Reported issues for Talos Linux MCP Server
Pod holds 20 of 57 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to Talos Linux MCP Server.
Most discussed
feat(upgrade-k8s): add talos_upgrade_k8s tool
Rewritten 2026-06-03 per maintainer decision (proceed via
go-kubernetes). This body supersedes the original gRPC-based proposal and the 2026-04-16 plan comment. See the pinned clarification comment for the rationale and the verified findings.
Severity
P2 — moderate
Category
reliability
Description
No talos_upgrade_k8s tool exists. Kubernetes component upgrades require an operator to break out of the MCP-first workflow and run talosctl upgrade-k8s from a shell, reint
Read the thread · 2026-04-07 · open · 4 comments
chore(http): migrate off deprecated StreamableHTTPOptions.CrossOriginProtection before go-sdk v1.8.0
type: chore status: triage risk: low
Intent
Replace the deprecated StreamableHTTPOptions.CrossOriginProtection field assignment with the protection.Handler(mcpHandler) wrapper form so the HTTP transport keeps compiling after go-sdk v1.8.0 removes the field.
Context
PR #177 (commit 5dc4794) restored cross-origin protection by setting StreamableHTTPOptions.CrossOriginProtection: &http.CrossOriginProtection{} in cmd/talos-mcp/main.go:315. The staff review of #177 flagged t
Read the thread · 2026-05-11 · closed · 2 comments
chore(governance): document and enforce GitHub branch protection rules
Severity
P2 — moderate
Category
security, governance
Description
There is no evidence of GitHub branch protection rules in the repository. Without protection, anyone with write access can push directly to main, bypassing CI, and automatically trigger a release via auto-tag.yml → release.yml.
Evidence
No branch protection configuration found in the repository. auto-tag.yml triggers on every push to main and creates a semver tag. The created tag triggers `release.y
Read the thread · 2026-04-08 · closed · 2 comments
extractMachineConfigBody fragile with 0% test coverage
Description
extractMachineConfigBody in internal/tools/lifecycle.go contains two distinct code paths (legacy protobuf format and YAML annotation format) with no unit tests. The function relies on assumptions about Talos' internal MachineConfig serialization format. A format change in a future Talos version would break this silently.
Evidence
internal/tools/lifecycle.go:360–389 — two branches:
- Legacy: direct protobuf field access
- Current: YAML-annotated struct traversal
Ne
Read the thread · 2026-04-07 · closed · 2 comments
Partial multi-node responses silently omit unreachable nodes
Description
When a multi-node tool call includes an unreachable node, that node's response is silently absent from the result. No error indicator, no partial flag, and no per-node status is returned. The caller receives a response that appears complete but is missing data.
Evidence
internal/talos/client.go:125–133 — node strings are forwarded to talosclient.WithNodes without any mechanism to detect or surface per-node failures. The Talos gRPC response format embeds per-message error
Read the thread · 2026-04-07 · closed · 2 comments
Add loud Talos version-skew detection to prevent silent config-resource data loss (v1.13 resource-format change)
Description
Since the machinery SDK bump to v1.13.4 (now on main), the server is liable to mis-read five control-plane config resources when the connected Talos node's minor version sits on the other side of the v1.13 resource-format boundary. The server already learns both versions at startup — its compiled machinery minor, and the cluster Talos version via GetClusterVersion — so it can detect the skew and warn or refuse instead of returning unreliable data. Today it does neither, and t
Read the thread · 2026-06-16 · closed · 1 comment
test(transport): add CSRF regression test for HTTP cross-origin protection
type: chore status: triage risk: low
Intent
Add a regression test that fails if the MCP StreamableHTTP handler stops rejecting cross-origin POSTs, so future SDK upgrades that flip the cross-origin default cannot reach main undetected.
Context
PR #177 explicitly sets StreamableHTTPOptions.CrossOriginProtection: &http.CrossOriginProtection{} in cmd/talos-mcp/main.go:315 to restore the v1.4.1–v1.5.0 go-sdk default that v1.6.0 dropped. Staff-review (`.claude/reviews/restore-cro
Read the thread · 2026-05-11 · closed · 1 comment
fix(tools): add confirm guard to talos_service_action (Phase B retrofit)
Description
talos_service_action is a mutating tool but its args struct ServiceActionArgs in internal/tools/lifecycle.go carries no Confirm bool field. Every other mutating tool (talos_reboot, talos_upgrade, talos_rollback, talos_reset, talos_patch_config, talos_apply_config) requires confirm=true per repo-root CLAUDE.md § Safety.
The invariants test added in PR #154 (internal/tools/invariants_test.go) asserts destructive tools carry a confirm property in their `
Read the thread · 2026-04-16 · closed · 1 comment
Most recent
feat(resources): support MCP resource subscriptions backed by COSI watch
Severity
P2 — enables reactive agents; high implementation cost.
Category
Protocol feature adoption (MCP resources/subscribe + notifications/resources/updated).
Description
MCP clients can subscribe to resource URIs to receive push updates when the underlying data changes. talos-mcp-server exposes two static resources and two templates (internal/resources/resources.go:25–51) but never registers a subscription handler. Talos gRPC provides native Watch semantics on the COS
Read the thread · 2026-04-15 · closed · 0 comments
feat(server): implement argument completion for tool inputs
Severity
P2 — UX improvement, no correctness impact.
Category
Protocol feature adoption (MCP completion/complete).
Description
talos-mcp-server declares tools with free-form string arguments (nodes, namespace, service_name, type/resource alias, config paths) but does not register a completion handler. MCP clients that implement completion/complete (Claude Desktop, Cursor) therefore cannot offer autosuggest for any argument. We already have authoritative sources for t
Read the thread · 2026-04-15 · closed · 0 comments
feat(tools): emit MCP progress notifications for long-running mutating tools
Severity
P1 — affects operator UX on every destructive operation.
Category
Protocol feature adoption (MCP progress notifications).
Description
Mutating tools that wait on the Talos cluster (talos_reboot wait=true, talos_upgrade, talos_reset, talos_apply_config with wait) block silently for up to 5 minutes (default reboot timeout per CLAUDE.md § Safety) before returning. MCP supports progress notifications via notifications/progress keyed by a caller-provided `progres
Read the thread · 2026-04-15 · closed · 0 comments
feat(tools): declare output schemas and return structured content for read-only tools
Severity
P1 — high value, low risk.
Category
Protocol feature adoption (MCP tool output schema + structured content).
Description
All 17 read-only tools in cmd/talos-mcp/main.go:182–352 currently return unstructured text (textResult(...)) without declaring an OutputSchema. Since go-sdk v1.5.0 (now in use on main), declaring an output schema and returning StructuredContent lets MCP clients consume the payload as typed JSON instead of re-parsing prose. The MCP spec forma
Read the thread · 2026-04-15 · closed · 0 comments
docs(tools): document symlink limitation of TALOS_MCP_ALLOWED_PATHS path allowlist
Description
talos_list_files and talos_read_file follow symlinks on the node filesystem without verifying the resolved path against the TALOS_MCP_ALLOWED_PATHS allowlist. An operator who restricts access to /etc can be bypassed if a symlink outside /etc points into it (or vice versa: a symlink inside /etc resolves to a path outside the allowlist).
The path allowlist check (checkPathAllowed) is applied to the request path supplied by the caller, not to the symlink-resolved
Read the thread · 2026-04-09 · closed · 1 comment
fix(tools): canonicalize incoming path in checkPathAllowed to prevent traversal bypass
Description
checkPathAllowed in internal/tools/files.go uses strings.HasPrefix(path, allowed) to validate the incoming request path against the allowlist. The incoming path (args.Path / listPath) is never canonicalized with filepath.Clean before the prefix check.
Evidence
checkPathAllowed (internal/tools/files.go):
func checkPathAllowed(path string, allowed []string) error {
for _, prefix := range allowed {
if strings.HasPrefix(path, prefix) {
[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/135) · 2026-04-09 · closed · 1 comment
### feat(tools): support config_file path in talos_apply_config to reduce token usage
## Problem or use case
`talos_apply_config` accepts the full machine config as an inline YAML/JSON string in the `config` parameter. A typical Talos machine config is 5,000–15,000+ tokens. When the AI agent passes this inline:
1. **The config consumes tokens twice** — once in the tool call arguments (agent output), once echoed back in the tool result context. For a 10K-token config this adds ~20K tokens per invocation.
2. **Dry-run + apply doubles the cost** — the recommended workflow calls th
[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/133) · 2026-04-09 · closed · 0 comments
### feat(tools): add talos_etcd_snapshot_restore tool for disaster recovery
## Problem or use case
When a Talos cluster loses etcd quorum permanently (e.g. due to multiple simultaneous node failures or unrecoverable data corruption), the only recovery path is to restore from an etcd snapshot. The talos-mcp-server already exposes `talos_etcd_snapshot` to create backups, but there is no counterpart tool to restore them.
Without a restore tool, AI agents cannot complete the disaster recovery workflow autonomously — they must hand off to a human operator who runs `talosct
[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/132) · 2026-04-09 · open · 1 comment
### design(safety): require preview token and fresh-state revalidation for talos_patch_config apply
## Problem
`talos_patch_config` already has or is gaining several important safety controls: `dry_run=true` by default, an explicit `confirm=true` guard from #37, blocked-path hardening in #80, and race-condition discussion in #71. Those controls are useful, but they still leave one production-readiness gap: there is no explicit reviewed plan token and no fresh-state refusal between preview and apply.
Today the operator can inspect a dry-run result and then send a second mutating request with
[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/127) · 2026-04-09 · open · 1 comment
### chore(tools): consolidate environment variable reading into startup config
## Description
`os.Getenv` calls are scattered across 4 files, with some read at startup and others in hot paths on every request. This makes the configuration surface implicit and harder to test.
## Evidence
| Variable | File | When read |
|---|---|---|
| `TALOSCONFIG` | `internal/talos/client.go:29` | Client init (once) |
| `TALOS_CONTEXT` | `internal/talos/client.go:41` | Client init (once) |
| `TALOS_ENDPOINTS` | `internal/talos/client.go:45` | Client init (once) |
| `TALOS_MCP_READ_ONLY`
[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/82) · 2026-04-08 · closed · 1 comment
### chore(transport): log warning when DisableLocalhostProtection is active
## Description
`DisableLocalhostProtection` is set to `true` in the HTTP transport configuration, disabling the MCP SDK's built-in DNS rebinding guard. This is a necessary configuration (the server relies on a reverse proxy for origin validation), but there is no runtime warning logged at startup.
## Evidence
`cmd/talos-mcp/main.go:296`:
```go
DisableLocalhostProtection: true,
No log line warns about this setting. An operator deploying without a properly configured reverse proxy would b
Read the thread · 2026-04-08 · closed · 0 comments
feat(safety): add optional blocklist for critical config paths in talos_patch_config
Severity
P2 — moderate
Category
security, safety
Description
talos_patch_config accepts arbitrary JSON/YAML patches that can modify any part of the Talos machine configuration. Even with the confirm guard proposed in #37, a compromised or misbehaving MCP client can patch critical security-relevant paths.
Evidence
internal/tools/lifecycle.go:245–355 — the patch is applied without inspecting which config paths are modified. Critical paths that can be abused:
| Config
Read the thread · 2026-04-08 · closed · 1 comment
The remaining reports are on the project's issue tracker.