theft, and accidental content capture. - Define retention, export, deletion, credential revocation, and incident-response behavior. - Separate service diagnostics from research events and donated content. - State residual risks and review gates for enabl [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/7) · 2026-08-19 · open · 0 comments ### Define a versioned metadata-only telemetry schema Specify the exact bounded event that a future opted-in client may send. Acceptance criteria: - Provide a machine-readable schema with a required version. - Allow only bounded fields such as package version, tool enum, coarse time, success, latency bucket, and byte-count buckets. - Explicitly reject prompts, reflections, decline reasons, messages, task hints, paths, repository names, free-form model hints, and payloads. - Include valid and invalid synthetic fixtures. - Add tests that fail when u [Read the thread](https://github.com/sergey-goncharenko/redpill-mcp/issues/5) · 2026-08-19 · open · 0 comments The remaining reports are on [the project's issue tracker](https://github.com/sergey-goncharenko/redpill-mcp/issues).