Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/vouch-mcp/issues.md or /mcp/vouch-mcp/issues.json, or Pod over MCP.

Reported issues for vouch-mcp

Pod holds 8 of 8 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to vouch-mcp.

Most discussed

Add a TypeScript example mirroring the FastAPI credential gate

Mirror the Python credential-gate example in the TypeScript SDK so both ecosystems have parity: a small server endpoint that reads a Vouch-Credential header and verifies it.

Acceptance: a signed request verifies and an unsigned one is rejected. File: packages/sdk-ts/ Size: M

Read the thread · 2026-06-18 · open · 2 comments

Bind intent.resource to the endpoint in the FastAPI credential gate

Currently the gate verifies a credential is authentic and unexpired, but it does not check that the credential's intent.resource matches the protected endpoint. Add that audience binding so a credential minted for a different resource is rejected.

This is a natural step up from the credential-gate example (a good second contribution).

Acceptance: a credential whose intent.resource does not match the endpoint is rejected (403); a matching one passes. File: `examples/fastapi_credenti

Read the thread · 2026-06-18 · closed · 1 comment

Add a minimal FastAPI example that rejects unsigned agent requests

In examples/, add a ~30-line FastAPI app with one endpoint that reads a Vouch-Credential header, verifies it with Verifier.verify_credential(...), and returns 401 when the header is missing or invalid.

Reference: vouch/verifier.py.

Acceptance: uvicorn runs it; a signed request passes, an unsigned one returns 401.

Read the thread · 2026-06-17 · closed · 1 comment

Event-triggered intent recheck: bind intent-seal freshness to the action, not the interval

The Heartbeat Protocol proves an agent is still alive across an interval. It does not prove the agent still means to do what it is about to do at the moment of a specific action. Today a justification sealed early in an interval still passes for an action executed much later in the same interval. A sophisticated actor who knows the pulse interval can time a sensitive action to land in the gap between two heartbeats, riding on an intent that was locked in earlier while nothing is re-verified.

Th

Read the thread · 2026-08-01 · closed · 0 comments

Add a "verify a credential from the CLI" quickstart doc

Add a short walkthrough showing how to mint a credential and verify it using the CLI, end to end, for newcomers.

Acceptance: a newcomer can follow it to verify a credential start to finish. File: docs/ or examples/ Size: S

Read the thread · 2026-06-18 · open · 0 comments

Add a CLI help smoke test

Add a test asserting that vouch --help and vouch init --help exit 0 and list the expected subcommands. Cheap regression coverage for the CLI surface.

Acceptance: the new test passes in CI. File: vouch/cli.py, tests/ Size: S

Read the thread · 2026-06-18 · closed · 0 comments

Port validator quorum to TypeScript

Port the validator quorum runtime module (vouch/quorum.py) to TypeScript, under packages/sdk-ts/.

It is an M-of-N validator quorum decision. The Python module is the source of truth, and the data formats are already cross-language.

Acceptance:

Read the thread · 2026-06-17 · open · 0 comments

Add a runnable tamper-detection demo

In examples/, add a script that signs a credential, mutates one field, and shows that verification now fails, printing a clear before/after.

Acceptance: the script runs and demonstrates the rejection.

Read the thread · 2026-06-17 · open · 0 comments

Most recent

The remaining reports are on the project's issue tracker.