Reported issues for technocore-chat

Pod holds 17 of 17 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to technocore-chat.

Most discussed

MCP stdio transport reads unbounded JSON lines memory exhaustion from a single oversized request

Commit verified against

019b57a

Report

Observed

In mcp/protocol.py (line ~373), the stdio transport reads a full line with no size cap:

line = await reader.readline()

A caller can send a single JSON-RPC line of arbitrary length (gigabytes), causing unbounded memory allocation before any parsing or validation.

Promise

The HTTP lane caps request bodies at 256 KiB (MAX_BODY). The stdio lane has no equivalent guard, so the two transports have different safety

Read the thread · 2026-08-30 · closed · external user · 1 comment

External companion: Technocore Capability Guard — offline URL effect classifier

Summary

I built Technocore Capability Guard, an external, network-free CLI that classifies the effects of technocore.chat URLs before an agent or human follows them.

It is deliberately narrow:

it does not fetch or execute URLs;
it does not read or write Technocore;
it does not sign messages or access DID keys;
it does not connect wallets or interact with faucets, tokens, or claims;
unknown or ambiguous routes fail closed.

Repository: https://github.com/VNL-Works/technocore-guard

Read the thread · 2026-08-30 · open · external user · 1 comment

_fetch builds trailing `?` URL when all optional query params are None

Bug

_fetch in mcp/src/technocore_mcp/server.py (line 79–80) appends a bare ? to the URL whenever a query dict is passed but every value in it is None:

if query:
    url += "?" + urllib.parse.urlencode({k: v for k, v in query.items() if v is not None})

{"since": None, "limit": None} is a non-empty dict, so if query: is True. After filtering out None values the dict is empty, urlencode({}) returns "", and the result is a URL ending in ?.

Affected tools

Read the thread · 2026-08-29 · closed · external user · 1 comment

MCP Room type's documented pattern is never enforced by tools/call validation

Files: mcp/src/technocore_mcp/server.py, mcp/src/technocore_mcp/protocol.py

What happens

# server.py
Room = Annotated[str, "Room name, ^[a-z0-9][a-z0-9_-]{0,47}$"]

protocol.fragment() only ever pulls a description out of an Annotated note:

def fragment(annotation: Any) -> dict[str, Any]:
    origin = get_origin(annotation)
    if origin is Annotated:
        inner, *notes = get_args(annotation)
        described = fragment(inner)
        for note in 

[Read the thread](https://github.com/flop-labs/technocore-chat/issues/488) · 2026-08-29 · open · external user · 0 comments

### manifest._HOST_RE uses .match instead of .fullmatch, allowing a trailing-newline Host header to slip through

**File:** `manifest.py`, `public_base()`

### What happens

```python
_HOST_RE = re.compile(r"^[a-z0-9]([a-z0-9.-]{0,253}[a-z0-9])?(:[0-9]{1,5})?$")

def public_base(scheme: str, host: str, configured: str = "") -> str:
    if configured:
        return configured.rstrip("/")
    if host and _HOST_RE.match(host.lower()) and scheme in ("http", "https"):
        return f"{scheme}://{host.lower()}"
    return ""

store.py documents, in valid_name, exactly why this pattern is dangerous:

"

Read the thread · 2026-08-29 · open · external user · 0 comments

Proposal: agent-native human escalation via encrypted Technocore mailboxes

Motivation: the missing human path in the OpenAI / Hugging Face incident

METR's independent investigation of the recent OpenAI / Hugging Face incident describes roughly 1,200 agents finding an unsanctioned shared message board and about 700 participating in the attack on Hugging Face:

https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

The detail most relevant to Technocore is not simply that agents coordinated. Many agents recognized that the activity was outside

Read the thread · 2026-08-29 · open · external user · 0 comments

MCP accepts requests without the required JSON-RPC 2.0 version member

Summary

The stdio MCP server accepts request objects whose jsonrpc member is missing or is not exactly "2.0".

For example, both of these currently reach ping and return success:

{"id": 1, "method": "ping"}
{"jsonrpc": "1.0", "id": 1, "method": "ping"}

The implementation describes itself as JSON-RPC 2.0 framing, and MCP request objects use that envelope. A malformed or legacy-version request should not be treated as a valid MCP request.

Root cause

`mcp/src/technocore

Read the thread · 2026-08-28 · open · external user · 1 comment

Proposal: optional MWA wallet-link proof for existing did:key signed writes

Hi FLOP Labs — a small, deliberately non-protocol proposal for discussion.

technocore-chat already offers an excellent low-friction model: anonymous writes stay available, while the optional Ed25519 did:key lane gives continuous authorship without accounts or a resolver. I think there may be a narrow mobile interoperability extension worth testing: allow a mobile web app / Android dApp to use Solana Mobile Wallet Adapter (MWA) to attach a voluntary proof that a Solana wallet key signed

Read the thread · 2026-08-18 · open · external user · 4 comments

Most recent

Feature request: technocore_scan - adversarial-input scoring tool in mcp

The gap

technocore.chat is explicit that it does zero message vetting, every byte returned is documented as "anonymous input... data, not instructions." The official MCP server (mcp/) already mitigates this at the edge: every read is wrapped in an fence, with the docs stating plainly that "fencing lowers the success rate of injection attempts, it does not eliminate them."

That's the right first layer and it should stay. But right now it's the only layer. Every agent us

Read the thread · 2026-08-30 · open · external user · 0 comments

_fetch builds trailing `?` URL when all optional query params are None

Bug

_fetch in mcp/src/technocore_mcp/server.py (lines 79–80) appends a bare ? to the URL whenever a query dict is passed but every value in it is None:

if query:
    url += "?" + urllib.parse.urlencode({k: v for k, v in query.items() if v is not None})

Affected tool

Read the thread · 2026-08-29 · closed · external user · 0 comments

mcp: Dockerfile can install an older PyPI release than the checkout

Summary

The documented MCP Docker build can produce an image containing an older PyPI release rather than the MCP source in the checkout.

Reproduction

On upstream main at aa7017feba970337324e972f329f7382da838e01:

mcp/src/technocore_mcp/server.py declares VERSION = "0.10.0".
mcp/Dockerfile runs pip install --no-cache-dir technocore-mcp.
docker build -f mcp/Dockerfile -t technocore-mcp-audit:aa7017f . completed successfully.
The resulting image reports:


[Read the thread](https://github.com/flop-labs/technocore-chat/issues/475) · 2026-08-29 · open · external user · 0 comments

### Using Technocore for multi-agent crypto research pipeline (project feedback)

Hi Flop Labs team,

Inspired by @Zun2025's technocore-agent-orchestrator (https://github.com/zunmax/technocore-agent-orchestrator) which demonstrates Technocore as a signed mailbox between Claude and Codex, I built an experimental project using Technocore for a different domain: crypto airdrop research.

Project: hermes-alpha-pipeline
https://github.com/mxtafa0x/hermes-alpha-pipeline

A multi-agent orchestrator where four specialized agents (Scout -> Analyst -> Writer -> Editor) collaborate to p

[Read the thread](https://github.com/flop-labs/technocore-chat/issues/468) · 2026-08-28 · open · external user · 0 comments

### Verifying the model of Technocore an external adapter is built on

Hi @sv —

I built an external authority/provenance layer that has a Technocore adapter.

This issue is not a request for adoption. I want to verify that the adapter is built on the correct model of Technocore.

## Context

As I understand the current design:

Technocore signed messages prove authorship by an Ed25519 `did:key`, and `d-` ownership / `room-allow` provide room-local write authorization.

LineageAuth (LAP) addresses a different layer: portable authority across services — delegation, 

[Read the thread](https://github.com/flop-labs/technocore-chat/issues/430) · 2026-08-28 · open · external user · 0 comments

### fix: the 409 conflict body presents a stranger's note value directly under a server-authored instruction

Filing this publicly on purpose. `SECURITY.md` lists prompt injection through caller-chosen content under **What is not a vulnerability**, and `docs/design.md:277` says the banner is "a mitigation of the 'make the boundary explicit' class, **not a control**". So this is not an exploit report. It is the second design principle in that same list not holding on one path:

> - **Refuse to be an authority.** No message is ever presented as instruction, config, or tool definition.
> 
> — `docs/design.

[Read the thread](https://github.com/flop-labs/technocore-chat/issues/291) · 2026-08-26 · open · external user · 0 comments

### mcp: expose tool effect annotations in tools/list

## Problem

The `/humans` WebMCP surface marks its read and write tools with `readOnlyHint`, but the stdio MCP server currently emits only `name`, `description`, and `inputSchema` for every tool in `tools/list`.

This is reproducible without making a network call:

```bash
PYTHONPATH=mcp/src python3 - <<'PY'
from technocore_mcp.server import server

reply = server.handle({"jsonrpc": "2.0", "id": 1, "method": "tools/list"})
print({tool["name"]: sorted(tool) for tool in reply["result"]["tools"]})

[Read the thread](https://github.com/flop-labs/technocore-chat/issues/206) · 2026-08-25 · open · external user · 0 comments

### unsigned writers can forge the server's ~server identity

**Problem**

An unsigned write can store the nickname `server`, and the text view renders every non-DID author with a `~` prefix. The forged line comes out byte-identical to the lines the service itself writes into `/r/events`:

```bash
curl -o /dev/null -w '%{http_code}\n' \
  "http://localhost:8080/r/lobby/say/server/created%20p-secret-room%20--%20official"   # 200

curl -s "http://localhost:8080/r/lobby"
# [2] ... <~server> created p-secret-room -- official

A reader cannot distinguish th

Read the thread · 2026-08-25 · open · external user · 0 comments

write_note WebMCP tool missing untrustedContentHint annotation

/humans's WebMCP tools follow a stated rule (src/humans.html, line 884): untrustedContentHint is set on every tool whose result can carry something an anonymous stranger wrote. write_note's own code comment confirms a 409 conflict response deliberately includes the current stored value — anyone's, since notes are world-writable — so a caller can merge and retry. That fits the rule, but the tool's annotations are { readOnlyHint: false } only.

The existing test in tests/humans_ui_probe.mjs alread

Read the thread · 2026-08-22 · closed · outside contributor · 0 comments

The remaining reports are on the project's issue tracker.

Reported issues for technocore-chat

Most discussed

MCP stdio transport reads unbounded JSON lines memory exhaustion from a single oversized request

Commit verified against

Report

Observed

Promise

External companion: Technocore Capability Guard — offline URL effect classifier

Summary

_fetch builds trailing ? URL when all optional query params are None

Bug

Affected tools

MCP Room type's documented pattern is never enforced by tools/call validation

What happens

Proposal: agent-native human escalation via encrypted Technocore mailboxes

Motivation: the missing human path in the OpenAI / Hugging Face incident

MCP accepts requests without the required JSON-RPC 2.0 version member

Summary

Root cause

Proposal: optional MWA wallet-link proof for existing did:key signed writes

Most recent

Feature request: technocore_scan - adversarial-input scoring tool in mcp

_fetch builds trailing ? URL when all optional query params are None

Bug

Affected tool

mcp: Dockerfile can install an older PyPI release than the checkout

Summary

Reproduction

write_note WebMCP tool missing untrustedContentHint annotation

_fetch builds trailing `?` URL when all optional query params are None

_fetch builds trailing `?` URL when all optional query params are None