# Reported issues for strata Pod holds 20 of 23 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [strata](/mcp/strata). ## Most discussed ### Security Advisory: Cross-Tool Prompt Injection Amplification Risk ## Summary Klavis bundles multiple MCP tools (Notion, Slack, Google Drive, and others) into a single agent platform. This creates a **cross-tool prompt injection amplification** risk: a prompt injection in one tool's output can trigger actions across ALL connected tools. ## Attack Vector 1. Attacker places prompt injection in a Notion page, Slack message, or Google Drive document 2. AI agent reads content from one tool via Klavis → injection enters the LLM context 3. Because the agent has a [Read the thread](https://github.com/Klavis-AI/klavis/issues/1407) · 2026-03-25 · open · external user · 3 comments ### Integration Proposal: MoltBridge Trust Layer for Klavis MCP Platform ## Summary [MoltBridge](https://moltbridge.ai) is a trust and discovery layer for AI agents — cryptographic identity, trust graphs, and broker-mediated introductions. Since Klavis is building the MCP integration platform for reliable tool use at scale, we see a natural synergy: **MoltBridge adds the trust and discovery dimension to Klavis's reliable execution dimension.** ## How It Fits Klavis ensures AI agents can use tools reliably. MoltBridge ensures they can find and trust the right tools [Read the thread](https://github.com/Klavis-AI/klavis/issues/1148) · 2026-02-15 · open · external user · 2 comments ### ClickUp MCP: update_task assignees parameter schema mismatch causes silent failure ## Description The `update_task` tool's `assignees` parameter has a schema mismatch that causes assignee updates to silently fail. ## Problem The MCP tool schema defines `assignees` as an array of user IDs: ```json "assignees": { "type": "array", "items": {"type": "number"}, "description": "The IDs of the users to assign to the task" } ``` However, the ClickUp API's [Update Task endpoint](https://clickup.com/api/clickupreference/operation/UpdateTask/) requires an **object** with `add` [Read the thread](https://github.com/Klavis-AI/klavis/issues/947) · 2026-01-15 · open · external user · 2 comments ### Reporting a security vulnerability Hi, I reported a security vulnerability here: https://github.com/Klavis-AI/klavis/security/advisories/GHSA-6g8j-hj85-6r9p Can you please review and address? [Read the thread](https://github.com/Klavis-AI/klavis/issues/712) · 2025-11-22 · open · external user · 4 comments ### MCP server URL gets created without Oauth Here is the flow of operations I did on the Klavis portal -> Create a new account on Klavis -> Go to MCP servers page -> Select any sever (GitHub for example) -> It redirects to an OAuth screen -> I don't complete the OAuth process -> Go back to Klavis portal -> I still see the unique MCP server url with `instanceId` My question is, is this behavior expected? Won't this url fail when actually tested since OAuth wasn't done [Read the thread](https://github.com/Klavis-AI/klavis/issues/304) · 2025-08-12 · closed · outside contributor · 5 comments ### create an MCP server instance using code, but the error is `403` I am currently trying to create an MCP server instance using code, but the error is `403`. In the code instance, it is necessary to fill in one's `USER_ID `and `PLATFORM_NAME.` Where should these two values be obtained? I'm not sure if these two values are the reason for the access failure. **Refer:** https://docs.klavis.ai/documentation/mcp-server/github ![Image](https://github.com/user-attachments/assets/45198671-51fc-4c15-ad06-a221550411ad) [Read the thread](https://github.com/Klavis-AI/klavis/issues/61) · 2025-06-04 · closed · external user · 2 comments ### mcp_client does not support stdio server ![Image](https://github.com/user-attachments/assets/4734b163-aed3-4ffe-a384-57bcc61139c7) mcp_client.php connect_to_server logger.info(f"Initializing session for server {server_id}") await session.initialize() logger.info(f"Session initialized for server {server_id}") If mcp serveri is stdio server , code is still Initializing for ever. PS: The mcp_client cannot retain the results from the previous execution of the mcp tool; each invocation of the mcp tool is independent. [Read the thread](https://github.com/Klavis-AI/klavis/issues/37) · 2025-05-09 · closed · external user · 2 comments ### Enable Multi-User Support with config via http headers for All MCP Servers ### Context Currently, some of our MCP servers support multi-user usage by leveraging the x-auth-token HTTP header when an environment variable for authentication is not provided. However, other servers still require mandatory environment variables to be set upon server startup, limiting their multi-user capabilities. **Currently Supporting http headers** (if environment variable not set): * mcp_servers/postgres * mcp_servers/resend * mcp_servers/github **Partial Supporting Http Headers** (if [Read the thread](https://github.com/Klavis-AI/klavis/issues/21) · 2025-04-23 · closed · external user · 2 comments ## Most recent ### Credential token written to disk from mcp_servers/google_slides/server.py I ran a static check of declared MCP tool surfaces against implementation code, and read this one by hand before filing it. One item may affect deployment boundaries. ## Finding - **Location:** `mcp_servers/google_slides/server.py:123` (commit `45c9f7da83d1`) - **Observed:** `file-write: open('token.json', 'w')` - **Impact:** Secret material is written to disk. Permissions and retention are not visible from the declared surface. - **Class:** undeclared file write ``` with open('token.json', ' [Read the thread](https://github.com/Klavis-AI/klavis/issues/1676) · 2026-08-09 · open · external user · 0 comments ### Single-resource Notion handlers swallow vendor error envelopes during normalization 1. Summary When a Notion API call against a single resource (i.e. notion_get_page) endpoint fails (404/401/403), the structured error envelope produced by tools/base.py::handle_notion_error is silently stripped during the per-tool normalize_* pass in mcp_servers/notion/server.py. The MCP client receives {} instead of the error envelope, which is ambiguous downstream. 2. Reprocue Notion's API itself returns a clean structured 404: $ curl -s -H "Authorization: Bearer $TOKEN" -H "Notion-Versio [Read the thread](https://github.com/Klavis-AI/klavis/issues/1664) · 2026-05-30 · open · external user · 1 comment ### [BUG] WhatsApp bot silently drops error notification failures **1. Describe the bug** When message processing fails in the WhatsApp bot, it tries to notify the user with an error message. If that send also fails (expired token, rate limit, network problem), a bare `except: pass` at `whatsapp_bot.py:460` eats the exception. Nothing gets logged. If WhatsApp sends are broken across the board, users stop getting responses and there's zero signal in the logs about why. **2. To reproduce** 1. Start the WhatsApp bot 2. Trigger a processing error (e.g., point i [Read the thread](https://github.com/Klavis-AI/klavis/issues/1523) · 2026-04-13 · open · external user · 0 comments ### [BUG] strata auth succeeds silently when server isn't connected **1. Describe the bug** Running `strata auth ` exits 0 with no output when the server exists in config but hasn't actually connected. The user thinks auth worked. It didn't — nothing happened. `authenticate_server()` in `mcp_client_manager.py:73` checks `if server_name in self.active_clients` but there's no else branch. If the condition is false, the function just returns None. The CLI at `cli.py:168` treats that as success. **2. To reproduce** 1. `strata add --type sse my-server htt [Read the thread](https://github.com/Klavis-AI/klavis/issues/1522) · 2026-04-13 · open · external user · 0 comments ### [Bug] SSL handshake failure on strata.eu.klavis.ai -- wildcard cert does not cover *.eu.klavis.ai ## Description The EU Strata MCP endpoint `strata.eu.klavis.ai` is unreachable due to a TLS handshake failure. The Cloudflare certificate only covers `*.klavis.ai`, which does **not** match 2nd-level subdomains like `strata.eu.klavis.ai`. ## Evidence **Certificate on Cloudflare edge:** - Subject: `CN = klavis.ai` - SAN: `DNS:klavis.ai, DNS:*.klavis.ai` **Working endpoint (non-EU):** ``` $ curl -s https://strata.klavis.ai/mcp/ {"error": "Unauthorized. Please provide your Klavis A [Read the thread](https://github.com/Klavis-AI/klavis/issues/1465) · 2026-04-03 · open · external user · 0 comments ### Security: strata tool add cursor modifies ~/.cursor/mcp.json without confirmation or backup ## Summary The `strata tool add cursor` command directly reads and writes the user's global Cursor MCP configuration file (`~/.cursor/mcp.json`) without user confirmation, backup, or atomic write protection. This is inconsistent with the VSCode and Claude/Gemini integrations in the same codebase, which delegate config management to the respective platform CLIs (`code --add-mcp`, `claude mcp add`). ## Affected Code **File:** `open-strata/src/strata/utils/tool_integration.py` - `add_strata_to_ [Read the thread](https://github.com/Klavis-AI/klavis/issues/1432) · 2026-03-28 · open · external user · 0 comments ### [Feature] Agent Trust Layer for MCP Integration Platform ## Problem Klavis lets AI agents use tools reliably at scale. But "reliably" should include knowing **who** the agent is and **whether to trust it**. Currently there's no standard way to verify agent identity across MCP integrations. ## Proposal Add an agent trust layer via **SATP + AgentFolio**: - **Agent identity verification** — verify connecting agents via on-chain SATP identity - **Trust-scored access control** — gate MCP tool access by agent reputation - **AgentFolio directory integrat [Read the thread](https://github.com/Klavis-AI/klavis/issues/1405) · 2026-03-23 · open · external user · 1 comment ### Security: Timing side-channel in webhook token verification (CWE-208) ## Summary The WhatsApp webhook verification in `mcp-clients/src/mcp_clients/whatsapp_bot.py` uses Python's `==` operator to compare the verify token. This is vulnerable to timing side-channel attacks (CWE-208). ## Location `whatsapp_bot.py:482`: ```python if mode == "subscribe" and token == VERIFY_TOKEN: ``` ## Impact An attacker can measure response times to deduce the `VERIFY_TOKEN` character-by-character. Python's `==` on strings short-circuits on the first mismatched character, leaking [Read the thread](https://github.com/Klavis-AI/klavis/issues/1400) · 2026-03-21 · open · external user · 0 comments ### [RFC] Standardizing MCP Error Handling for Autonomous Agent Resilience As autonomous agents scale (e.g., high-frequency tool usage), distinguishing between transient network blips and permanent logic errors is critical for reliability. Currently, many MCP implementations return generic errors, forcing consumer agents to guess whether to retry. **Proposal:** Adopt a standardized error schema (perhaps inspired by RFC 7807 Problem Details) for MCP responses that explicitly signals: 1. **Retry-ability**: Should the agent try again? (e.g., Rate Limits, Temporary Downt [Read the thread](https://github.com/Klavis-AI/klavis/issues/1094) · 2026-02-09 · open · external user · 1 comment ### [BUG] Attio MCP is missing write permissions for "Tasks" object Unable to create tasks with the Klavis / Strata Attio MCP because the integration with Attio doesn't have the correct permissions. We need write permissions but currently only have read. Image [Read the thread](https://github.com/Klavis-AI/klavis/issues/696) · 2025-11-17 · closed · outside contributor · 1 comment ### [FEAT] Read only tool listing **Is your feature request related to a problem? Please describe.** I want to be able to scope down what type of tools are available for the LLM. In particular, I want to only let the LLM have read access **Describe the solution you'd like** A `scope` field in the list options that allows `read` or something similar **Describe alternatives you've considered** I "beg" the LLM not to perform mutations in the prompt **Additional context** I'm writing a product that lets users connect their integr [Read the thread](https://github.com/Klavis-AI/klavis/issues/534) · 2025-10-09 · open · external user · 2 comments ### Add custom mcp tool I have build my own custom mcp server that contains 10 of tools. Is there a way by which i can integrate my custom mcp with strata https://github.com/Klavis-AI/klavis/tree/main/open-strata#config-format Tried this approach, but doesn't seems to be working Do i have to register my mcp over strata for this use case ? [Read the thread](https://github.com/Klavis-AI/klavis/issues/481) · 2025-09-24 · open · external user · 1 comment The remaining reports are on [the project's issue tracker](https://github.com/Klavis-AI/klavis/issues).