# Reported issues for Trentina

Pod holds 17 of 27 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Trentina](/mcp/trentina).

## Most discussed

### Improve SSE and keepalive connection resilience to prevent client disconnects

### Description
When the Trentina MCP server experiences transient network drops, restarts, or upstream connection lags, the client-side gateway can easily exhaust its application-level reconnection budget (e.g., 5 attempts) and permanently transition to a `"not connected"` state. 

To prevent these permanent disconnects and make the integration robust and self-healing, we should implement standard protocol-level resilience patterns directly inside `mcp-trentina`.

---

### Proposed Improvements

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/51) · 2026-07-02 · closed · 2 comments

### Rename MCP-Airlock to Trentina

## The Story

In 1377, the city of Ragusa (near modern-day Dubrovnik on the Dalmatian coast) faced a crisis. They had built an innovative open shipping system where anyone could dock and trade — progressive for the 1300s. Then the plague arrived, and they had to reinvent the system without abandoning it.

Their solution was brilliant: keep visitors on abandoned islands for 30 days before allowing them into the city. They called this **trentina** (from *trenta*, Italian for thirty). Later, they e

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/19) · 2026-06-23 · closed · 2 comments

### chore: one-time full-codebase Gatehouse sweep to clear legacy debt

## Problem

Gatehouse runs on every PR via the `/feature` workflow, but it only reviews the diff — not the full codebase. Code written before Gatehouse was part of the workflow has never been reviewed. This creates a false sense of coverage: recent PRs are clean, but legacy code may have unaddressed security, test coverage, or architecture findings.

Example: `repr(block)[:200]` in `backend.py` was introduced in the rename commit (d20b7e4, June 23) and persisted through 8 subsequent PRs until ca

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/47) · 2026-06-30 · closed · 1 comment

### Test Trentina against OpenClaw attack vectors (Imperva, Varonis, InfoSec Write-ups)

## Context

Three independent security research teams published attacks against OpenClaw AI agents in June 2026. We need to determine which of these attack vectors Trentina can resist, which it can't, and where we have gaps.

Source: https://thehackernews.com/2026/06/new-attacks-trick-openclaw-ai-agent.html

## Attack Vectors to Test

### 1. Prompt Injection via Message Objects (Imperva)
**Researcher:** Yohann Sillam
**Paper:** https://www.imperva.com/blog/compromise-openclaw-with-prompt-injecti

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/29) · 2026-06-23 · open · 1 comment

### Extend module shadow scanner to cover common language ecosystems

## Context

The `quarantine_scan_dir` tool and `sanitize/shadows.py` currently detect Python stdlib module shadowing (e.g. `struct.py` replacing Python's real `struct` module). This was built in response to wunderwuzzi's Claude Code Opus 5 bypass (Aug 2026).

However, module shadowing / auto-execute file attacks exist across many ecosystems. The scanner should cover the 80% most common vectors without needing per-language regex — detect files that language runtimes and build tools will automatic

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/76) · 2026-08-30 · open · 0 comments

### Alert ingress: add per-host correlation window to batch concurrent alerts

When multiple services on the same host go critical simultaneously (reboot, cascade), Nagios fires one notification per service. Trentina forwards each immediately to Kagetora, which spawns a separate agent per alert. Multiple agents then independently restart services on the same host, causing flapping.

Trentina's alert ingress endpoint should hold incoming alerts for a short window (30-60s), group them by host, and forward one consolidated payload per host to Hermes. This keeps the fix in the

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/74) · 2026-08-24 · open · 0 comments

### Suppress uvicorn access log and httpx request logging in production

## Problem

mcp-trentina generates ~14,000 journal lines/hour, mostly from:
1. Uvicorn access logs (`INFO: 10.89.10.10:... - "POST /gateway/..." 200 OK`)
2. httpx request logs (`INFO httpx: HTTP Request: GET https://matrix-client.matrix.org/...`)

`TRENTINA_LOG_LEVEL=WARNING` only sets the root Python logger; uvicorn overrides it with its own `logging.config.dictConfig()` during startup.

## Proposed Fix

Pass `log_level="warning"` to the uvicorn run config in `mcp.run()`, or explicitly set uvic

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/73) · 2026-08-24 · closed · 0 comments

### Add tool to reconnect individual MCP backends without full gateway restart

## Problem

When a backend MCP server (e.g. Postiz) is restarted, trentina's MCP transport session to that backend becomes stale. The `cache_flush_tool` clears tool-list caches and circuit breakers, but does **not** re-establish the underlying streamable-HTTP MCP connection. The only recovery is restarting the entire trentina gateway, which disrupts all backends.

## Observed behavior

1. Postiz container restarted → new container ID, new process
2. Trentina circuit breaker tripped from connecti

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/55) · 2026-07-04 · closed · 0 comments

## Most recent

### LLM proxy: support per-client API key pass-through

## Problem

Kagetora and Trentina's Q-Agent share a single Gemini API key, which means all LLM traffic from both consumers stacks against the same rate limit (3M input tokens/minute on paid tier 2).

Kagetora has ~520 MCP tools, so each agentic turn sends ~100k+ input tokens. That gives roughly 30 calls/minute before hitting quota. When Trentina's Q-Agent (quarantine, search, content extraction) fires concurrently, the limit is exceeded and Kagetora gets HTTP 429s:

```
HTTP 429: quota exceeded 

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/53) · 2026-07-03 · closed · 0 comments

### feat(gateway): upgrade to Streamable HTTP transport with session persistence

## Problem

Trentina's gateway is stateless per-call (`POST /gateway/{profile}/mcp`). It cannot push server-initiated MCP notifications because there is no persistent session with consuming agents. When a circuit breaker opens or closes, agents hold stale tool lists and either get "circuit open" errors or never discover recovered backends.

## Solution

Upgrade the gateway from stateless POST-only HTTP to the MCP **Streamable HTTP** transport (spec 2025-03-26):

1. **POST responses can be SSE st

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/49) · 2026-07-02 · closed · 0 comments

### feat: emit listChanged notification when circuit breaker opens/closes

## Problem

When a backend's circuit breaker opens (backend down) or closes (backend recovered), connected agents hold a stale tool list. MCP supports notifications/tools/listChanged — if Trentina emits this when a circuit state changes, agents would re-request tools/list and get an accurate view.

## Current behavior

- Circuit opens → agent still thinks backend's tools exist → calls fail with "circuit open" error
- Circuit closes → agent doesn't know tools are back → never calls them until rec

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/44) · 2026-06-29 · closed · 0 comments

### feat: provider benchmark harness — compare injection detection across LLM providers

## Overview

Build a benchmark harness that runs Trentina's adversarial test corpus through quarantine_detect() with each configured provider (Gemini, OpenAI, Anthropic, Ollama) and produces a comparative results table.

## What to measure per provider

- Detection rate by attack category (10 categories from test_adversarial.py)
- False positive rate on benign content
- Risk level accuracy (does it calibrate severity correctly?)
- Latency per detection call
- Token cost per detection

## Test co

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/43) · 2026-06-29 · closed · 0 comments

### feat: automatic provider fallback chain

## Problem

If the configured LLM provider has an outage, hits rate limits, or returns errors, the Q-Agent (L3) and compression both fail. Currently L3 is silently skipped (fallback to L1-only), degrading the defense pipeline without attempting an alternative provider.

## Proposed Solution

Add a fallback chain so that if the primary provider fails, Trentina tries the next provider before giving up.

### Configuration

```yaml
defense:
  provider: gemini
  provider_fallback:
    - openai
    - 

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/42) · 2026-06-29 · open · 0 comments

### feat: per-profile LLM provider selection

## Problem

`TRENTINA_MODEL_PROVIDER` is a global env var — every profile uses the same provider. Different agents have different cost/quality tradeoffs: a human-supervised agent (josui) can afford a more expensive provider for better detection, while an autonomous agent (kagetora) might need the cheapest option.

## Proposed Solution

Add an optional `provider` field to the profile's `defense` config in `profiles.yaml`:

```yaml
profiles:
  josui:
    defense:
      provider: anthropic    # ove

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/41) · 2026-06-29 · closed · 0 comments

### Gateway tools/list hangs when a backend is unreachable

## Problem

When any backend configured in a profile is unreachable (container down, network issue, DNS failure), the gateway's `tools/list` response hangs until the backend timeout expires. This blocks the **entire** tool listing for the profile — all backends, not just the failed one.

In practice, this means a single dead backend (e.g. `rotv`) makes the whole trentina gateway unusable for every client connecting to that profile. Claude Code's MCP connection times out before the gateway ever r

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/36) · 2026-06-27 · closed · 0 comments

### Fix all Gourmand and Gatehouse quality gate violations

## Context

PR #33 (LLM provider proxy + Matrix reverse proxy) shipped with pre-existing and new quality gate violations. The constitution (Section V) requires all five gates to pass: Lint → Type Check → Tests → Gourmand → Container Build. Gates 2 (mypy) and 4 (Gourmand) are currently failing.

## Gatehouse Findings (5 remaining from PR #33 review)

- **MEDIUM**: `request.body()` buffers entire request body in `llm_proxy.py` and `matrix_proxy.py` — switch to `request.stream()` for streaming requ

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/34) · 2026-06-24 · closed · 0 comments

### fix(gateway): pre-compression startup integration broken

## Problem

The description compression feature (#21) works at the data layer — cache lookups, SQLite persistence, Gemini API calls, and the router integration all function correctly (proven with 77% savings on 28 tools in testing). But the **startup integration** that triggers pre-compression when the server boots has three unresolved issues:

### 1. FastMCP doesn't expose `.settings.lifespan` (PR #28)
Attempted to use Starlette's ASGI lifespan to schedule compression as a background task on th

[Read the thread](https://github.com/crunchtools/mcp-trentina/issues/31) · 2026-06-23 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/crunchtools/mcp-trentina/issues).