# Reported issues for Trackly CLI

Pod holds 7 of 7 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Trackly CLI](/mcp/trackly-cli).

## Most discussed

### [Analytics CLI-1] Forward MCP client name attribution

Part of https://github.com/trackly-app/close-ai/issues/1378

## Goal

Forward bounded MCP client identity to the backend analytics envelope.

## Scope

- Capture an approved client_name from the MCP host/CLI boundary.
- Forward it only on authenticated API calls governed by CA-4.
- Avoid commands, arguments, prompts, and user content in analytics.

## Acceptance criteria

- [ ] Known clients map deterministically; unknown values normalize safely.
- [ ] CLI, MCP, and mcp-hosted channels remain di

[Read the thread](https://github.com/trackly-app/trackly-cli/issues/101) · 2026-08-06 · open · 1 comment

### Trackly Apply: verify clean public 0.8.1 installation

## What to build

Verify the public Trackly Apply `0.8.1` / skill `4.2.1` distribution exactly as a new macOS user receives it after trackly-cli PR #80 lands.

This is an end-to-end release proof: npm and MCP Registry provenance, clean Codex/Claude installation, doctor compatibility, authenticated profile/resume readiness, and a non-submitting application smoke test against the production backend.

## Acceptance criteria

- [ ] `trackly-cli@0.8.1` is available from npm with SLSA provenance.
- [ 

[Read the thread](https://github.com/trackly-app/trackly-cli/issues/81) · 2026-07-25 · closed · 1 comment

### MCP profile updates should require explicit confirmation for sensitive-storage revocation

Archived from Conductor workspace TracklyApp/yangon, .context/ce-code-review-pr-207.md residual follow-up.

Context:
- iOS fixed the application-profile editor so destructive or backend-sensitive profile confirmations cannot be implied accidentally.
- The shared MCP workflow still needs a parity check before destructive sensitive-storage revocation or confirmation-like profile changes.
- This likely spans local trackly-cli MCP schemas/instructions and hosted MCP parity in close-ai; coordinate wi

[Read the thread](https://github.com/trackly-app/trackly-cli/issues/74) · 2026-07-18 · closed · 1 comment

### Security: hono transitive vuln not patched for published-package consumers (overrides don't publish)

## Problem

PR #51 added `overrides: { "hono": "^4.12.25" }` to fix the high-severity hono advisory (GHSA-xrhx-7g5j-rcj5 IP-restriction bypass + GHSA-3hrh-pfw6-9m5x cookie injection). This fixes the **repo/CI** install and the required `npm audit` check.

**But `overrides` is NOT published** (Codex P2 on PR #51): npm only applies `overrides` from the *root* project, and `package-lock.json` isn't in the published tarball. So consumers running `npx trackly` / installing `trackly-cli` as a dependen

[Read the thread](https://github.com/trackly-app/trackly-cli/issues/52) · 2026-06-20 · closed · 1 comment

### Verify Trackly Agent Plugin marketplace approval and fresh Codex install

## Why

The Trackly Agent Plugin marketplace package was still under external OpenAI review when the compatible-client launch work closed. The website correctly presents it as in review, but the approval and fresh-install verification must remain visible after the Conductor workspace is archived.

## Trigger

When OpenAI approves or otherwise updates the marketplace submission.

## Safe follow-up

- Confirm the directory state is `available` before changing public copy.
- From a fresh Codex/Chat

[Read the thread](https://github.com/trackly-app/trackly-cli/issues/117) · 2026-08-21 · open · 0 comments

### Harden MCP_SCOPE_DEFINITIONS with exhaustive reference inventory

## Context

The exact hosted contract verifier locks the `MCP_SCOPE_DEFINITIONS` initializer, derived supported-scope structures, function ASTs, whole-source digest, and merge provenance. It does not independently inventory every reference to `MCP_SCOPE_DEFINITIONS`.

This was explicitly dispositioned as non-blocking defense in depth during PR #102 and remains non-blocking after PR #106. Current shipped behavior and the OpenAI submission are not defective.

## Trigger

Address during the next de

[Read the thread](https://github.com/trackly-app/trackly-cli/issues/108) · 2026-08-12 · open · 0 comments

### Harden `trackly mcp` graceful shutdown (SIGTERM / stdin-close / EPIPE)

## Context

`trackly mcp` is a long-lived process that talks to an AI client (Claude Code, Cursor, ChatGPT) over stdin/stdout. Its entire lifecycle handling today is (`mcp/server.js:321`):

```js
async function startMcpServer() {
  const server = createServer();
  const transport = new StdioServerTransport();
  await server.connect(transport);   // connects, then just runs
  return server;
}
```

There is **no explicit handling for the parent client going away** — no `SIGTERM` handler, no `stdin

[Read the thread](https://github.com/trackly-app/trackly-cli/issues/48) · 2026-06-14 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/trackly-app/trackly-cli/issues).