Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/strata/issues.md or /mcp/strata/issues.json, or Pod over MCP.

Reported issues for strata

Pod holds 20 of 23 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to strata.

Most discussed

Security Advisory: Cross-Tool Prompt Injection Amplification Risk

Summary

Klavis bundles multiple MCP tools (Notion, Slack, Google Drive, and others) into a single agent platform. This creates a cross-tool prompt injection amplification risk: a prompt injection in one tool's output can trigger actions across ALL connected tools.

Attack Vector

  1. Attacker places prompt injection in a Notion page, Slack message, or Google Drive document
  2. AI agent reads content from one tool via Klavis → injection enters the LLM context
  3. Because the agent has a

Read the thread · 2026-03-25 · open · external user · 3 comments

Integration Proposal: MoltBridge Trust Layer for Klavis MCP Platform

Summary

MoltBridge is a trust and discovery layer for AI agents — cryptographic identity, trust graphs, and broker-mediated introductions. Since Klavis is building the MCP integration platform for reliable tool use at scale, we see a natural synergy: MoltBridge adds the trust and discovery dimension to Klavis's reliable execution dimension.

How It Fits

Klavis ensures AI agents can use tools reliably. MoltBridge ensures they can find and trust the right tools

Read the thread · 2026-02-15 · open · external user · 2 comments

ClickUp MCP: update_task assignees parameter schema mismatch causes silent failure

Description

The update_task tool's assignees parameter has a schema mismatch that causes assignee updates to silently fail.

Problem

The MCP tool schema defines assignees as an array of user IDs:

"assignees": {
  "type": "array",
  "items": {"type": "number"},
  "description": "The IDs of the users to assign to the task"
}

However, the ClickUp API's Update Task endpoint requires an object with add

Read the thread · 2026-01-15 · open · external user · 2 comments

Reporting a security vulnerability

Hi, I reported a security vulnerability here: https://github.com/Klavis-AI/klavis/security/advisories/GHSA-6g8j-hj85-6r9p

Can you please review and address?

Read the thread · 2025-11-22 · open · external user · 4 comments

MCP server URL gets created without Oauth

Here is the flow of operations I did on the Klavis portal -> Create a new account on Klavis -> Go to MCP servers page -> Select any sever (GitHub for example) -> It redirects to an OAuth screen -> I don't complete the OAuth process -> Go back to Klavis portal -> I still see the unique MCP server url with instanceId

My question is, is this behavior expected? Won't this url fail when actually tested since OAuth wasn't done

Read the thread · 2025-08-12 · closed · outside contributor · 5 comments

create an MCP server instance using code, but the error is 403

I am currently trying to create an MCP server instance using code, but the error is 403.

In the code instance, it is necessary to fill in one's USER_ID and PLATFORM_NAME. Where should these two values be obtained?

I'm not sure if these two values are the reason for the access failure.

Refer: https://docs.klavis.ai/documentation/mcp-server/github

Image

Read the thread · 2025-06-04 · closed · external user · 2 comments

mcp_client does not support stdio server

Image

mcp_client.php connect_to_server

logger.info(f"Initializing session for server {server_id}") await session.initialize() logger.info(f"Session initialized for server {server_id}")

If mcp serveri is stdio server , code is still Initializing for ever.

PS: The mcp_client cannot retain the results from the previous execution of the mcp tool; each invocation of the mcp tool is independent.

Read the thread · 2025-05-09 · closed · external user · 2 comments

Enable Multi-User Support with config via http headers for All MCP Servers

Context

Currently, some of our MCP servers support multi-user usage by leveraging the x-auth-token HTTP header when an environment variable for authentication is not provided. However, other servers still require mandatory environment variables to be set upon server startup, limiting their multi-user capabilities.

Currently Supporting http headers (if environment variable not set):

Partial Supporting Http Headers (if

Read the thread · 2025-04-23 · closed · external user · 2 comments

Most recent

Credential token written to disk from mcp_servers/google_slides/server.py

I ran a static check of declared MCP tool surfaces against implementation code, and read this one by hand before filing it. One item may affect deployment boundaries.

Finding

with open('token.json', '

[Read the thread](https://github.com/Klavis-AI/klavis/issues/1676) · 2026-08-09 · open · external user · 0 comments

### Single-resource Notion handlers swallow vendor error envelopes during normalization

1. Summary

When a Notion API call against a single resource (i.e. notion_get_page) endpoint fails (404/401/403), the structured error envelope produced by tools/base.py::handle_notion_error is silently stripped during the per-tool normalize_* pass in mcp_servers/notion/server.py. 
The MCP client receives {} instead of the error envelope, which is ambiguous downstream.

2. Reprocue

Notion's API itself returns a clean structured 404:

$ curl -s -H "Authorization: Bearer $TOKEN" -H "Notion-Versio

[Read the thread](https://github.com/Klavis-AI/klavis/issues/1664) · 2026-05-30 · open · external user · 1 comment

### [BUG] WhatsApp bot silently drops error notification failures

**1. Describe the bug**

When message processing fails in the WhatsApp bot, it tries to notify the user with an error message. If that send also fails (expired token, rate limit, network problem), a bare `except: pass` at `whatsapp_bot.py:460` eats the exception. Nothing gets logged. If WhatsApp sends are broken across the board, users stop getting responses and there's zero signal in the logs about why.

**2. To reproduce**

1. Start the WhatsApp bot
2. Trigger a processing error (e.g., point i

[Read the thread](https://github.com/Klavis-AI/klavis/issues/1523) · 2026-04-13 · open · external user · 0 comments

### [BUG] strata auth succeeds silently when server isn't connected

**1. Describe the bug**

Running `strata auth <server>` exits 0 with no output when the server exists in config but hasn't actually connected. The user thinks auth worked. It didn't — nothing happened.

`authenticate_server()` in `mcp_client_manager.py:73` checks `if server_name in self.active_clients` but there's no else branch. If the condition is false, the function just returns None. The CLI at `cli.py:168` treats that as success.

**2. To reproduce**

1. `strata add --type sse my-server htt

[Read the thread](https://github.com/Klavis-AI/klavis/issues/1522) · 2026-04-13 · open · external user · 0 comments

### [Bug] SSL handshake failure on strata.eu.klavis.ai -- wildcard cert does not cover *.eu.klavis.ai

## Description

The EU Strata MCP endpoint `strata.eu.klavis.ai` is unreachable due to a TLS handshake failure. The Cloudflare certificate only covers `*.klavis.ai`, which does **not** match 2nd-level subdomains like `strata.eu.klavis.ai`.

## Evidence

**Certificate on Cloudflare edge:**
- Subject: `CN = klavis.ai`
- SAN: `DNS:klavis.ai, DNS:*.klavis.ai`

**Working endpoint (non-EU):**

$ curl -s https://strata.klavis.ai/mcp/ {"error": "Unauthorized. Please provide your Klavis A

Read the thread · 2026-04-03 · open · external user · 0 comments

Security: strata tool add cursor modifies ~/.cursor/mcp.json without confirmation or backup

Summary

The strata tool add cursor command directly reads and writes the user's global Cursor MCP configuration file (~/.cursor/mcp.json) without user confirmation, backup, or atomic write protection. This is inconsistent with the VSCode and Claude/Gemini integrations in the same codebase, which delegate config management to the respective platform CLIs (code --add-mcp, claude mcp add).

Affected Code

File: open-strata/src/strata/utils/tool_integration.py

Read the thread · 2026-03-28 · open · external user · 0 comments

[Feature] Agent Trust Layer for MCP Integration Platform

Problem

Klavis lets AI agents use tools reliably at scale. But "reliably" should include knowing who the agent is and whether to trust it. Currently there's no standard way to verify agent identity across MCP integrations.

Proposal

Add an agent trust layer via SATP + AgentFolio:

Read the thread · 2026-03-23 · open · external user · 1 comment

Security: Timing side-channel in webhook token verification (CWE-208)

Summary

The WhatsApp webhook verification in mcp-clients/src/mcp_clients/whatsapp_bot.py uses Python's == operator to compare the verify token. This is vulnerable to timing side-channel attacks (CWE-208).

Location

whatsapp_bot.py:482:

if mode == "subscribe" and token == VERIFY_TOKEN:

Impact

An attacker can measure response times to deduce the VERIFY_TOKEN character-by-character. Python's == on strings short-circuits on the first mismatched character, leaking

Read the thread · 2026-03-21 · open · external user · 0 comments

[RFC] Standardizing MCP Error Handling for Autonomous Agent Resilience

As autonomous agents scale (e.g., high-frequency tool usage), distinguishing between transient network blips and permanent logic errors is critical for reliability.

Currently, many MCP implementations return generic errors, forcing consumer agents to guess whether to retry.

Proposal: Adopt a standardized error schema (perhaps inspired by RFC 7807 Problem Details) for MCP responses that explicitly signals:

  1. Retry-ability: Should the agent try again? (e.g., Rate Limits, Temporary Downt

Read the thread · 2026-02-09 · open · external user · 1 comment

[BUG] Attio MCP is missing write permissions for "Tasks" object

Unable to create tasks with the Klavis / Strata Attio MCP because the integration with Attio doesn't have the correct permissions. We need write permissions but currently only have read.

Image

Read the thread · 2025-11-17 · closed · outside contributor · 1 comment

[FEAT] Read only tool listing

Is your feature request related to a problem? Please describe. I want to be able to scope down what type of tools are available for the LLM. In particular, I want to only let the LLM have read access

Describe the solution you'd like A scope field in the list options that allows read or something similar

Describe alternatives you've considered I "beg" the LLM not to perform mutations in the prompt

Additional context I'm writing a product that lets users connect their integr

Read the thread · 2025-10-09 · open · external user · 2 comments

Add custom mcp tool

I have build my own custom mcp server that contains 10 of tools. Is there a way by which i can integrate my custom mcp with strata

https://github.com/Klavis-AI/klavis/tree/main/open-strata#config-format

Tried this approach, but doesn't seems to be working Do i have to register my mcp over strata for this use case ?

Read the thread · 2025-09-24 · open · external user · 1 comment

The remaining reports are on the project's issue tracker.