# Reported issues for Talos Linux MCP Server

Pod holds 20 of 57 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Talos Linux MCP Server](/mcp/talos-linux-mcp-server).

## Most discussed

### feat(upgrade-k8s): add talos_upgrade_k8s tool

> **Rewritten 2026-06-03** per maintainer decision (proceed via `go-kubernetes`). This body supersedes the original gRPC-based proposal and the 2026-04-16 plan comment. See the pinned clarification comment for the rationale and the verified findings.

### Severity

P2 — moderate

### Category

reliability

### Description

No `talos_upgrade_k8s` tool exists. Kubernetes component upgrades require an operator to break out of the MCP-first workflow and run `talosctl upgrade-k8s` from a shell, reint

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/30) · 2026-04-07 · open · 4 comments

### chore(http): migrate off deprecated StreamableHTTPOptions.CrossOriginProtection before go-sdk v1.8.0

---
type: chore
status: triage
risk: low
---

## Intent
Replace the deprecated `StreamableHTTPOptions.CrossOriginProtection` field assignment with the `protection.Handler(mcpHandler)` wrapper form so the HTTP transport keeps compiling after go-sdk v1.8.0 removes the field.

## Context
PR #177 (commit `5dc4794`) restored cross-origin protection by setting `StreamableHTTPOptions.CrossOriginProtection: &http.CrossOriginProtection{}` in `cmd/talos-mcp/main.go:315`. The staff review of #177 flagged t

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/180) · 2026-05-11 · closed · 2 comments

### chore(governance): document and enforce GitHub branch protection rules

### Severity

P2 — moderate

### Category

security, governance

### Description

There is no evidence of GitHub branch protection rules in the repository. Without protection, anyone with write access can push directly to `main`, bypassing CI, and automatically trigger a release via `auto-tag.yml` → `release.yml`.

### Evidence

No branch protection configuration found in the repository. `auto-tag.yml` triggers on every push to `main` and creates a semver tag. The created tag triggers `release.y

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/77) · 2026-04-08 · closed · 2 comments

### extractMachineConfigBody fragile with 0% test coverage

## Description

`extractMachineConfigBody` in `internal/tools/lifecycle.go` contains two distinct code paths (legacy protobuf format and YAML annotation format) with no unit tests. The function relies on assumptions about Talos' internal `MachineConfig` serialization format. A format change in a future Talos version would break this silently.

## Evidence

`internal/tools/lifecycle.go:360–389` — two branches:
1. Legacy: direct protobuf field access
2. Current: YAML-annotated struct traversal

Ne

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/47) · 2026-04-07 · closed · 2 comments

### Partial multi-node responses silently omit unreachable nodes

## Description

When a multi-node tool call includes an unreachable node, that node's response is silently absent from the result. No error indicator, no partial flag, and no per-node status is returned. The caller receives a response that appears complete but is missing data.

## Evidence

`internal/talos/client.go:125–133` — node strings are forwarded to `talosclient.WithNodes` without any mechanism to detect or surface per-node failures. The Talos gRPC response format embeds per-message error

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/46) · 2026-04-07 · closed · 2 comments

### Add loud Talos version-skew detection to prevent silent config-resource data loss (v1.13 resource-format change)

## Description

Since the machinery SDK bump to v1.13.4 (now on `main`), the server is liable to mis-read five control-plane config resources when the connected Talos node's minor version sits on the other side of the v1.13 resource-format boundary. The server already learns both versions at startup — its compiled machinery minor, and the cluster Talos version via `GetClusterVersion` — so it can detect the skew and warn or refuse instead of returning unreliable data. Today it does neither, and t

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/210) · 2026-06-16 · closed · 1 comment

### test(transport): add CSRF regression test for HTTP cross-origin protection

---
type: chore
status: triage
risk: low
---

## Intent
Add a regression test that fails if the MCP StreamableHTTP handler stops rejecting cross-origin POSTs, so future SDK upgrades that flip the cross-origin default cannot reach `main` undetected.

## Context
PR #177 explicitly sets `StreamableHTTPOptions.CrossOriginProtection: &http.CrossOriginProtection{}` in `cmd/talos-mcp/main.go:315` to restore the v1.4.1–v1.5.0 go-sdk default that v1.6.0 dropped. Staff-review (`.claude/reviews/restore-cro

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/179) · 2026-05-11 · closed · 1 comment

### fix(tools): add confirm guard to talos_service_action (Phase B retrofit)

## Description

`talos_service_action` is a mutating tool but its args struct `ServiceActionArgs` in `internal/tools/lifecycle.go` carries no `Confirm bool` field. Every other mutating tool (`talos_reboot`, `talos_upgrade`, `talos_rollback`, `talos_reset`, `talos_patch_config`, `talos_apply_config`) requires `confirm=true` per repo-root `CLAUDE.md` § Safety.

The invariants test added in PR #154 (`internal/tools/invariants_test.go`) asserts destructive tools carry a `confirm` property in their `

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/156) · 2026-04-16 · closed · 1 comment

## Most recent

### feat(resources): support MCP resource subscriptions backed by COSI watch

### Severity

P2 — enables reactive agents; high implementation cost.

### Category

Protocol feature adoption (MCP `resources/subscribe` + `notifications/resources/updated`).

### Description

MCP clients can subscribe to resource URIs to receive push updates when the underlying data changes. talos-mcp-server exposes two static resources and two templates (`internal/resources/resources.go:25–51`) but never registers a subscription handler. Talos gRPC provides native `Watch` semantics on the COS

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/148) · 2026-04-15 · closed · 0 comments

### feat(server): implement argument completion for tool inputs

### Severity

P2 — UX improvement, no correctness impact.

### Category

Protocol feature adoption (MCP `completion/complete`).

### Description

talos-mcp-server declares tools with free-form string arguments (`nodes`, `namespace`, `service_name`, `type`/resource alias, config paths) but does not register a completion handler. MCP clients that implement `completion/complete` (Claude Desktop, Cursor) therefore cannot offer autosuggest for any argument. We already have authoritative sources for t

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/147) · 2026-04-15 · closed · 0 comments

### feat(tools): emit MCP progress notifications for long-running mutating tools

### Severity

P1 — affects operator UX on every destructive operation.

### Category

Protocol feature adoption (MCP progress notifications).

### Description

Mutating tools that wait on the Talos cluster (`talos_reboot wait=true`, `talos_upgrade`, `talos_reset`, `talos_apply_config` with wait) block silently for up to 5 minutes (default reboot timeout per `CLAUDE.md § Safety`) before returning. MCP supports progress notifications via `notifications/progress` keyed by a caller-provided `progres

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/146) · 2026-04-15 · closed · 0 comments

### feat(tools): declare output schemas and return structured content for read-only tools

### Severity

P1 — high value, low risk.

### Category

Protocol feature adoption (MCP tool output schema + structured content).

### Description

All 17 read-only tools in `cmd/talos-mcp/main.go:182–352` currently return unstructured text (`textResult(...)`) without declaring an `OutputSchema`. Since go-sdk v1.5.0 (now in use on `main`), declaring an output schema and returning `StructuredContent` lets MCP clients consume the payload as typed JSON instead of re-parsing prose. The MCP spec forma

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/145) · 2026-04-15 · closed · 0 comments

### docs(tools): document symlink limitation of TALOS_MCP_ALLOWED_PATHS path allowlist

## Description

`talos_list_files` and `talos_read_file` follow symlinks on the node filesystem without verifying the resolved path against the `TALOS_MCP_ALLOWED_PATHS` allowlist. An operator who restricts access to `/etc` can be bypassed if a symlink outside `/etc` points into it (or vice versa: a symlink inside `/etc` resolves to a path outside the allowlist).

The path allowlist check (`checkPathAllowed`) is applied to the **request path** supplied by the caller, not to the symlink-resolved 

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/136) · 2026-04-09 · closed · 1 comment

### fix(tools): canonicalize incoming path in checkPathAllowed to prevent traversal bypass

## Description

`checkPathAllowed` in `internal/tools/files.go` uses `strings.HasPrefix(path, allowed)` to validate the incoming request path against the allowlist. The incoming path (`args.Path` / `listPath`) is never canonicalized with `filepath.Clean` before the prefix check.

## Evidence

`checkPathAllowed` (internal/tools/files.go):
```go
func checkPathAllowed(path string, allowed []string) error {
    for _, prefix := range allowed {
        if strings.HasPrefix(path, prefix) {
           

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/135) · 2026-04-09 · closed · 1 comment

### feat(tools): support config_file path in talos_apply_config to reduce token usage

## Problem or use case

`talos_apply_config` accepts the full machine config as an inline YAML/JSON string in the `config` parameter. A typical Talos machine config is 5,000–15,000+ tokens. When the AI agent passes this inline:

1. **The config consumes tokens twice** — once in the tool call arguments (agent output), once echoed back in the tool result context. For a 10K-token config this adds ~20K tokens per invocation.
2. **Dry-run + apply doubles the cost** — the recommended workflow calls th

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/133) · 2026-04-09 · closed · 0 comments

### feat(tools): add talos_etcd_snapshot_restore tool for disaster recovery

## Problem or use case

When a Talos cluster loses etcd quorum permanently (e.g. due to multiple simultaneous node failures or unrecoverable data corruption), the only recovery path is to restore from an etcd snapshot. The talos-mcp-server already exposes `talos_etcd_snapshot` to create backups, but there is no counterpart tool to restore them.

Without a restore tool, AI agents cannot complete the disaster recovery workflow autonomously — they must hand off to a human operator who runs `talosct

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/132) · 2026-04-09 · open · 1 comment

### design(safety): require preview token and fresh-state revalidation for talos_patch_config apply

## Problem

`talos_patch_config` already has or is gaining several important safety controls: `dry_run=true` by default, an explicit `confirm=true` guard from #37, blocked-path hardening in #80, and race-condition discussion in #71. Those controls are useful, but they still leave one production-readiness gap: there is no explicit reviewed plan token and no fresh-state refusal between preview and apply.

Today the operator can inspect a dry-run result and then send a second mutating request with 

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/127) · 2026-04-09 · open · 1 comment

### chore(tools): consolidate environment variable reading into startup config

## Description

`os.Getenv` calls are scattered across 4 files, with some read at startup and others in hot paths on every request. This makes the configuration surface implicit and harder to test.

## Evidence

| Variable | File | When read |
|---|---|---|
| `TALOSCONFIG` | `internal/talos/client.go:29` | Client init (once) |
| `TALOS_CONTEXT` | `internal/talos/client.go:41` | Client init (once) |
| `TALOS_ENDPOINTS` | `internal/talos/client.go:45` | Client init (once) |
| `TALOS_MCP_READ_ONLY`

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/82) · 2026-04-08 · closed · 1 comment

### chore(transport): log warning when DisableLocalhostProtection is active

## Description

`DisableLocalhostProtection` is set to `true` in the HTTP transport configuration, disabling the MCP SDK's built-in DNS rebinding guard. This is a necessary configuration (the server relies on a reverse proxy for origin validation), but there is no runtime warning logged at startup.

## Evidence

`cmd/talos-mcp/main.go:296`:

```go
DisableLocalhostProtection: true,
```

No log line warns about this setting. An operator deploying without a properly configured reverse proxy would b

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/81) · 2026-04-08 · closed · 0 comments

### feat(safety): add optional blocklist for critical config paths in talos_patch_config

### Severity

P2 — moderate

### Category

security, safety

### Description

`talos_patch_config` accepts arbitrary JSON/YAML patches that can modify any part of the Talos machine configuration. Even with the `confirm` guard proposed in #37, a compromised or misbehaving MCP client can patch critical security-relevant paths.

### Evidence

`internal/tools/lifecycle.go:245–355` — the patch is applied without inspecting which config paths are modified. Critical paths that can be abused:

| Config 

[Read the thread](https://github.com/Nosmoht/talos-mcp-server/issues/80) · 2026-04-08 · closed · 1 comment

The remaining reports are on [the project's issue tracker](https://github.com/Nosmoht/talos-mcp-server/issues).