Issues
Volume
Open Issues
↑
32.94%113
Opened
—5
last 7 days
Opened
—56
last 30 days
Opened
—113
last 90 days
Closed
—8
last 7 days
Closed
—90
last 30 days
Closed
—123
last 90 days
Response Time
Time to first maintainer response
Average
—64d
Median
↓
24.52%4d
P90
—253d
P95
—325d
Stale Issues
Issues with no activity
Stale
—48
>30 days
Stale
—45
>60 days
Stale
—38
>90 days
Reopen Rate
—94%
Issues by Label
| Label | Count |
|---|---|
| tracking | 47 |
| documentation | 37 |
| rc-high-priority | 29 |
| enhancement | 28 |
| bug | 19 |
| implementation-needed | 19 |
| auth | 6 |
| security | 5 |
| SEP | 3 |
| draft | 2 |
| SEP-requested | 1 |
| governance | 1 |
| proposal | 1 |
| schema | 1 |
| sdk/2026-07-feedback | 1 |
| spec | 1 |
Issues Awaiting Maintainer Response
Sorted by longest wait time first
| Issue | Title | Labels | Comments | Waiting |
|---|---|---|---|---|
| #569 | Unspecified error handling for tool calls with output schema | enhancement | 2 | 418d |
| #910 | Specification should be more prescriptive about client/host/LLM behavior | enhancement | 0 | 376d |
| #1281 | Versioning challenges with spec negotiation – client/server compatibility & rollout concerns | enhancement | 5 | 348d |
| #1341 | Obligatory MCP state transitions | (unlabeled) | 2 | 335d |
| #1400 | SEP-1400: Semantic Versioning for MCP Specification | enhancementSEP+1 | 13 | 320d |
| #1416 | Bug(Schema): Linting issues found using the @sourcemeta/jsonschema cli | bug | 0 | 316d |
| #2452 | Tasks SEP-1686: In-progress results | bug | 1 | 113d |
| #2470 | Proposal: Capability-Aware Tool Presentation for Heterogeneous Model Sizes | (unlabeled) | 4 | 111d |
| #2600 | Schema generation pipeline may produce overly permissive schemas without safeguards | bug | 1 | 88d |
| #2721 | Clarify behavior when `initialize.params.protocolVersion` conflicts with `MCP-Protocol-Version` | bug | 0 | 63d |
| #2734 | No visibility of errors from tool call responses | bug | 8 | 59d |
| #2920 | MRTR url-mode: standardize the "still waiting" response (state-only InputRequiredResult) + retry/cancel guidance | (unlabeled) | 0 | 29d |
| #2919 | MRTR: `inputRequests` is a closed enum of three methods — add an extensible / reverse-DNS-namespaced member type | (unlabeled) | 0 | 29d |
| #2939 | SEP-2549: clarify whether cacheScope is required or defaults to public | bug | 0 | 27d |
| #2966 | Gap in "The Complete Flow" documentation on /docs/learn/server-concepts | bug | 0 | 22d |
| #2982 | feat: provide a machine-readable MCP conformance runner interface | (unlabeled) | 1 | 17d |
| #2991 | SEP-2243 still references pre-renumber HeaderMismatch error code -32001 | bug | 0 | 15d |
| #2989 | subscriptions/listen response: no dedicated *ResultResponse envelope, and SubscriptionsListenResultMeta suffix | (unlabeled) | 0 | 15d |
| #3003 | [Spec Gap] Tool Execution Errors lack a schema-governed signal for LLM forwarding — structuredContent should be defined for error path | bug | 3 | 12d |
| #3028 | docs: cover multiple authorization servers, credential binding, and `application_type` in the authorization guide | documentationrc-high-priority+1 | 0 | 7d |
| #3027 | docs: document RFC 9207 `iss` validation for authorization responses | documentationrc-high-priority+1 | 0 | 7d |
| #3026 | docs: reflect RFC 9728 protected-resource metadata discovery in the authorization guide | documentationrc-high-priority+1 | 0 | 7d |
| #3051 | docs: update or freeze SEP-1686 tasks code examples for the v2 SDK | documentationrc-high-priority+1 | 0 | 7d |
| #3050 | docs: update OAuth client credentials extension examples to v2 SDKs | documentationrc-high-priority+1 | 0 | 7d |
| #3049 | docs: update MCP Apps build guide examples to the v2 TypeScript SDK | documentationrc-high-priority+1 | 0 | 7d |
| #3048 | docs: update authorization tutorial code examples to v2 SDKs | documentationrc-high-priority+1 | 0 | 7d |
| #3047 | docs: update build-server examples to v2 SDKs | documentationrc-high-priority+1 | 0 | 7d |
| #3046 | docs: update build-client examples to v2 SDKs | documentationrc-high-priority+1 | 0 | 7d |
| #3045 | docs: note HTTP+SSE transport deprecation per the feature lifecycle policy | documentationrc-high-priority+1 | 0 | 7d |
| #3044 | docs: document CacheableResult `ttlMs` and `cacheScope` fields | documentationrc-high-priority+1 | 0 | 7d |
| #3043 | docs: update extension capability phrasing to per-request `_meta` and `server/discover` | documentationrc-high-priority+1 | 0 | 7d |
| #3042 | docs: rewrite server-initiated request flows for Multi Round-Trip Requests (MRTR) | documentationrc-high-priority+1 | 0 | 7d |
| #3041 | docs: replace `resources/subscribe` and GET-stream guidance with `subscriptions/listen` | documentationrc-high-priority+1 | 0 | 7d |
| #3040 | docs: document the new mandatory `server/discover` RPC | documentationrc-high-priority+1 | 0 | 7d |
| #3039 | docs: reflect the stateless protocol and removal of the initialize handshake | documentationrc-high-priority+1 | 0 | 7d |
| #3038 | docs: update links to the relocated Security Best Practices page | documentationrc-high-priority+1 | 0 | 7d |
| #3037 | docs: describe stderr as the general logging channel for stdio servers | documentationrc-high-priority+1 | 0 | 7d |
| #3036 | docs: recategorize Tasks as a protocol extension | documentationrc-high-priority+1 | 0 | 7d |
| #3035 | docs: add OAuth Client ID Metadata Documents to client registration guidance | documentationrc-high-priority+1 | 0 | 7d |
| #3034 | docs: document incremental scope consent and step-up authorization | documentationrc-high-priority+1 | 0 | 7d |
| #3033 | docs: add deprecation callouts for Roots, Sampling, and Logging | documentationrc-high-priority+1 | 0 | 7d |
| #3032 | docs: reflect removal of `ping`, `logging/setLevel`, and `notifications/roots/list_changed` | documentationrc-high-priority+1 | 0 | 7d |
| #3031 | docs: reflect removal of protocol-level sessions and `Mcp-Session-Id` in debugging, security, and architecture guides | documentationrc-high-priority+1 | 0 | 7d |
| #3030 | docs: mention tool calling in sampling and retarget the sampling redirect | documentationrc-high-priority+1 | 0 | 7d |
| #3029 | docs: introduce URL mode elicitation in client concepts | documentationrc-high-priority+1 | 0 | 7d |
| #3054 | Reduce authorization spec verbiage by delegating to the OAuth RFCs it builds on | authspec+1 | 0 | 6d |
| #3091 | SEP-2575: error codes contradict the draft schema and conformance suite | bug | 0 | 1d |
| #3089 | Broken Link on SEP documentation page | bug | 1 | 1d |
Bugs ready
—bug + ready for work — triaged and reproducible.
Click to jump to the tier.
Red: any P0/P1
Yellow: > 10
Green: ≤ 10
106
13 P0/P1 · 81 fix proposed
Decisions pending
—enhancement + needs decision — say yes (→ ready/design) or no (→ close).
Click to jump to the tier.
68
3 at P1
Questions > 2d
—Questions past 2 business days with no maintainer response.
Click to jump to the tier.
Green: 0
Yellow: 1–4
Red: 5+
3
Close candidates
—potentially close + repro/confirm requests expired (>14d). Across all types.
54
median 240d old
P0 open
—All open P0 issues. SEP-1730: resolve within 7 days.
Green: 0
Yellow: any open
Red: any past 7d
3
3 past 7d SLA
P1 > 90d
—P1 issues open longer than 90 days.
Not in SEP-1730 — surfaces aspirational-P1 rot.
Green: 0
Yellow: 1–4
Red: 5+
11
Repro expired
—needs repro / needs confirmation requested >14d ago, no reporter reply. Auto-close candidates.
Green: 0
Yellow: 1–4
Red: 5+
10
Bot pending
—No type label yet — bot hasn't run, or needs manual triage.
Should be ~0 within 30min of any issue activity.
Green: 0
Yellow: 1–2
Red: 3+
21
Stats — volume, response time, staleness, labels
Volume
Open Issues
↑
1.67%244
Opened
—5
last 7 days
Opened
—16
last 30 days
Opened
—109
last 90 days
Closed
—2
last 7 days
Closed
—27
last 30 days
Closed
—40
last 90 days
Response Time
Time to first maintainer response
Average
—66d
Median
—20d
P90
—182d
P95
—223d
Stale Issues
Issues with no activity
Stale
↓
19.71%167
>30 days
Stale
—155
>60 days
Stale
—27
>90 days
Reopen Rate
—100%
Issues by Label
| Label | Count |
|---|---|
| bug | 133 |
| ready for work | 115 |
| P2 | 103 |
| enhancement | 96 |
| P3 | 82 |
| fix proposed | 81 |
| needs decision | 71 |
| potentially close | 47 |
| v2 | 44 |
| auth | 41 |
| P1 | 14 |
| needs confirmation | 13 |
| documentation | 12 |
| question | 12 |
| good first issue | 8 |
| help wanted | 7 |
| needs maintainer | 6 |
| needs repro | 5 |
| breaking change | 4 |
| pending SEP approval | 4 |
| P0 | 3 |
| improves spec compliance | 3 |
| needs design | 2 |
| v2-fixes | 2 |
Untriaged (21)
No type label — bot pending or needs manual triage.
untriaged (21) — Bot has not labeled yet, or needs manual type assignment.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1459 | pcarleton | _onclose() incomplete cleanup: _timeoutInfo not cleared and stale .finally() can delete new connection's abort controller | 1 | 1 | 162d | |
| #1565 | joy7758 | RC1 Review Request: AAR-MCP-2.0 Verifiable Interaction Layer (Conformance Gate included) | 1 | — | 144d | |
| #1859 | loaditoutadmin | Your MCP server earned an A security grade on Loaditout | — | — | 99d | |
| #1956 | sejano77 | SEP-1303: Input validation errors should return Tool Execution Errors, not Protocol Errors | 3 | 1 | 82d | |
| #1959 | apicurius | Bug: `_handleSseStream` retains reader lock on stream close, leaking ~50MB per reconnection | 2 | 1 | 81d | |
| #2018 | blackwell-systems | handleAutomaticTaskPolling ignores AbortSignal; cancelled requests poll indefinitely | 1 | 1 | 72d | |
| #2036 | irparent | Bump hono and fast-uri to versions covering published GHSA advisories | 3 | — | 67d | |
| #2042 | morozow | Security: Transitive dependencies with known vulnerabilities in @modelcontextprotocol/sdk@1.29.0 | 1 | 1 | 66d | |
| #2054 | khill1269 | `registerPrompt()` silently drops `icons` from PromptDefinition config | 1 | 1 | 64d | |
| #2078 | mcpsafe-gh | Security scan results for typescript-sdk — MCPSafe AIVSS 53/100 (Grade F) | 1 | — | 64d | |
| #2083 | swadel | Type inconsistency: StreamableHTTPServerTransport.onclose widens Transport interface contract under exactOptionalPropertyTypes | 2 | 1 | 63d | |
| #2093 | thkim-us | v2 alpha: @modelcontextprotocol/server has @cfworker/json-schema as optional peer but imports it unconditionally | 2 | 1 | 61d | |
| #2100 | daveCode-dot | Tool inputSchema generation emits $ref for reused Zod instances · breaks strict MCP clients (kimi) | 3 | — | 61d | |
| #2151 | fallintoplace | closeSSEStream() breaks request-scoped SSE resumability for terminal responses | 1 | 1 | 52d | |
| #2237 | dvaerum | [PLEASE DELETE] sorry | 1 | — | 44d | |
| #2257 | idobrovolski | KIMI mcp integration fix | 1 | 1 | 39d | |
| #2297 | connerlambden | Integration idea: BGPT evidence retrieval tool | — | — | 31d | |
| #2480 | SnowSky1 | Streamable HTTP server accepts invalid media types by Accept-header substring | — | — | 3d | |
| #2491 | zelinewang | [v2] Declaration source maps (.d.cts.map/.d.mts.map) reference unshipped src/ with empty sourcesContent — dangling for consumers | — | — | 2d | |
| #2489 | morluto | [v2] Origin and Host validators accept userinfo before allowlisted hostnames | — | — | 2d | |
| #2499 | ayush00git | Bug: Resumption token dropped when a resumed SSE stream disconnects before any id-bearing event | — | — | 1d |
Bugs (133)
Queue — pick the top fix-ready and work it. Priority then age.
in-progress (6) — Assigned — someone is on it.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #754 | boogie-amplitude | ProxyOAuthServerProvider fails with Zod validation error when using Ory Hydra as OAuth provider | bug P2 | 4 | 1 | 371d |
| #1149 | spacewander | output schema has unnecessary restriction type=object | bug P2 | 5 | 1 | 236d |
| #1186 | Miaoxingren | Zombie Task Collision in StreamableHTTPServerTransport | bug P2 | 3 | 1 | 229d |
| #1429 | aldipower | Do not return and expose internal errors to the client as this is a security risk | bug P2 | 3 | 1 | 168d |
| #1658 | arthurchan35 | StreamableHTTPServerTransport has no public API to reconstruct a session-aware transport from persisted session data | bug P2 | 4 | — | 126d |
| #911 | dsp-ant | Implement consistent structuredContent handling per specification clarification | bug P3 | — | — | 317d |
fix-proposed (78) — Bot posted a suggested fix — review the diff. P0/P1 first.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #209 | praboud-ant | /token endpoint should validate redirect_uri matches | bug P0 | 2 | 1 | 483d |
| #235 | jspahrsummers | Revoke tokens if authorization code presented a second time | bug P0 | 2 | 1 | 474d |
| #1562 | gogakoreli | schemaToJson() produces $ref in tool inputSchema, causing LLM failures | bug P0 | 3 | 1 | 145d |
| #971 | NorthIsUp | CommonJS export paths broken - missing index.js file in dist/cjs | bug P1 | 8 | 1 | 293d |
| #2002 | ElliotDrel | Bug: StdioServerTransport doesn't handle stdin close/end — causes zombie process accumulation | bug P1 | 4 | 1 | 76d |
| #2084 | rsalus | [SEP-1613 regression] tools/list still emits draft-07 in 1.29.0 — `target` option missing from mcp.js `toJsonSchemaCompat` calls | bug P1 | 3 | 1 | 62d |
| #2273 | itosa-kazu | Root package export points to missing dist index files | bug P1 | 2 | 1 | 36d |
| #147 | au-re | Additional parameters are not passed through to tools | bug P2 | 3 | 1 | 520d |
| #149 | disintegrator | Unordered and partial query parameter matching | bug P2 | 4 | 1 | 518d |
| #321 | nichtsam | SSEServerTransport doesn't seem to close properly | bug P2 | 9 | 1 | 459d |
| #392 | mhart | Promise/async handling causes unhandled rejections | bug P2 | 4 | 1 | 447d |
| #471 | tobegit3hub | MCP SDK Can not handle the MCP Servers with subpath | bug P2 | 9 | 1 | 432d |
| #470 | tobegit3hub | MCP SDK Path Handling Bug for Subpath Servers | bug P2 | 5 | 1 | 432d |
| #563 | joshcanhelp | Invalid JSON RPC requests do not respond with an error | bug P2 | 2 | 1 | 412d |
| #581 | ZachGerman | Enforcing Content-Type header on client requests | bug P2 | 1 | 1 | 408d |
| #650 | zackify | Dynamic Resources 404 when using nested paths | bug P2 | 2 | 1 | 393d |
| #677 | dudo | ResourceTemplate fails when user selects <Empty> for optional parameter | bug P2 | 4 | 1 | 390d |
| #759 | johnfriz | OAuth token exchange fails with URL-encoded responses - assumes JSON format only | bug P2 | 3 | 1 | 369d |
| #771 | alexhermida | Memory leak in StreamableHTTP and SSE | bug P2 | 3 | 1 | 364d |
| #776 | elvisjhonataoliveira | [BUG] Multi-Node Deployment with Persistent Storage Mode not working | bug P2 | 4 | 1 | 364d |
| #780 | shellRaining | onerror and other listener not remove after client close (stdio) | bug P2 | 4 | 1 | 362d |
| #811 | mahmoudmoravej | Cannot destructure property 'requestInfo' of 'undefined' as it is undefined. | bug P2 | 4 | 1 | 356d |
| #817 | nikhilmat | Package attaches process signal handlers | bug P2 | 1 | 1 | 352d |
| #842 | cameroncooke | Bulk tool registration causes EventEmitter memory leak warnings | bug P2 | 4 | 1 | 344d |
| #868 | shellRaining | When executing client.close(), onerror will be executed twice (Streamable HTTP) | bug P2 | 9 | 1 | 337d |
| #876 | Kelier | sse timeout set dont work & always close after 5mins | bug P2 | 5 | 1 | 335d |
| #893 | inverted-capital | McpServer re-registers capabilities after connect, blocking dynamic registration even when capabilities were supplied at construction | bug P2 | 3 | 1 | 328d |
| #941 | jeremyshi-ant | OAuth: scope parameter missing from token exchange requests | bug P2 | 1 | 1 | 305d |
| #943 | y0geshdev | The bug in InMemoryEventStore break SSE stream resumability | bug P2 | 4 | 1 | 303d |
| #998 | younaman | Bug Report: Initialize Request Cancellation Violation | bug P2 | 2 | 1 | 286d |
| #1001 | younaman | Bug Report-3: Missing Progress Monotonicity Validation Leading to Resource Exhaustion | bug P2 | 2 | 1 | 286d |
| #1004 | CahidArda | storeEvent in EventStore Receives Hardcoded `streamId` | bug P2 | 2 | 1 | 285d |
| #1079 | 4bd4ll4h | # MCP SDK ResourceTemplate URI Validation Issue: RFC 6570 Template Matching Behavior | bug P2 | 7 | 1 | 253d |
| #1167 | bmingles | Support `roots/list` request from server to client | bug P2 | 6 | 1 | 232d |
| #1234 | pcarleton | OAuth: Resource metadata URL lost after redirect, causing token exchange to fail | bug P2 | 2 | 1 | 223d |
| #1308 | joshjg | Tool output validation fails when outputSchema is a Zod schema other than ZodObject | bug P2 | 6 | 1 | 211d |
| #1385 | punkpeye | Task-augmented tool call errors are wrapped incorrectly, masking actual error messages | bug P2 | 4 | 1 | 182d |
| #1417 | severi | MCP servers deployed on AWS Lambda Function URLs stopped working after upgrading from v1.24.2 to v1.25.0+ | bug P2 | 5 | 1 | 175d |
| #1471 | mattzcarey | registerToolTask handlers receive wrong arguments when inputSchema is omitted | bug P2 | 1 | 1 | 162d |
| #1476 | Bacra | Client received "no session ID or not initialization request" when server restart | bug P2 | 2 | 1 | 161d |
| #1582 | asoorm | Scope overwrite in 403 upscoping prevents progressive authorization for servers with per-operation scopes | bug P2 | 1 | 1 | 141d |
| #1635 | ac-aashugupta | StreamableHTTPClientTransport should handle 404 and 406 gracefully for GET SSE stream | bug P2 | 3 | 1 | 132d |
| #1641 | semistrict | StreamableHTTPClientTransport cannot be restarted after close() — breaks OAuth re-authentication | bug P2 | 2 | 1 | 130d |
| #1708 | mbochneak | StreamableHTTPClientTransport doesn't handle 404 per spec (no session clear + re-init) | bug P2 | 7 | 1 | 118d |
| #1760 | DhyeyaDesai | Race condition in auth() causes refresh token invalidation when rotating tokens are used | bug P2 | 3 | 1 | 112d |
| #1819 | yu1uuu | Resources: Disable listChanged capability in V1x | bug P2 | 3 | 1 | 107d |
| #1844 | felixweinberger | Elicit primitive schemas reject extra JSON Schema keys (pattern, format, etc.) | bug P2 | 2 | 1 | 104d |
| #1864 | sainathreddyb | McpServer.registerTool() does not support icons field from ToolScheme | bug P2 | 5 | 1 | 98d |
| #1869 | dgon-jd | prompts/get rejects omitted `arguments` when all argsSchema fields are optional; tools fix (#1404) not in 1.x | bug P2 | 3 | 1 | 97d |
| #1872 | carrotRakko | SSE client: duplicate Authorization header when using eventSourceInit.fetch + requestInit.headers | bug P2 | 2 | 1 | 96d |
| #1944 | bokelley | StreamableHTTPServerTransport rejects JSON-only Accept with 406 even when enableJsonResponse: true | bug P2 | 3 | 1 | 84d |
| #1960 | andypalmi | RegisteredTool.update() crashes with ZodObject inputSchema (passthrough schemas) | bug P2 | 1 | 1 | 81d |
| #1968 | huven | OAuth resource indicator from protected resource metadata is normalized with a trailing slash | bug P2 | 1 | 1 | 79d |
| #1994 | Phil-Browne | Stateless StreamableHTTPServerTransport: non-initialize requests return 500 with empty body when transport is reused (regression vs 1.24.3) | bug P2 | 1 | 1 | 76d |
| #2011 | Euaell | zod listed in both dependencies and peerDependencies causes duplicate installs and TS type-incompatibility | bug P2 | 1 | 1 | 74d |
| #2012 | blackwell-systems | tools/call with null arguments returns -32603 (InternalError) instead of being accepted | bug P2 | 1 | 1 | 74d |
| #2023 | JoannaaKL | StdioClientTransport.close() does not kill the process tree, leaving orphan processes | bug P2 | 2 | 1 | 70d |
| #2034 | jbsky | auth() silently swallows non-OAuthError exceptions from refreshAuthorization / saveTokens, preventing token persistence | bug P2 | 1 | 1 | 68d |
| #2037 | pkailas | DEFAULT_INHERITED_ENV_VARS | bug P2 | 1 | 1 | 67d |
| #2076 | ContextVM-org | `resetTimeoutOnProgress` on low-level `request()` only works when `onprogress` is explicitly provided | bug P2 | 2 | 1 | 64d |
| #2108 | cclabadmin | Streamable HTTP server accepts mismatched `MCP-Protocol-Version` header and body `protocolVersion` on `initialize` | bug P2 | 5 | 1 | 60d |
| #2115 | feldmannn | requestId 0 is silently dropped by _oncancel, making the first request from every Protocol uncancellable | bug P2 | 3 | 1 | 60d |
| #2117 | tylerklose | relatedRequestId 0 is treated as absent by notification debounce guard | bug P2 | 2 | 1 | 59d |
| #2126 | DmitroKihtenko | OAuth AS metadata discovery crashes on 200 OK + non-JSON response instead of falling back to OIDC | bug P2 | 2 | 1 | 56d |
| #2145 | produtoramaxvision | tools/list returns empty inputSchema for ZodEffects-wrapped schemas (Zod .superRefine / .refine / .transform / .pipe) | bug P2 | 5 | 1 | 54d |
| #2155 | randyramig | Claude.AI hangs with 408 timeout when MCP tool response JSON contains U+2028 (LINE SEPARATOR) or U+2029 (PARAGRAPH SEPARATOR) | bug P2 | 3 | 1 | 52d |
| #2165 | sakthiveltofficial | AbortSignal cancellation throws `SdkErrorCode.RequestTimeout` instead of a distinct abort error | bug P2 | 3 | 1 | 48d |
| #2166 | sakthiveltofficial | `UriTemplate.match()` returns `null` for multi-variable path expressions like `{userId,format}` | bug P2 | 3 | 1 | 48d |
| #2232 | luizgribeiro | sendToolListChanged drops notifications on stateless Streamable HTTP transports (missing relatedRequestId) | bug P2 | 6 | 1 | 44d |
| #2247 | SSanju | Invalid Request frames silently dropped with no error response — client hangs waiting for id that never resolves | bug P2 | 6 | 1 | 43d |
| #2283 | felixweinberger | notifications/cancelled is ignored for request id 0 | bug P2 | 5 | 1 | 33d |
| #2284 | felixweinberger | Spec-method requests with invalid params answer -32603 instead of -32602 | bug P2 | 5 | 1 | 33d |
| #2433 | scottmsilver | streamable HTTP server: no duplicate-in-flight request-id guard — concurrent POSTs with the same JSON-RPC id cross-wire responses | bug P2 | 2 | 1 | 12d |
| #2464 | jtemps | zod v4: toJSONSchema options are hardcoded — z.date() breaks tools/list; output schemas advertise required/closed shapes the raw structuredContent can't satisfy | bug P2 | 1 | 1 | 7d |
| #929 | LandonSchropp | Client#listPrompts results in MCP error -32601: Method not found | bug P3 | 5 | 1 | 309d |
| #949 | Lutz2015 | Client error for command SSE stream disconnected: TypeError: terminated | bug P3 | 4 | 1 | 300d |
| #1914 | shaun0927 | authExtensions docs say custom claims override reserved JWT claims, but implementation keeps reserved claims authoritative | bug P3 | 4 | 1 | 90d |
| #2112 | sceran | docs(README): `@modelcontextprotocol/fastify` missing from middleware listing | bug P3 | 1 | 1 | 60d |
ready-for-work (26) — Triaged and reproducible — pick one up. P0/P1 first.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #174 | punkpeye | stderr is not available until after start is called | bug P1 | 3 | 1 | 495d |
| #251 | gmaison | Bug: npm spawn processes incorrectly use root directory instead of project directory | bug P1 | 1 | 1 | 470d |
| #553 | sram1337 | tool/call results in 'Method not found' with StreamableHTTPServerTransport in stateful session after successful initialize (SDK v1.12.0) | bug P1 | 4 | 1 | 415d |
| #778 | junjiexv | invoke asyn method in mcp tool through StreamableHttpTransport cause early return from tool call | bug P1 | 5 | 1 | 363d |
| #852 | christopherorea | Missing session reuse in browser: client.connect ignores mcp-session-id | bug P1 | 9 | 1 | 342d |
| #1028 | juanlluva | ListTools request handler fails to generate inputSchema (jsonSchema) | bug P1 | 7 | 1 | 273d |
| #436 | jigarchhadwa | SSE client is not adding headers from requestInit? in _commonHeaders method | bug P2 | 9 | 2 | 441d |
| #484 | ajgray-stripe | SDK makes HTTPS fetches through an HTTP proxy | bug P2 | 3 | 1 | 429d |
| #509 | rickchow88 | Bug Report: Tool Handlers Not Invoked with StdioServerTransport on macOS | bug P2 | 3 | 1 | 424d |
| #573 | carlpeaslee | Dynamically listed Resources created by ResourceTemplates display the ResourceTemplates rather than their own | bug P2 | 2 | 1 | 411d |
| #579 | pavelfeldman | StdioClientTransport does not follow the spec on close | bug P2 | — | — | 410d |
| #951 | thomasst | Prefer token endpoint auth method obtained during OAuth client registration | bug P2 | 3 | 1 | 300d |
| #999 | younaman | Bug Report-1: Missing Cancellation Logging Implementation | bug P2 | 2 | — | 286d |
| #1049 | masx200 | [MCP-SDK] stdio client crashes with "MCP error -32000: Connection closed" when spawned server exits unexpectedly | bug P2 | 2 | 1 | 260d |
| #1112 | YashwantRamAB | Can not create proxy OAuth flow with google OAuth | bug P2 | 5 | 1 | 243d |
| #1211 | whynixx | SSE stream disconnected: TypeError: terminated | bug P2 | 5 | 1 | 225d |
| #1415 | mozmo15 | getParseErrorMessage prioritizes error.message which bypasses custom Zod errors | bug P2 | 4 | 1 | 175d |
| #1858 | maximemoreillon | ERR_PACKAGE_PATH_NOT_EXPORTED with @modelcontextprotocol/express | bug P2 | 4 | 2 | 100d |
| #1954 | daksh-goyal | adaptOAuthProvider returns expired tokens without checking expiry, breaking long-running StreamableHTTP connections | bug P2 | 2 | 1 | 82d |
| #2048 | morozow | High-severity CVEs via pnpm audit | bug P2 | 1 | 1 | 65d |
| #2098 | cloudingenium-automation | StreamableHTTPClientTransport: 2-retry SSE reconnect ceiling + silent-success after exhaustion | bug P2 | 2 | 1 | 61d |
| #2233 | marc-wilson | Published package omits `src/` but `dist/**/*.js.map` references it, breaking source-map consumers | bug P2 | 4 | 1 | 44d |
| #42 | jspahrsummers | Typechecking should fail on returning {} for all requests | bug P3 | 2 | 1 | 614d |
| #584 | localden | SDK assumes one authorization server to be used from PRM | bug P3 | — | — | 408d |
| #1400 | AI-Hub-Admin | MCP 1.25 Cursor Second Connection to StreamableHTTPServerTransport Initialization Request Failed | bug P3 | 3 | 1 | 180d |
| #2410 | christopher-h-johnson | [v2] feedback: Client sends legacy `initialize` to non-conforming "MCP" endpoint — no dual-era probe | bug P3 | 6 | 2 | 14d |
needs-maintainer (9) — Reporter replied, or bot/triage flagged for maintainer judgment.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #539 | ghalibansari | Raw bytes support sending to mcp server in callTool method | bug P3 | 5 | — | 419d |
| #861 | utkarshpandey6 | StreamableHTTPClientTransport is not implementing Transport properly | bug P3 | 2 | 1 | 339d |
| #181 | theodormarcu | MCP should return empty instead of error if tools / prompts / resources are not defined | bug | 9 | 1 | 491d |
| #342 | cj2a7t | SSEClientTransport | bug | 6 | 1 | 456d |
| #419 | bbracha-evinced | Cannot load a basic STDIO MCP server (JS) in claude desktop | bug | 3 | 1 | 443d |
| #545 | pavinduLakshan | Resolving Authorization server metadata URL omits the base path of the Authorization server URL | bug | 13 | 1 | 416d |
| #737 | Mohhit1230 | Request time out issue repeatedly | bug | 7 | 1 | 376d |
| #912 | zhuyuanmin | 【BUG】Use Koa server create StreamableHTTPServerTransport, when call tool， server crash! | bug | 5 | 1 | 316d |
| #2146 | One-Up-Dev | A se | bug | — | — | 54d |
close-candidates (12) — Bot says already-fixed/not-a-bug, or repro request expired (>14d).
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #320 | ynaoto | The MCP client using a tool launched with uvx does not terminate. | bug | 2 | 1 | 459d |
| #451 | pete-grunge-ai | Subclassing McpServer causes tool invocation issues | bug | 4 | 1 | 436d |
| #1317 | lokendra-ss | Auth Failure Retry Handler `_hasCompletedAuthFlow` | bug P3 | 1 | — | 208d |
| #1450 | waltmayf | OAuth Token Exchange Fails with Separate Authorization Servers | bug | 2 | 1 | 163d |
| #1585 | jonnycoder1 | server.tool() silently drops inputSchema when passed plain JSON Schema objects instead of Zod schemas | bug | 5 | 1 | 140d |
| #1639 | vz443 | Hono Package is not under @modelcontextprotocol | bug | 4 | 1 | 131d |
| #1852 | cdunda-perchwell | StreamableHTTPServerTransport destroys sessions on TCP keepalive timeout (regression in 1.25+) | bug | 2 | 1 | 102d |
| #1946 | caravin | OAuth discovery does not fall back to well-known URI when 401 carries a non-Bearer WWW-Authenticate (e.g. Negotiate) | bug | 3 | 2 | 84d |
| #2077 | scastria | client code can't execute inside browser due to import spawn | bug | 3 | 1 | 64d |
| #2143 | slowtick | @modelcontextprotocol/client 2.0.0-alpha.2 is missing peer dependency declaration for @cfworker/json-schema | bug | 3 | 1 | 54d |
| #2162 | SrjAlamy | invalid argument should throw protocol error, rather than tool execution error | bug | 2 | 1 | 48d |
| #2255 | pavlo-to | Step-up authorization (403 insufficient_scope) dead-ends with SdkHttpError when a refresh_token is present | bug | 4 | 1 | 40d |
waiting (1) — Reporter owes repro/confirmation, or a PR is in flight, or blocked.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #2408 | carissalicatovich | OAuth token exchange crashes on gzip-compressed token response (JSON.parse on undecompressed bytes) | bug | 2 | 1 | 14d |
backlog (1) — Triaged bug, no status — plan into a sprint or label.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #2175 | lokendra-ss-18283 | Session Close Notification for Stateful Connections (MCP Clients) | bug P2 | 2 | — | 47d |
Enhancements (86)
Decisions — say yes/no, then design or implement.
in-progress (12) — Assigned — someone is on it.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1294 | domdomegg | Server SDK support for signaling token expiry (401) from tool handlers | enhancement P1 | 2 | — | 215d |
| #558 | kentcdodds | Support the resources/subscribe method | enhancement P2 | 6 | — | 414d |
| #2189 | felixweinberger | Implement SEP-2663: Tasks Extension | enhancement P2 | 2 | — | 47d |
| #74 | lino-levan | Publish on the JSR | enhancement P3 | 1 | — | 595d |
| #963 | ochafik | Simplify attribution of elicitation to a tool call | enhancement P3 | 2 | — | 295d |
| #1090 | felixweinberger | Implement SEP-990: Enterprise Managed Authorization (Extension) | enhancement P3 | 4 | — | 250d |
| #1264 | felixweinberger | OpenTelemetry integration out of the box | enhancement P3 | 1 | — | 219d |
| #1271 | felixweinberger | Better contribution guidelines for external contributors | enhancement P3 | 1 | — | 219d |
| #1260 | felixweinberger | Refactor Protocol.ts to eliminate client/server conditionals | enhancement P3 | — | — | 219d |
| #1262 | felixweinberger | Inject your own logger | enhancement P3 | — | — | 219d |
| #1430 | NSeydoux | Support providing client scopes to StaticPrivateKeyJwtProvider (also applicable to PrivateKeyJwtProvider) | enhancement P3 | 1 | — | 167d |
| #1734 | felixweinberger | Evaluate OIDC nonce support | enhancement P3 | — | — | 114d |
decide (65) — needs decision — say yes (→ ready/design/backlog) or no (→ close). P1 first.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #283 | psclkhoury | Support JSON schema in addition to zod | enhancement P1 | 11 | — | 464d |
| #1063 | felixweinberger | Implement SEP-1724: Extensions | enhancement P1 | 1 | — | 258d |
| #1250 | felixweinberger | Remove or clarify ProxyOAuthProvider | enhancement P1 | — | — | 219d |
| #143 | jspahrsummers | Better CORS defaults for SSE transport | enhancement P2 | 6 | — | 527d |
| #2352 | riccardorispoli | `McpServer` does not implement server-side pagination for list operations | enhancement P2 | 2 | — | 22d |
| #34 | jspahrsummers | Make it easy to send progress notifications from a request handler | enhancement P2 | 1 | — | 618d |
| #1000 | younaman | Bug Report-2: Missing Periodic Ping Implementation | enhancement P2 | 1 | — | 286d |
| #1151 | pcarleton | Server SDK support for scope challenges on tool calls | enhancement P2 | 1 | — | 236d |
| #1587 | zero1zero | Published 2.0.0-rc/alpha version to npmjs.com? | enhancement P2 | 1 | — | 140d |
| #28 | jspahrsummers | Automate sending pings from SSE servers | enhancement P2 | 1 | — | 625d |
| #6 | jspahrsummers | `Host` abstraction for multiple client → server connections in one process | enhancement P2 | 1 | — | 650d |
| #892 | katjes733 | Issue: No Reliable Mapping Between sessionId and streamId for Stateless Resumability | enhancement P2 | — | — | 328d |
| #192 | wskish | consider defaulting resetTimeoutOnProgress to True | enhancement P2 | — | — | 489d |
| #1238 | ahammednibras8 | Feature Request: Middleware support for McpServer | enhancement P3 | 13 | — | 222d |
| #836 | danielsinai | Dynamic Tool Registration Based on Authentication Context | enhancement P3 | 7 | — | 346d |
| #1124 | nazoking | Support Secure Hashed Client Secrets in OAuthRegisteredClientsStore | enhancement P3 | 5 | — | 240d |
| #153 | mikesir87 | Expected manner to capture error details during startup | enhancement P3 | 5 | — | 512d |
| #1160 | clemmy | Call schema on inputSchema validation failure | enhancement P3 | 4 | — | 233d |
| #956 | jordan-burnett | Ability to pass custom context to tool handlers | enhancement P3 | 4 | — | 298d |
| #1046 | felixweinberger | Zod types via `infer` make TypeScript types a lot less readable | enhancement P3 | 4 | — | 261d |
| #688 | dudo | Resource Templates: Support for display names vs values in completion and better handling of special characters in URI paths | enhancement P3 | 3 | — | 387d |
| #2298 | paztis | creation of a tool without any server instance knowledge | enhancement P3 | 2 | — | 30d |
| #1928 | mddaud | McpServer: add tool lifecycle hooks (beforeToolCall, afterToolCall) | enhancement P3 | 2 | — | 88d |
| #703 | KKonstantinov | Prompts - Metadata attributes in prompt registration, similar to resource metadata or tool annotations | enhancement P3 | 2 | — | 383d |
| #1039 | dmcwherter | Support upscoping on insufficient_scope 403 like in Python SDK | enhancement P3 | 2 | 1 | 265d |
| #1757 | tizmagik | Add hook or middleware for transforming tools/list responses | enhancement P3 | 2 | — | 112d |
| #2032 | jirispilka | Feature request: allow customizing `taskId` in `InMemoryTaskStore` | enhancement P3 | 1 | — | 68d |
| #2090 | RomKadria | Stateless mode: per-request McpServer+Protocol allocation causes memory leak at scale | enhancement P3 | 1 | — | 62d |
| #1882 | technicallychudi | Public API for multi-node session rehydration (e.g. transport.adoptSession(id)) | enhancement P3 | 1 | — | 94d |
| #1924 | klodr | Optional install of HTTP/SSE transport deps (express, hono) for stdio-only servers | enhancement P3 | 1 | — | 89d |
| #88 | jspahrsummers | Increase default child process `maxBuffer`, and make configurable | enhancement P3 | 1 | — | 583d |
| #208 | jrieken | Add ways for server processes to self-terminate when host is gone | enhancement P3 | 1 | — | 483d |
| #577 | Rajesh-Narayanappa87 | Auth : Allow user provided routes to escape Auth middleware | enhancement P3 | 1 | — | 410d |
| #676 | alonhar | OAuth Request Should Accept client_id and client_secret via Headers, Not Just in the Request Body | enhancement P3 | 1 | — | 390d |
| #830 | jkorach | Need to handle GET and POST differently in OAuthServerProvider.authorize handler | enhancement P3 | 1 | — | 349d |
| #886 | weihaoxia-01 | Request guidance/feature to stream streaming tool responses back | enhancement P3 | 1 | — | 330d |
| #927 | kentcdodds | Use types for tool annotations to reduce confusion | enhancement P3 | 1 | — | 310d |
| #932 | yadav-prakhar | Elicitation with custom input [ SEP-1456 ] | enhancement P3 | 1 | — | 308d |
| #1036 | localconst | Simplify public access to McpServer registered tools | enhancement P3 | 1 | — | 267d |
| #1253 | felixweinberger | Type-first as opposed to Zod schema-first approach | enhancement P3 | 1 | — | 219d |
| #1268 | felixweinberger | MSW (Mock Service Worker) integration | enhancement P3 | 1 | — | 219d |
| #1361 | domdomegg | Consider type coercion for tool arguments | enhancement P3 | 1 | — | 190d |
| #1877 | yokonao | `createMcpHonoApp` should support generics for Env (Bindings and Variables) | enhancement P3 | 1 | — | 95d |
| #1883 | DrDexter6000 | Feature: add idle timeout to SSE stream reader in StreamableHTTPClientTransport | enhancement P3 | 1 | — | 94d |
| #370 | logan272 | Allow Custom Client Features for MCP Tools | enhancement P3 | 1 | — | 451d |
| #2020 | icopp | TaskStore interface should pass through authInfo and signal | enhancement P3 | — | — | 71d |
| #2025 | edge-ignacio-rojas | Proposal: Move examples to a separate repository to avoid dependency-related vulnerabilities | enhancement P3 | — | — | 70d |
| #2029 | icopp | Completables should pass through authInfo and signal | enhancement P3 | — | — | 69d |
| #2208 | bryant-eastham | One line change to enable fallback authentication | enhancement P3 | — | — | 47d |
| #1941 | misterwigglesworth | deps: include hono@4.12.14 in the next dependabot bump (GHSA-458j-xx4x-4375) | enhancement P3 | — | — | 85d |
| #741 | nataliapc | Feature: Retrieve info about registered Resources and execute them from a tool | enhancement P3 | — | — | 373d |
| #1059 | felixweinberger | Implement SEP-1649: MCP Server Cards (.well-known Discovery) | enhancement P3 | — | — | 258d |
| #1259 | felixweinberger | Class names - align with Python SDK (server, session, etc.) | enhancement P3 | — | — | 219d |
| #1263 | felixweinberger | Add custom onError config points for McpError handling | enhancement P3 | — | — | 219d |
| #1265 | felixweinberger | Clear abstracted way to define experimental features | enhancement P3 | — | — | 219d |
| #1316 | BestOwl | Support RFC 8252 dynamic loopback port selection for native OAuth clients | enhancement P3 | — | — | 208d |
| #1474 | mattzcarey | Completers as a first class option in Prompts | enhancement P3 | — | — | 162d |
| #1537 | josefaidt | consider consolidation of tooling, revise ts setup | enhancement P3 | — | — | 151d |
| #1847 | felixweinberger | Convert tool/prompt schemas eagerly at register time instead of on tools/list | enhancement P3 | — | — | 104d |
| #1860 | earonesty | mcpAuthRouter construction-time env is incompatible with request-scoped runtimes (Cloudflare Workers, Supabase Edge, etc.) | enhancement P3 | — | — | 98d |
| #1863 | haydenrear | Add MCP_TOOL_TIMEOUT_MSEC default value only for tool calls. | enhancement P3 | — | — | 98d |
| #1892 | MMoMM-org | Client transport: HTTP 429 responses are not retried with Retry-After | enhancement P3 | — | — | 91d |
| #387 | flippinjoe | Allow receiving messages per stream in client sdk | enhancement P3 | — | — | 448d |
| #674 | fxBrBowman | Please add the ability to supply the the registerClient and defaultScopes to the ProxyOAuthServerProvider | enhancement P3 | — | — | 390d |
| #10 | jspahrsummers | Add conveniences for MCP proxy pattern | enhancement P3 | — | — | 642d |
close-candidates (6) — Bot flagged duplicate/out-of-scope, or confirmation expired.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #19 | jspahrsummers | Automatically create a new server from a template | enhancement P3 | — | — | 637d |
| #682 | ruturaj-browserstack | Dynamic MCP Tool Registration Not Available Mid-Chain or Same Cycle | enhancement P3 | 3 | 1 | 387d |
| #690 | dudo | Resource completion performance: Consider client-side caching and fuzzy filtering | enhancement P3 | 2 | — | 387d |
| #794 | ho3einmolavi | disconnect method for MCP client | enhancement P3 | 2 | — | 360d |
| #1642 | jalpp | feat: Http based register tool adapters | enhancement P3 | — | — | 130d |
| #2250 | mohdgufran07 | MCP tool calls timeout after 60 seconds for long-running requests | enhancement | 2 | 1 | 42d |
backlog (3) — Acknowledged, not prioritized — explicit backlog label or no status yet.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1231 | bhaveshpatel640 | Undici instrumentation marks successful MCP requests as aborted due to premature AbortController.abort() in SSE / StreamableHTTP transports | enhancement P2 | 6 | 1 | 223d |
| #740 | username7171 | Can we have a chatbot example that connected to multiple remote servers | enhancement P3 | 4 | — | 373d |
| #658 | ochafik | update server examples to cover external authentication servers | enhancement P3 | 1 | — | 392d |
Questions (4)
Inbox — answer, then close or convert to bug/enhancement.
answer (4) — No maintainer response yet, or reporter followed up.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1126 | splincode | What is the recommended way of writing unit tests for MCP endpoints? | question P3 | 2 | 1 | 240d |
| #1132 | enesgules | Question: Tool list changed notification | question P3 | 5 | 1 | 239d |
| #1512 | mattzcarey | [TRACKING] non compliance with SEP-986 / tool name validation | question P2 | 5 | 1 | 155d |
| #2101 | joaquinmagneres-asana | Is there a way to pass request-scoped context to tool handlers via HTTP headers without modifying the tool schema? | question | 1 | 1 | 61d |
Bugs ready
—bug + ready for work — triaged and reproducible.
Click to jump to the tier.
Red: any P0/P1
Yellow: > 10
Green: ≤ 10
64
19 P0/P1 · 16 fix proposed
Decisions pending
—enhancement + needs decision — say yes (→ ready/design) or no (→ close).
Click to jump to the tier.
50
9 at P1
Questions > 2d
—Questions past 2 business days with no maintainer response.
Click to jump to the tier.
Green: 0
Yellow: 1–4
Red: 5+
5
Close candidates
—potentially close + repro/confirm requests expired (>14d). Across all types.
14
median 167d old
P0 open
—All open P0 issues. SEP-1730: resolve within 7 days.
Green: 0
Yellow: any open
Red: any past 7d
0
0 past 7d SLA
P1 > 90d
—P1 issues open longer than 90 days.
Not in SEP-1730 — surfaces aspirational-P1 rot.
Green: 0
Yellow: 1–4
Red: 5+
53
Repro expired
—needs repro / needs confirmation requested >14d ago, no reporter reply. Auto-close candidates.
Green: 0
Yellow: 1–4
Red: 5+
12
Bot pending
—No type label yet — bot hasn't run, or needs manual triage.
Should be ~0 within 30min of any issue activity.
Green: 0
Yellow: 1–2
Red: 3+
51
Stats — volume, response time, staleness, labels
Volume
Open Issues
↑
0.40%251
Opened
—3
last 7 days
Opened
—30
last 30 days
Opened
—120
last 90 days
Closed
—1
last 7 days
Closed
—45
last 30 days
Closed
—98
last 90 days
Response Time
Time to first maintainer response
Average
—73d
Median
—22d
P90
—199d
P95
—241d
Stale Issues
Issues with no activity
Stale
↑
3.65%199
>30 days
Stale
—156
>60 days
Stale
—99
>90 days
Reopen Rate
—99%
Issues by Label
| Label | Count |
|---|---|
| enhancement | 102 |
| ready for work | 84 |
| bug | 82 |
| P2 | 70 |
| v2 | 61 |
| P1 | 53 |
| needs decision | 51 |
| P3 | 46 |
| auth | 32 |
| documentation | 16 |
| fix proposed | 16 |
| needs confirmation | 11 |
| good first issue | 8 |
| improves spec compliance | 8 |
| question | 8 |
| breaking change | 7 |
| needs repro | 5 |
| pending SEP approval | 3 |
| improves sdk consistency | 2 |
| potentially close | 2 |
| spec-2026-07-28 | 2 |
| help wanted | 1 |
| needs maintainer | 1 |
Untriaged (51)
No type label — bot pending or needs manual triage.
untriaged (51) — Bot has not labeled yet, or needs manual type assignment.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1318 | Norcim133 | Critical Token Refresh Bugs - Prevents Proactive Refresh | P1 | 9 | — | 322d |
| #1450 | certainly-param | Response leak in SSE handlers | P2 | 3 | — | 279d |
| #1602 | maxisbey | OAuth: 403 responses without insufficient_scope incorrectly retry with same token | P3 | — | — | 247d |
| #1785 | sonmaximum | Discover OIDC-only authorization servers when PR metadata is absent | P2 | 8 | — | 213d |
| #1821 | maxisbey | Clarify JSON-RPC error code for 'session not found' responses | — | — | 196d | |
| #1842 | aiwebb | ClientAuthenticator ignores token_endpoint_auth_method="none" when client_secret is stored | 6 | — | 188d | |
| #2021 | maxisbey | Refactor handler context to be transport- and handler-type-aware | P1 | 1 | — | 156d |
| #2233 | sergeykad | pywin32 installation fails on Windows — hard dep only needed for client stdio, but pulled in for all users via eager import in __init__.py | 1 | — | 131d | |
| #2270 | oedokumaci | _handle_refresh_response discards existing refresh_token when server omits it | 1 | — | 126d | |
| #2278 | maxisbey | Mark SSE transport as deprecated | P3 | 1 | — | 126d |
| #2307 | tsingh2k15 | [mcp/python-sdk] ClientSession has no way to specify protocolVersion | 2 | — | 118d | |
| #2317 | artdent | Don't override client_metadata.scopes if they are already set | 1 | — | 118d | |
| #2329 | kingpanther13 | Improve log clarity for "Terminating session: None" in stateless mode | 1 | — | 115d | |
| #2331 | rgoldstein1989 | Add remove_prompt() and remove_resource() for parity with remove_tool() | 4 | — | 115d | |
| #2349 | juliendoclot | Streamable HTTP transport rejects Accept: text/event-stream without application/json | 1 | — | 112d | |
| #2354 | maxisbey | Design: future of `dependencies` parameter on MCPServer | 2 | — | 111d | |
| #2376 | Kunyu-Chen | Image/ImageContent serialization fails in stateless HTTP mode | 3 | — | 108d | |
| #2379 | dgenio | ClientSession: add public API for updating callbacks after initialization | 3 | — | 107d | |
| #2384 | felixweinberger | Inline $ref in tool inputSchema for LLM consumption (parity with typescript-sdk) | 2 | — | 104d | |
| #2393 | jeffplourde | StreamableHTTP client: _handle_reconnection resets attempt counter to 0, causing infinite retry loop | 2 | — | 101d | |
| #2474 | itomise | Return 405 on GET when stateless_http=True | 4 | — | 87d | |
| #2473 | 0717376 | MCPServer unconditionally declares `prompts`, `resources`, `tools` capabilities on `initialize` | — | — | 87d | |
| #2480 | q-thomasdickson | RequestResponder.cancel sends JSON-RPC response, violating cancellation spec | 1 | — | 86d | |
| #2486 | leiserfg | Split the core from the server and client implementations | 2 | — | 85d | |
| #2539 | rynowak | Bug: task_result_handler.py serializes None optional fields as JSON null, breaking Node SDK Zod validation | 1 | — | 72d | |
| #2548 | Botschagow | BaseSession.send_request fails when forwarding a request received via ServerSession (envelope-fields collision) | 2 | — | 70d | |
| #2564 | blackwell-systems | raise without from discards exception chain in 12 remaining sites | — | — | 68d | |
| #2610 | mlorentedev | RequestResponder.__exit__ leaks CancelledError on cancelled request, killing the stdio receive loop | 3 | 1 | 61d | |
| #2702 | hognek | FastMCP: streamable_http_app() silently breaks when BaseHTTPMiddleware is added | 3 | 1 | 49d | |
| #2741 | SingingOwl | Stateful Streamable HTTP: in-session exceptions are masked as an empty -32603; real cause only in a separate "Session crashed" log | 2 | — | 45d | |
| #2740 | ghost | Proposal: Bridge for CLI‑first MCP servers (like typer-mcp) | — | — | 45d | |
| #2751 | cclabadmin | Deep JSON-RPC request over stdio logs a validation error and leaves the original request pending | 1 | — | 44d | |
| #2770 | mengyunxie | McpError raised in tool handlers is swallowed as isError:true instead of propagating as JSON-RPC error | — | — | 43d | |
| #2776 | artdent | OAuth handler doesn't support redirect URLs with params | — | — | 42d | |
| #2826 | nikodemas | `simple-auth` is not working as expected | — | — | 35d | |
| #2847 | EnGassa | Bug: anyio.Lock in async_auth_flow causes RuntimeError under concurrent OAuth MCP connections | 4 | — | 33d | |
| #2848 | cclabadmin | Invalid JSON-RPC envelope errors are not correlated with the original request id | — | — | 33d | |
| #2883 | viejunoacien | AnyHttpUrl normalization adds trailing slash → breaks RFC 9728 canonical resource URL in ProtectedResourceMetadata | — | — | 29d | |
| #2896 | maxisbey | Capabilities API + server/discover handler | — | — | 28d | |
| #2891 | maxisbey | 2026-07-28 spec support — tracking | — | — | 28d | |
| #2935 | zlucas03 | dict[str, T] tool return types lose Annotated/Field metadata in output schema | 2 | — | 25d | |
| #2958 | simpson1045 | StreamableHTTP server accumulates CLOSE_WAIT sockets behind reverse proxy due to missing disconnect cleanup | 1 | — | 21d | |
| #2960 | Robin1987China | [Bug] validate_tool_use_result_messages raises false positive when tool_use is not followed by tool_result | 3 | — | 20d | |
| #2965 | Robin1987China | [Bug] check_capability does not validate elicitation sub-capabilities (form/url) | 2 | — | 20d | |
| #3009 | VihaanAgarwal | WWW-Authenticate parsing matches a field name as a substring of another auth-param | 2 | — | 18d | |
| #3055 | vientooscuro | FuncMetadata.pre_parse_json mis-detects str | None as non-string and corrupts JSON-looking string arguments | 2 | — | 13d | |
| #3060 | scottmsilver | streamable HTTP (stateful): concurrent requests with duplicate JSON-RPC ids cross-wire responses — one request receives another's payload, the other hangs | 4 | — | 12d | |
| #3065 | mayankbohradev | [v2] RFC 9728 PRM URLs and resource matching drop query components | — | — | 9d | |
| #3067 | ramonahl | FastMCP tool argument models silently ignore unknown/misspelled arguments (extra=ignore default) | 1 | — | 9d | |
| #3089 | scotthibbs | Heavy sync init work (e.g. local ML models) starves stdio initialize/tool calls even with threadpool offload -- Windows GIL contention | 1 | — | 3d | |
| #3091 | afterrburn | streamable_http: HTTP status errors (401/403/5xx) on tools/list, tools/call never reach the caller — indistinguishable from a timeout | 6 | — | 2d |
Bugs (82)
Queue — pick the top fix-ready and work it. Priority then age.
in-progress (1) — Assigned — someone is on it.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #2009 | felixweinberger | Re-enable conformance tests in CI | bug P1 | 1 | — | 158d |
fix-proposed (16) — Bot posted a suggested fix — review the diff. P0/P1 first.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #915 | hzeus | Exception in `ClientSessionGroup` if `streamable_http` MCP server is not available | bug P1 | 11 | 1 | 400d |
| #1257 | 0x-Professor | Don’t use shell=True in mcp dev subprocess on Windows (command injection risk) | bug P1 | 3 | 1 | 339d |
| #2416 | bbarwik | Bug: AssertionError: Request already responded to — cancellation race in v1.27.0 | bug P2 | 4 | 1 | 97d |
| #2429 | kimsehwan96 | [v1.x] Server-side outputSchema validation blocks tool error reporting (isError: true) | bug P2 | 2 | 1 | 94d |
| #2431 | rain87 | McpError is not pickle-safe and fails to unpickle | bug P2 | 3 | 1 | 93d |
| #2432 | HenriChabert | Initialize call hangs forever if MCP server does not return a `Content-Type: text/plain` | bug P2 | 3 | 1 | 93d |
| #2433 | DonovanDeHart | Windows: TextIOWrapper in stdio_server() emits CRLF instead of LF, corrupting newline-delimited JSON messages | bug P2 | 6 | 1 | 93d |
| #2454 | shaun0927 | stdio_client crashes on malformed UTF-8 from child stdout instead of surfacing parse error | bug P2 | 3 | 1 | 90d |
| #2455 | shaun0927 | session_idle_timeout is not exposed via streamable_http_app() and can cancel active requests | bug P2 | 3 | 1 | 90d |
| #2578 | ShaneFlag | OAuth token refresh sends RFC 8707 resource parameter that Entra ID v2.0 rejects (AADSTS9010010) | bug P2 | 6 | 1 | 64d |
| #2605 | cclabadmin | Duplicate `initialize` with changed parameters can overwrite `ServerSession.client_params` | bug P2 | 3 | 1 | 61d |
| #2629 | CrypticCortex | DCR registration accepts redirect_uris with non-HTTPS / non-loopback / fragmented schemes | bug P2 | 1 | 1 | 58d |
| #2655 | dexteradeus | Streamable HTTP server silently drops in-flight request when client reuses a JSON-RPC id | bug P2 | 3 | 1 | 55d |
| #2687 | ptrhrsch-arch | `OAuthClientInformationFull.redirect_uris`: pydantic strict-type-equality breaks `AnyUrl(x) != AnyHttpUrl(x)` round-trip | bug P2 | 3 | 1 | 50d |
| #2689 | mr-brobot | `ClientSessionGroup` attempts to use capabilities that were not advertised | bug P2 | 3 | 1 | 50d |
| #2663 | MikeNjoroge | FastMCP.run(transport="stdio") produces noisy traceback on KeyboardInterrupt instead of clean exit | bug P3 | 2 | 1 | 54d |
ready-for-work (48) — Triaged and reproducible — pick one up. P0/P1 first.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #262 | herrrX | cannot get response from await session.call_tool() | bug P1 | 16 | — | 490d |
| #373 | samirbajaj | How to set / get `client_id`? | bug P1 | 2 | — | 476d |
| #381 | weester-yan | Fastmcp tool parameter parsing type error | bug P1 | 12 | — | 475d |
| #577 | HMJiangGatech | `RuntimeError: Attempted to exit cancel scope in a different task` when cleaning up multiple MCPClient instances out-of-order | bug P1 | 11 | — | 448d |
| #698 | bendavis78 | Tool.run should not reveal exception value to the client | bug P1 | 1 | — | 429d |
| #737 | jasny6969 | Bug Report: FastMCP `RuntimeError: Received request before initialization was complete` Leading to Empty SSE Responses When Embedded in FastAPI | bug P1 | 5 | — | 425d |
| #795 | lizzzcai | Support for API Gateway Path Prefixes in SSE Client URL Handling | bug P1 | 2 | — | 418d |
| #874 | efcwetgw | Cannot break out of session.initialize() when using streamable-http | bug P1 | 5 | — | 407d |
| #883 | toughnoah | AssertionError: Unexpected message while using middlewares | bug P1 | 15 | — | 406d |
| #1065 | nileshmalode11 | MCP Completion Issue | bug P1 | 2 | — | 379d |
| #1250 | pematth | Framework does not handle refreshed tokens correctly | bug P1 | 12 | — | 341d |
| #1265 | FakeDocument | Trailing slash in `.well-known/oauth-protected-resource` response may violate “Canonical Server URI” requirement | bug P1 | 2 | — | 337d |
| #1272 | lindycoder | Server hangs when shutting down if a connection is still open | bug P1 | 2 | — | 335d |
| #1401 | Unshure | ClientSession Error Handling | bug P1 | 11 | — | 293d |
| #1675 | AydarDD | Streamable HTTP transport drops requests immediately after `initialize` | bug P1 | 1 | — | 231d |
| #1811 | ivanbelenky | client's `read_stream_writer` open after SSE disconnection hanging `.receive()` | bug P1 | 3 | — | 206d |
| #1919 | joar | Trailing slash in OAuthMetadata's `issuer` causes issues with clients | bug P1 | 3 | — | 175d |
| #423 | folkvir | MCP SSE Server: Received request before initialization was complete | bug P2 | 25 | — | 468d |
| #526 | RodrigoPAml | MCP Server with Python on Claude Desktop Never Exits | bug P2 | 6 | — | 456d |
| #1060 | paxan | PydanticSchemaGenerationError: Unable to generate pydantic-core schema for Image type | bug P2 | 3 | — | 380d |
| #1218 | howardjohn | `simple-streamablehttp-stateless` example will not return data if `id=0` | bug P2 | 1 | — | 350d |
| #1264 | carlosemart | Protected Resource Metadata resource erroneous when setting up authentication on server | bug P2 | 4 | — | 337d |
| #1269 | chipkent | FastMCP server death on client HEAD calls | bug P2 | 6 | — | 336d |
| #1274 | rcxwhiz | Streamable HTTP client performance regression starting with v1.12.0 | bug P2 | 2 | — | 335d |
| #1295 | somaraani | 401 in Streamable HTTP should be handled gracefully | bug P2 | — | — | 327d |
| #1326 | Norcim133 | Clients Using Storage Face Deadlock on Token Refresh for SSE | bug P2 | 3 | — | 319d |
| #1333 | peteski22 | `stdio_server` uses unbuffered memory streams which can cause server to block and become unresponsive | bug P2 | 1 | — | 317d |
| #1405 | 0Delta | It is not possible to define a Resource that takes only the Context parameter as an argument. | bug P2 | 2 | — | 292d |
| #1452 | Shashikant86 | The `stdio_client` hangs indefinitely on session initialization | bug P2 | 6 | — | 279d |
| #1523 | cfytrok | OAuthClientProvider._handle_token_response expect json | bug P2 | — | — | 260d |
| #1577 | gyang-xai | Client tool call hangs forever if server crashes or connection dies when using streamable-http | bug P2 | 3 | — | 252d |
| #1648 | FanisPapakonstantinou | ClientDisconnect returns HTTP 500 | bug P2 | 2 | — | 237d |
| #1656 | pfaion | FastMCP configures logging on init, which messes up application-level logging | bug P2 | 7 | — | 233d |
| #1664 | LucaButBoring | User-Agent header in sHTTP transport is not forwarded to auth flow | bug P2 | 1 | — | 233d |
| #1676 | david-nominal | MCP client doesn't not initialize new session when getting 404 session not found | bug P2 | 3 | — | 231d |
| #1873 | TommyVee | Bug: String parameters starting with digits coerced to numbers, causing UUID data loss | bug P2 | 4 | — | 181d |
| #2001 | hubbard-zlee | Progress notifications not delivered via SSE in stateless HTTP mode | bug P2 | 3 | — | 160d |
| #2150 | emmahoggan | Active Streamable HTTP sessions are not terminated during shutdown | bug P2 | 3 | — | 139d |
| #2216 | nik1097 | Bug: validate_scope rejects client scopes when required scopes in None | bug P2 | 4 | — | 132d |
| #2678 | theone139344 | FastMCP/stdio: in-flight tool responses dropped on stdin EOF when input is bash-redirected from a file | bug P2 | 4 | 1 | 51d |
| #156 | grll | support logging to stderr in Jupyter Notebook Environments. | bug P3 | 6 | — | 544d |
| #396 | omasoud | MCP Server: Inconsistent Exception Handling in @app.call_tool and Client Undetected Server Termination via Stdio | bug P3 | 1 | — | 471d |
| #514 | growler | FastMCP server with SSE transport fails to shut down on a signal | bug P3 | 11 | — | 457d |
| #671 | ycycycl | MCP Tool execution hangs indefinitely in stdio mode when calling external Python scripts | bug P3 | 7 | — | 432d |
| #1141 | abhishekgahlot2 | Progress notifications cause server to hang on stdio transport | bug P3 | 4 | — | 366d |
| #1251 | de-code | Incorrect typing hint for FastMCP.call_tool | bug P3 | — | — | 341d |
| #1579 | fennb | FastMCP read_resource() returns incorrect error code when resource not found | bug P3 | 4 | — | 252d |
| #1307 | jennsun | Error & Mismatch in OAuth scope resolution between Claude.ai/MCP Python SDK and Inspector | bug | 1 | — | 324d |
needs-maintainer (3) — Reporter replied, or bot/triage flagged for maintainer judgment.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #2057 | clouatre | Requests with "id": null silently misclassified as notifications | bug P2 | 10 | — | 152d |
| #1103 | kdheeraz | MCP client not able to initiate StdioServerParameters while running in Jupyter Notebook | bug | 5 | — | 372d |
| #1372 | SinDongHwan | fastmcp.run() runtimeerror: task group is not initialized. make sure to use run(). | bug | 3 | — | 301d |
close-candidates (4) — Bot says already-fixed/not-a-bug, or repro request expired (>14d).
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1053 | sidgangs99 | Streamable HTTP transport fails when accessing MCP server on Cloud Run using sdk | bug | 4 | — | 382d |
| #1805 | h-filzer | Possible ressource leak / race condition in streamable_http_client | bug | 10 | — | 208d |
| #2591 | Swcmb | FastMCP crashes when tool return type uses Python 3.10+ `A | B | C` union syntax | bug | 5 | 1 | 62d |
| #2653 | colinlabrooy | mcp.server.fastmcp.FastMCP HTTP transport deadlocks after ~5 sequential client sessions on Windows (companion to PrefectHQ/fastmcp#4192) | bug | 3 | 1 | 55d |
waiting (1) — Reporter owes repro/confirmation, or a PR is in flight, or blocked.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1332 | dsp-ant | Implement consistent structuredContent handling per specification clarification | bug P3 | 1 | — | 317d |
backlog (9) — Triaged bug, no status — plan into a sprint or label.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1581 | maxisbey | Add RFC 9728 resource field validation for protected resource metadata discovery | bug P1 | — | — | 252d |
| #2110 | maxisbey | HTTP transport swallows non-2xx status codes causing client to hang | bug P1 | 7 | — | 146d |
| #2114 | maxisbey | ExceptionGroup wrapping obscures real errors from task groups | bug P1 | 3 | — | 146d |
| #2107 | maxisbey | Handle list_changed notifications instead of dropping them | bug P2 | — | — | 146d |
| #1564 | ParthibanRajasekaran | stdio_client fails with BrokenResourceError during initialization | bug P3 | 3 | — | 255d |
| #1795 | maxisbey | Make JSON-RPC ID type coercion configurable | bug P3 | 2 | — | 210d |
| #1933 | hyn0027 | Using transport="stdio" closes real stdio, causing ValueError after server exits | bug P3 | 3 | — | 174d |
| #1974 | mjahr | find_context_parameter() fails to detect Context parameter in callable class instances | bug P3 | 1 | — | 167d |
| #2208 | maxisbey | get_access_token() returns stale token in stateful streamable-HTTP sessions | bug | — | — | 133d |
Enhancements (101)
Decisions — say yes/no, then design or implement.
in-progress (12) — Assigned — someone is on it.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1240 | yannj-fr | Implement OAuth relying on Authlib | enhancement P1 | 7 | — | 344d |
| #1253 | Kludex | Python SDK v2 | enhancement P1 | 2 | — | 340d |
| #1701 | dgenio | Define and document the public Python SDK API surface | enhancement P1 | 4 | — | 229d |
| #1739 | maxisbey | Support clean server shutdown | enhancement P1 | 1 | — | 222d |
| #1889 | felixweinberger | Add transport types to Client + infer_transport() for auto-detection | enhancement P1 | — | — | 180d |
| #857 | Kludex | Drop uvicorn from test suite | enhancement P2 | 7 | — | 411d |
| #348 | ezyang | No way to set isError=True for arbitrary tool result content | enhancement P3 | 4 | — | 479d |
| #421 | fali007 | Adding Opentelemetry to MCP SDK | enhancement P3 | 19 | — | 468d |
| #1315 | Mars9934 | OAuth TokenHandler should check Authorization header for client credentials | enhancement | 3 | — | 322d |
| #2051 | maxisbey | Simplify README and move examples to documentation site | enhancement | — | — | 152d |
| #2121 | martimfasantos | Allow `OAuthClientProvider` to accept a pre-configured auth server URL | enhancement | — | — | 144d |
| #2141 | enkidulan | Add wildcard pattern support for `allowed_hosts` in transport security | enhancement | — | — | 140d |
decide (50) — needs decision — say yes (→ ready/design/backlog) or no (→ close). P1 first.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #420 | carlosemart | Option to not rewrite the logging configuration | enhancement P1 | 11 | — | 468d |
| #1509 | damianoneill | Support Per-Request HTTP Headers in call_tool() | enhancement P1 | 8 | — | 265d |
| #194 | mconflitti-pbc | Allow customization of the Starlette app (middleware, routes, etc) | enhancement P1 | 8 | — | 523d |
| #1429 | maxisbey | feat: enhance dynamic tool management with notifications and enable/disable | enhancement P1 | 4 | — | 282d |
| #1207 | samuelcolvin | Excessive use of generics | enhancement P1 | 3 | — | 352d |
| #1233 | dsp-ant | Middleware Support in MCP | enhancement P1 | 2 | — | 345d |
| #299 | john0312 | Low-level Server support for mcp dev and mcp run command | enhancement P1 | 2 | — | 486d |
| #12 | jspahrsummers | Add conveniences for MCP proxy pattern | enhancement P1 | — | — | 642d |
| #47 | jspahrsummers | Validate local capabilities | enhancement P1 | — | — | 610d |
| #226 | salman1993 | Improving how function docstring gets converted to tool's jsonschema for FastMCP | enhancement P2 | 13 | — | 509d |
| #710 | skunkwerk | how to trigger a resources_changed or listChanged | enhancement P2 | 10 | — | 428d |
| #509 | maxschulz-COL | Force returning tool result/ressource as artifact without regeneration | enhancement P2 | 6 | — | 457d |
| #1335 | whitewg77 | Using /.well-known/ OAuth endpoints behind custom path on GKE | enhancement P2 | 4 | — | 316d |
| #1374 | ochafik | No default timeout for requests (unlike TS SDK) | enhancement P2 | 4 | — | 301d |
| #600 | grll | SDKs and other middleware SHOULD allow these timeouts to be configured on a per-request basis. | enhancement P2 | 3 | — | 442d |
| #1788 | felixweinberger | Consider extensible pattern for protocol flow-control exceptions | enhancement P2 | 3 | — | 212d |
| #1801 | maxisbey | Implement server-side support for Client ID Metadata Documents (CIMD) | enhancement P2 | 3 | — | 209d |
| #1671 | maxisbey | ServerSession methods (create_message, elicit_form) don't expose progress_callback parameter | enhancement P2 | 2 | — | 232d |
| #1126 | chrisagrams | Specifying capabilities w/ FastMCP Server | enhancement P2 | 2 | — | 369d |
| #1281 | FallenDeity | Modular system to define MCP Primitives | enhancement P2 | 2 | — | 331d |
| #1723 | erwang01 | `auth` specification in `ClientSessionGroup` | enhancement P2 | 2 | — | 223d |
| #2453 | NeelakandanNC | feat: Add roots enforcement utility to FastMCP (get_roots, assert_within_roots, @within_roots_check) | enhancement P2 | 1 | — | 90d |
| #230 | ihrpr | No way to get `request_id` for a tool call to cancel it | enhancement P2 | 1 | — | 506d |
| #1023 | magicbrighter | Support for Parameter Passing in MCP Configuration and Runtime Context | enhancement P2 | 1 | — | 385d |
| #1393 | caffeinism | Lazy HTTP connections seem to make error handling difficult. | enhancement P2 | — | — | 294d |
| #235 | yu-iskw | Official Adapter Functions for LLM Providers in MCP Python SDK | enhancement P3 | 8 | — | 503d |
| #193 | mconflitti-pbc | Add default /docs route to list information about the HTTP MCP server | enhancement P3 | 5 | — | 523d |
| #2422 | DevonFulcher | Specific ToolNotFoundError for easier handling than ToolError in multi-tenant environments | enhancement P3 | 4 | — | 96d |
| #2673 | danielgshea | ClientSession receive loop swallows callback exceptions, replying "Invalid request parameters" to the server instead of propagating to the call_tool awaiter | enhancement P3 | 3 | — | 52d |
| #2727 | fede-kamel | streamable_http client does not send `Origin` header → rejected with 403 by spec-compliant servers (e.g. go-sdk `CrossOriginProtection`) | enhancement P3 | 3 | — | 46d |
| #2626 | germanbecker | Add option to skip output validation for mcp client | enhancement P3 | 3 | — | 59d |
| #762 | surister | Allow installing mcp servers from pypi | enhancement P3 | 3 | — | 421d |
| #817 | huang-sh | STDIO hangs forever when the using multiprocessing in tools | enhancement P3 | 3 | — | 414d |
| #837 | davenpi | Type system complexity creating developer friction and maintenance overhead | enhancement P3 | 2 | — | 412d |
| #1302 | DebajitKumarPhukan | [Feature Request]: Support For "Proxy" in SSE and Streamable HTTP Client | enhancement P3 | 2 | — | 325d |
| #2618 | cclabadmin | Streamable HTTP server accepts mismatched `MCP-Protocol-Version` header and body `protocolVersion` on `initialize` | enhancement P3 | 1 | — | 60d |
| #3 | dsp-ant | Specific transports could be Python package extras | enhancement P3 | 1 | — | 658d |
| #622 | bendavis78 | [Feature] De-couple Starlette from FastMCP to make it easier to implement MCP endpoints in other frameworks | enhancement P3 | 1 | — | 438d |
| #1121 | wiltshirek | MCP tool proxy, planned pull request. Allowing for Seamless Human or determinism (private keys, etc) in the middle. | enhancement P3 | 1 | — | 370d |
| #1678 | felixweinberger | test_streamable_http.py isn't covered by test coverage | enhancement P3 | 1 | — | 230d |
| #1700 | dgenio | Refactor func_metadata() into smaller components for schema & metadata generation | enhancement P3 | 1 | — | 229d |
| #1806 | sesajad | More control over stderr in stdio client | enhancement P3 | 1 | — | 208d |
| #2582 | leowonglaw | Expose `schema_generator` on `FastMCP` for tool params schema generation | enhancement P3 | — | — | 64d |
| #2588 | fuyu-quant | `ClientConfig` has inconsistent naming: `message_handler` should be `message_callback` | enhancement P3 | — | — | 63d |
| #2617 | eeee2345 | docs/examples: add a tool-response detection middleware sample? | enhancement P3 | — | — | 60d |
| #2408 | dgenio | Introduce strategy/registry pattern for type handling in _create_output_model() | enhancement P3 | — | — | 97d |
| #767 | DamyanBG | Feature Proposal: Modular Router System for MCP Python SDK | enhancement P3 | — | — | 420d |
| #1128 | simba-git | Native sampling method on Context | enhancement P3 | — | — | 369d |
| #1347 | felixweinberger | Address currently ignored ruff rules in Python SDK | enhancement P3 | — | — | 313d |
| #1696 | dgenio | Clarify semantics, limitations, and naming for stateless HTTP mode | enhancement P3 | — | — | 229d |
close-candidates (5) — Bot flagged duplicate/out-of-scope, or confirmation expired.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1692 | dgenio | Revisit single-use semantics of StreamableHTTPSessionManager.run() | enhancement | 1 | — | 229d |
| #1705 | dgenio | Document and provide hooks for sandboxing file and network access in MCP tools | enhancement | 10 | — | 229d |
| #1702 | dgenio | Clarify and improve behavior when tool output fails schema validation | enhancement | 1 | — | 229d |
| #1843 | davidbernat | Function parameter coercion ("false" => False) failures in properly documented FastMCP tools? | enhancement | 5 | — | 187d |
| #2083 | rf-ellamind | Optionally(?) allow plaintext on localhost subdomains | enhancement | — | — | 147d |
waiting (5) — Reporter owes detail, or PR in flight, or SEP/hold.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #309 | mattzh72 | Synchronous Python Client | enhancement P2 | 8 | — | 485d |
| #881 | SoldierSacha | Client Credentials In the token Handler | enhancement P1 | 1 | — | 407d |
| #1690 | dgenio | Introduce a shared Transport abstraction to reduce stdio/SSE/WebSocket/HTTP duplication | enhancement | 2 | — | 229d |
| #1691 | dgenio | Simplify and harden session lifecycle with an explicit state machine | enhancement P2 | 2 | — | 229d |
| #2556 | CJGjr | Add `list_all_*` helpers to drain pagination | enhancement P3 | 2 | — | 68d |
backlog (29) — Acknowledged, not prioritized — explicit backlog label or no status yet.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1743 | maxisbey | Extract OAuth flow logic into reusable components for proxy use cases | enhancement P1 | 9 | — | 222d |
| #2098 | maxisbey | Expose session, auth, and transport information on handler Context | enhancement P1 | 1 | — | 146d |
| #2113 | maxisbey | Redesign lifespan: separate server-scoped and session-scoped lifetimes | enhancement P1 | 1 | — | 146d |
| #1733 | maxisbey | Refactor examples to use PEP 723 inline script metadata | enhancement P1 | — | — | 222d |
| #2116 | sr07asthana | Support MCP client session resumption (sessionId reuse) in Python SDK | enhancement P2 | 2 | — | 145d |
| #1475 | maxisbey | FastMCP: Support dynamic annotation updates | enhancement P2 | 2 | — | 275d |
| #1741 | maxisbey | Support pluggable logging for structured output and correlation IDs | enhancement P2 | 1 | — | 222d |
| #1742 | maxisbey | Introduce typed error classes with metadata | enhancement P2 | — | — | 222d |
| #1746 | maxisbey | Support multiple MCP protocol versions | enhancement P2 | — | — | 222d |
| #1744 | maxisbey | Improve exception tracebacks for easier debugging | enhancement P2 | — | — | 222d |
| #1734 | maxisbey | Audit and document the MCP server publishing experience | enhancement P2 | — | — | 222d |
| #2108 | maxisbey | Design client-side caching for list_tools/list_prompts/list_resources | enhancement P3 | 2 | — | 146d |
| #1745 | maxisbey | Remove jsonschema dependency | enhancement P3 | 1 | — | 222d |
| #2111 | maxisbey | Support serializable session state for distributed deployments | enhancement P3 | — | — | 146d |
| #2806 | localden | Implement SEP-2663: Tasks Extension | enhancement | 6 | — | 39d |
| #1031 | davemssavage | Enable FastMCP to filter tools, prompts, resources using a fine grained policy | enhancement | 3 | — | 385d |
| #1305 | wenhuizhang | Feature Proposal: Secure Tool/Resource/Prompt Decorators with Auth + Encrypted I/O | enhancement | 2 | — | 324d |
| #2053 | maxisbey | Replace Field(description=...) with proper docstrings in auth models | enhancement | 1 | — | 152d |
| #1966 | somaraani | Per-Request Transport Configuration for MCP Clients | enhancement | 1 | — | 169d |
| #2052 | maxisbey | Audit MCPServer constructor parameters | enhancement | 1 | — | 152d |
| #2202 | maxisbey | Type the MCPServer handler pipeline: tool/resource/prompt return types | enhancement | — | — | 135d |
| #2153 | maxisbey | MCPServer handlers should raise exceptions, not return error objects | enhancement | — | — | 138d |
| #992 | andrey-star | Support granular OAuth2 flow with state and verifier persistence | enhancement | — | — | 390d |
| #1368 | vitorbal | OAuth client should support bi-phasic oauth flows | enhancement | — | — | 303d |
| #2135 | maxisbey | Public API for runtime handler registration/deregistration on low-level Server | enhancement | — | — | 141d |
| #2105 | maxisbey | Support custom method handlers with custom params and return types on MCPServer | enhancement | — | — | 146d |
| #2024 | nypdmax | Support multi-protocol authentication with spec-aligned discovery and OAuth fallback | enhancement | — | — | 156d |
| #2054 | maxisbey | Add dependency injection support to MCPServer | enhancement | — | — | 152d |
| #1319 | localden | Support selection of authorization servers from PRM document | enhancement | — | — | 322d |
Questions (7)
Inbox — answer, then close or convert to bug/enhancement.
answer (7) — No maintainer response yet, or reporter followed up.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #1277 | ilvalerione | How to get environment variables on the server? | question P2 | 2 | — | 334d |
| #1410 | asheshvidyut | Cancelling a Call Tool Request from Client | question P1 | 1 | — | 289d |
| #1512 | venetak | Add client subscription and server event broadcasting | question | 1 | — | 264d |
| #1521 | cfytrok | How to manually set client_id client_secret? | question | — | — | 260d |
| #1625 | cdreetz | Running Streamable HTTP Servers | question | — | — | 244d |
| #1798 | Junyi-99 | Guide: Resolving "421 Invalid Host Header" (DNS Rebinding Protection) | question P2 | 12 | — | 210d |
| #2501 | lottopotato | Was it a bad idea to stream the text generation process using Context.report_progress()? | question | — | — | 82d |
Docs (10)
Documentation issues.
docs (10) — Documentation issues — fold into a docs sprint.
| # | Author | Title | Labels | 💬 | 🤖 | Age |
|---|---|---|---|---|---|---|
| #431 | Gelembjuk | Question: How to authorise a client with Bearer header with SSE? | documentation P1 | 18 | — | 467d |
| #457 | alnickle | Documentation for mcp command flags | documentation P1 | 2 | — | 463d |
| #498 | dgzxx-2000 | How do python clients and servers use prompt | documentation P1 | 4 | — | 459d |
| #539 | z29 | We need some more client and sampling examples and use-cases. | documentation P1 | 9 | — | 453d |
| #702 | Westerby | Auth for MCP - Starlette middleware vs. OAuthAuthorizationServerProvider | documentation P1 | 7 | — | 428d |
| #880 | karthich | [horizontal scaling] How to actually build session persistence in streamable http MCP server? | documentation P1 | 22 | — | 407d |
| #1205 | yarnabrina | Controlling Context in Client for Sampling Requests | documentation P1 | 11 | — | 353d |
| #1464 | felixweinberger | Improve docs on how to use `instructions` on `InitializeResult` | documentation P1 | 4 | — | 278d |
| #339 | exeex | [docs] How to run FastMCP with args or env vars? | documentation P2 | 2 | — | 481d |
| #766 | CakeCrusher | (discussion) How to best handle instrumenting for `resources` and `prompts` | documentation P2 | 2 | — | 420d |
Volume
Open Issues
↓
3.68%131
Opened
—3
last 7 days
Opened
—20
last 30 days
Opened
—77
last 90 days
Closed
—6
last 7 days
Closed
—33
last 30 days
Closed
—60
last 90 days
Response Time
Time to first maintainer response
Average
—36d
Median
—6d
P90
—94d
P95
—233d
Stale Issues
Issues with no activity
Stale
↓
6.74%83
>30 days
Stale
—76
>60 days
Stale
—65
>90 days
Reopen Rate
—100%
Issues by Label
| Label | Count |
|---|---|
| enhancement | 68 |
| bug | 45 |
| area-auth | 36 |
| needs confirmation | 27 |
| P2 | 13 |
| ready for work | 12 |
| P3 | 8 |
| documentation | 7 |
| question | 4 |
| help wanted | 3 |
| blocked | 2 |
| P1 | 1 |
| area-infrastructure | 1 |
Issues Awaiting Maintainer Response
Sorted by longest wait time first
| Issue | Title | Labels | Comments | Waiting |
|---|---|---|---|---|
| #236 | Pass context from request endpoint to message handler | enhancementneeds confirmation | 2 | 463d |
| #350 | MAUI application create mcp client throw exception:The server shut down unexpectedly. | bug | 5 | 447d |
| #433 | McpServerPrimitiveCollection needs transactions/updates | enhancementneeds confirmation | 0 | 422d |
| #450 | Resource-based authorization on tools | enhancementarea-auth+1 | 0 | 415d |
| #611 | Host several MCP in one ASP.Net application | questionneeds confirmation | 1 | 369d |
| #623 | Allow tools to continue running when session is closed | enhancement | 1 | 365d |
| #640 | Dictionary<string, JsonElement> overload for CallToolAsync | enhancement | 0 | 358d |
| #648 | OAuth authentication request fails with MS Entra-ID | area-authready for work | 4 | 354d |
| #654 | When Absolute Uri passed as McpAuthenticationOptions.ResourceMetadataUri, /.well-known/oauth-protected-resource endpoint returns 404 | bugarea-auth | 2 | 352d |
| #659 | AspNetCore TestHost client transport | enhancement | 0 | 350d |
| #657 | Release signed binaries in nuget package | enhancement | 0 | 350d |
| #667 | MCP Framework Tool Invocation Fails Based on Method Name Despite Identical Implementation | bug | 2 | 347d |
| #681 | Not able to authenticate MCP Servers | bugarea-auth | 6 | 342d |
| #684 | Using incorrect oauth-authorization-server endpoint | bugarea-auth+1 | 1 | 342d |
| #689 | ProtectedMcpServer sample doesn't work with VSCode auth flow | bugarea-auth | 0 | 341d |
| #720 | Passing ACR_VALUES TO Token Endpoint | enhancement | 0 | 329d |
| #738 | Server-side keep-alive Scheduler for SSE responses | bug | 0 | 321d |
| #752 | How can a server using the SSE (Server-Sent Events) model over HTTP support additional content like images within the conversational context? | enhancement | 2 | 315d |
| #788 | Passing a malformed body throws a 500 error instead of 400. Very hard to figure out what is incorrect in the request being issued by the caller | bug | 0 | 300d |
| #812 | Support PRM subpaths per RFC 9728 (multiple resources per host) | enhancementarea-auth | 0 | 295d |
| #814 | Is there a way to run multiple stateful MCP servers? | enhancementneeds confirmation | 4 | 294d |
| #842 | OAuth Flow not working for Atlassian MCP and Github MCP | bugarea-auth | 4 | 279d |
| #887 | Scopes not forwarded to DCR endpoint and duplication of RedirectUris | bugarea-auth | 0 | 271d |
| #889 | Make EverythingServer capable of running either stdio or http | enhancement | 0 | 271d |
| #917 | Support externally sourced JWT in Auth header from MCP client | enhancementarea-auth | 2 | 264d |
| #932 | Transfer-Encoding=Chunked causes issues with locally run Azure Functions | bug | 0 | 256d |
| #964 | 403 error with Authorization Bearer | needs confirmation | 2 | 242d |
| #1026 | Provide an example of how to connect telemetry with Application Insights | enhancement | 1 | 232d |
| #1052 | Practical OAuth implementation for production | documentationhelp wanted+2 | 0 | 224d |
| #1126 | Request for Sample: ASP.NET Core MCP Client with One Persisted Connection Per User Session | documentationhelp wanted+1 | 5 | 197d |
| #1150 | Allow JsonSerializerOptions without TypeInfoResolver | bug | 0 | 181d |
| #1166 | Github copilot not setting bearer token on acces to tools. | bugarea-auth | 2 | 177d |
| #1172 | Support using WithStreamServerTransport for multiple in-process mcp servers | bug | 0 | 173d |
| #1216 | Version-Based Tool Registration for MCP Server | enhancement | 0 | 166d |
| #1236 | Specified ClientOAuthOptions.Scopes are ignored | bugarea-auth+1 | 1 | 162d |
| #1287 | Add DeleteStreamsForSessionAsync to ISseEventStreamStore | enhancementready for work+1 | 0 | 149d |
| #1314 | Custom filters | enhancementready for work+1 | 0 | 145d |
| #1389 | Sample: stdio-to-HTTP bridge for AI clients that only support stdio transport | documentationenhancement | 0 | 140d |
| #1413 | Export Control Classification Number for these packages? | documentationquestion | 0 | 131d |
| #1446 | [Auth] OAuth proxy / DCR facade for non-DCR providers (e.g. Entra ID + Claude Code) | enhancementarea-auth | 3 | 119d |
| #1470 | McpClient.CreateAsync times out behind APIM in .NET SDK while MCP Inspector/Azure AI Foundry succeed | bugP2 | 0 | 110d |
| #1487 | Authorization Server & Protected Resource Metadata inspection | enhancementarea-auth | 0 | 105d |
| #1482 | Built-in server-side support for incremental scope consent (SEP-835) | enhancementarea-auth | 0 | 105d |
| #1494 | [Documentation request] Authentication architecture suggestions | documentationenhancement | 3 | 104d |
| #1526 | `AutoDetect` transport hides the real error: surfaces 405 to the user when the server actually returned 415 | bug | 0 | 85d |
| #1539 | 2026-07-28 Spec Compliance | (unlabeled) | 0 | 76d |
| #1545 | SEP-837: Update authorization spec to clarify client type requirements | area-auth | 4 | 75d |
| #1556 | Method not found: 'System.String Microsoft.Extensions.AI.HostedMcpServerTool.get_AuthorizationToken() | bug | 0 | 74d |
| #1557 | Option to support declarative tool registration activated by version (e.g. "beta") | enhancement | 0 | 73d |
| #1571 | SEP-2468: Recommend Issuer (iss) Parameter in MCP Auth Responses | area-auth | 1 | 63d |
| #1580 | Streamable HTTP server accepts mismatched header/body protocol versions on `initialize` | bugneeds confirmation | 0 | 60d |
| #1587 | OAuth token refresh fails with AADSTS9010010 | bugarea-auth | 0 | 57d |
| #1601 | StdioClientTransportOptions is failing with space in Command | bug | 1 | 51d |
| #1602 | McpServerToolCreateOptions miss MarshalResult option. | enhancement | 0 | 50d |
| #1606 | the context.RequestAborted not reliable in HandleSseRequestAsync | bug | 0 | 48d |
| #1608 | MCP Apps: Add round-trip integration test for _meta.ui serialization | enhancement | 1 | 47d |
| #1607 | MCP Apps: Add ergonomic WithAppTool helper to reduce wiring boilerplate | enhancement | 0 | 47d |
| #1612 | Can't implement a CIMD client if auth provider doesn't put "none" first in it's list of supported token auth methods | bugarea-auth | 0 | 46d |
| #1614 | Stdio requests with deeply nested params can remain pending while the server remains healthy | bug | 0 | 44d |
| #1636 | MCP Apps: Add [McpAppResource] attribute and resource-collection processing in WithMcpApps() | enhancement | 0 | 35d |
| #1673 | Tool annotation default values are not applied | bugneeds confirmation | 0 | 18d |
| #1690 | Optional exception summarization for server-side logging | enhancement | 1 | 9d |
Volume
Open Issues
↓
2.70%36
Opened
—0
last 7 days
Opened
—13
last 30 days
Opened
—43
last 90 days
Closed
—1
last 7 days
Closed
—8
last 30 days
Closed
—23
last 90 days
Response Time
Time to first maintainer response
Average
—25d
Median
↓
34.34%5d
P90
—66d
P95
—79d
Stale Issues
Issues with no activity
Stale
↓
12.50%21
>30 days
Stale
—17
>60 days
Stale
—8
>90 days
Reopen Rate
—100%
Issues by Label
| Label | Count |
|---|---|
| bug | 10 |
| enhancement | 5 |
Issues Awaiting Maintainer Response
Sorted by longest wait time first
| Issue | Title | Labels | Comments | Waiting |
|---|---|---|---|---|
| #151 | tier-check: support monorepos with multiple SDK packages | (unlabeled) | 0 | 149d |
| #182 | tier-check reports 0/30 server conformance despite all tests passing | (unlabeled) | 0 | 131d |
| #223 | Workload Identity Federation (SEP-1933) - Client Conformance | (unlabeled) | 0 | 95d |
| #226 | Add scenario option to authorization server conformance test | enhancement | 1 | 91d |
| #225 | Add JSON-based setup option to authorization server conformance test | enhancement | 0 | 91d |
| #244 | Proposal: Tasks conformance scenarios (spec 2025-11-25) | (unlabeled) | 1 | 82d |
| #258 | Add support for a stdio testing | enhancement | 2 | 77d |
| #266 | Add SEP-2575 conformance tests | (unlabeled) | 1 | 64d |
| #274 | initialize scenario test server violates specification causing client failure | bug | 0 | 62d |
| #315 | caching scenario should use DRAFT-2026-v1 | bug | 1 | 52d |
| #312 | server-stateless doesn't set `mcp-method` etc. | bug | 1 | 52d |
| #323 | SEP-2243: ServerRejectsMissingMethodHeader contradicts TypeScript SDK behavior | (unlabeled) | 7 | 47d |
| #338 | dns-rebinding-protection client never sends notifications/initialized after a successful initialize (2025-11-25 path) | (unlabeled) | 0 | 34d |
| #345 | CI does not smoke-test client CLI path; everything-client drift on elicitation-sep1034-client-defaults and sse-retry | bug | 1 | 28d |
| #370 | Authorization Server Auth: DPoP Token Binding (SEP-1932) | (unlabeled) | 0 | 19d |
| #369 | Server Auth: DPoP Proof Validation (SEP-1932) | (unlabeled) | 0 | 19d |
| #382 | server-stateless: `sep-2575-http-server-no-independent-requests-on-stream` probe never declares the elicitation capability its own fixture requires | bug | 0 | 13d |
| #379 | Fix SEP-986(-ish) strict tool name checks: align with SHOULD semantics and 2025-11-25 spec | bug | 0 | 13d |
| #378 | Add conformance test (2025-06-18+): servers MUST reject JSON-RPC batch requests | bug | 0 | 13d |
Volume
Open Issues
↑
4.92%64
Opened
—2
last 7 days
Opened
—9
last 30 days
Opened
—40
last 90 days
Closed
—0
last 7 days
Closed
—2
last 30 days
Closed
—5
last 90 days
Response Time
Time to first maintainer response
Average
—78d
Median
↑
99.68%83d
P90
—137d
P95
—144d
Stale Issues
Issues with no activity
Stale
↑
35.00%54
>30 days
Stale
—37
>60 days
Stale
—29
>90 days
Reopen Rate
—100%
Issues by Label
| Label | Count |
|---|---|
| bug | 23 |
| enhancement | 20 |
| question | 1 |
Issues Awaiting Maintainer Response
Sorted by longest wait time first
| Issue | Title | Labels | Comments | Waiting |
|---|---|---|---|---|
| #9 | What does "bundle a complete virtual environment" mean? | question | 3 | 383d |
| #10 | How to specify platform-specific overrides based on CPU architecture? | enhancement | 4 | 383d |
| #35 | Local development workflow doesn't work | bug | 1 | 379d |
| #54 | ENOENT no such file or directory, open '/path/to/manifest.json' | bug | 1 | 371d |
| #68 | Proposal: Add `post_install` and `post_uninstall` script hooks to DXT manifest | enhancement | 3 | 366d |
| #71 | Code signing requires private key PEM, but providers (e.g., Certum) don’t provide private key for download | enhancement | 2 | 365d |
| #91 | Low severity vulnerabilities introduced by dxt | bug | 0 | 328d |
| #149 | Feat: Tool icons | enhancement | 0 | 255d |
| #164 | Support oauth settings | enhancement | 2 | 232d |
| #165 | Feature Request: Add enum/dropdown support for user_config fields | enhancement | 1 | 224d |
| #176 | Support for remote MCP servers (streamable HTTP transport) | enhancement | 1 | 189d |
| #177 | Feature Request: Declarative Filesystem Permissions in MCPB Manifest | enhancement | 1 | 188d |
| #179 | Feature Request: Add server.type = "bash" for Bash-based MCP servers | enhancement | 1 | 181d |
| #180 | Incompatibility with native modules (ABI mismatch) in Node.js bundles | (unlabeled) | 2 | 179d |
| #182 | Feature Request: Support for MCP servers integrated with native applications | enhancement | 2 | 177d |
| #202 | support configuration of an already installed MCP server | enhancement | 1 | 126d |
| #218 | [BUG] mcpb validate warns about icon size even for 512x512 PNGs | bug | 1 | 115d |
| #219 | Filesystem MCP write_file returns success but files don't exist (Claude Desktop 1.1.8308, macOS) | bug | 1 | 113d |
| #223 | [BUG] Claude Desktop (Windows MSIX) — MSIX registry silo prevents all C:\Windows\System32\OpenSSH\ binaries from executing in child processes | bug | 0 | 106d |
| #224 | Feature Request: Bundle Attestation for API Backend Verification | (unlabeled) | 4 | 103d |
| #225 | Claude Desktop (Store): stdio MCP tools discovered but tools/call never reaches server (regression) | bug | 0 | 99d |
| #226 | Claude Desktop crashes on invalid semver in manifest version field | (unlabeled) | 0 | 92d |
| #229 | macOS: UtilityProcess rejects third-party native Node modules due to library validation (distinct from #180) | (unlabeled) | 1 | 91d |
| #232 | Desktop Extension submission status inquiry — Overboard Studio | (unlabeled) | 0 | 87d |
| #235 | mcpb pack on Windows produces .mcpb without Unix file permissions | bug | 0 | 77d |
| #236 | Claude Desktop: Local DXT connector tool calls never dispatched after MCP handshake (silent timeout) | bug | 0 | 76d |
| #240 | 채팅 검색 시 프로젝트에 속한 채팅분류 | enhancement | 0 | 72d |
| #239 | 채팅 일부 삭제기능 건의 | enhancement | 0 | 72d |
| #238 | Freeze on mounting folders in claude coworkers | bug | 1 | 72d |
| #241 | Default EXCLUDE_PATTERNS in mcpb pack is too broad | bug | 0 | 69d |
| #244 | Claude Desktop: sensitive user_config fields displayed in plain text in environment variables panel | (unlabeled) | 2 | 64d |
| #247 | Feature request: Native connector for Bloom.io | enhancement | 0 | 61d |
| #250 | Claude Desktop: substitute `user_config` options with no value | bug | 0 | 48d |
| #251 | Claude Desktop: substitute `${HOME}` in `user_config` defaults | bug | 0 | 47d |
| #256 | Textos en ingles con idioma español | bug | 0 | 39d |
| #260 | Signing/verification is non-functional: PKCS#7 signature never verified (node-forge stub), fails closed | (unlabeled) | 1 | 36d |
| #267 | Minor correctness/robustness fixes: empty-string override, secret logging, version precedence, ZIP bounds | (unlabeled) | 0 | 36d |
| #266 | mcpb unpack: unbounded in-memory decompression (zip-bomb DoS) | (unlabeled) | 0 | 36d |
| #265 | Resolved mcp_config still contains the full platform_overrides map | (unlabeled) | 0 | 36d |
| #264 | mcpb clean silently drops unknown nested manifest keys (loose .passthrough() is top-level only) | (unlabeled) | 0 | 36d |
| #263 | Strict 0.4 schema still requires server.mcp_config for uv type (contradicts spec + loose schema; incomplete fix of #201) | (unlabeled) | 0 | 36d |
| #262 | replaceVariables interpolates the variable key into a RegExp unescaped (over-match + crash/ReDoS) | (unlabeled) | 0 | 36d |
| #261 | mcpb unpack fails on archives containing directory entries (unusable on standard ZIP/.mcpb files) | (unlabeled) | 0 | 36d |
| #258 | replaceVariables corrupts user_config values containing $ (String.replace replacement-pattern footgun) | (unlabeled) | 0 | 36d |
| #276 | verifyMcpbFile always reports signed extensions as "unsigned" (node-forge pkcs7.verify() is an unimplemented stub) | (unlabeled) | 0 | 34d |
| #278 | `mcpb sign` produces bundles that strict zip parsers reject - including Claude Desktop itself ("Invalid comment length") | bug | 4 | 33d |
| #277 | `mcpb verify` reports every signed bundle as "Extension is not signed" (node-forge `p7.verify` is unimplemented) | bug | 1 | 33d |
| #280 | Register an icon for the .mcpb document type in Claude Desktop | (unlabeled) | 0 | 33d |
| #281 | Installing .mcpb | bug | 1 | 32d |
| #282 | Claude Desktop (macOS): an "Install Unpacked" type: binary extension is never launched — host falls back to "basic execution" and fails with ENOENT | bug | 0 | 31d |
| #283 | [Bug] User-level MCPB install silently never completes (org-level succeeds) | (unlabeled) | 1 | 29d |
| #284 | Drag-to-Settings install silently fails; double-click works (docs mismatch) | bug | 0 | 29d |
| #285 | Cowork: tool-call markup rendered as raw text + executions stall with no progress indicator | bug | 0 | 27d |
| #288 | "HRESULT 0x80073D28 설치 실패 - 레지스트리 키 손상" | bug | 0 | 15d |
| #289 | Add advanced agent workflow features from CLI to VS Code extension | enhancement | 0 | 14d |
| #290 | MCPB file doesn't install the server even though server is running | bug | 4 | 10d |
| #291 | Please Read: Issues with uv runtime | (unlabeled) | 0 | 5d |
| #292 | `mcpb pack` fails with a cryptic ELOOP error when the extension directory contains a symlink cycle | (unlabeled) | 1 | 2d |
Volume
Open Issues
↑
8.60%101
Opened
—7
last 7 days
Opened
—11
last 30 days
Opened
—44
last 90 days
Closed
—0
last 7 days
Closed
—1
last 30 days
Closed
—7
last 90 days
Response Time
Time to first maintainer response
Average
—22d
Median
—4d
P90
—69d
P95
—89d
Stale Issues
Issues with no activity
Stale
↑
3.80%82
>30 days
Stale
—66
>60 days
Stale
—44
>90 days
Reopen Rate
—100%
Issues by Label
| Label | Count |
|---|---|
| enhancement | 39 |
| bug | 18 |
| protocol | 7 |
| v2 | 3 |
| documentation | 2 |
| needs more work | 1 |
| needs spec change | 1 |
| upstream-host | 1 |
| v1 | 1 |
Issues Awaiting Maintainer Response
Sorted by longest wait time first
| Issue | Title | Labels | Comments | Waiting |
|---|---|---|---|---|
| #26 | ui:// protocol needs to be registered with IANA | bug | 1 | 231d |
| #269 | SEP: Duplicate placement of `McpUiResourceMeta` in the resource metadata and the resource read value leads to confusion. | bug | 0 | 182d |
| #412 | Side Panels For Interactive Documents | enhancement | 0 | 168d |
| #423 | Angular based MCP apps example | enhancement | 1 | 162d |
| #481 | MCP Apps: No shared session identity between AppBridge and Model sub-connections | (unlabeled) | 1 | 151d |
| #458 | Multiple `initialize` calls per conversation breaks `Mcp-Session-Id` linking | (unlabeled) | 2 | 150d |
| #465 | Feature parity with Apps SDK setWidgetState | enhancement | 0 | 147d |
| #500 | Proposal: Slot-based updateModelContext() for independent context channels | (unlabeled) | 0 | 140d |
| #511 | [Proposal] Rich UI elicitation — attach an MCP App to an elicitation/create request | enhancement | 2 | 137d |
| #513 | [Proposal] Features for speeding up slow Python/ Pyodide based apps | enhancement | 1 | 135d |
| #515 | CSP: Clarify/Allow '*' and scheme-based policies | enhancement | 1 | 134d |
| #542 | PostMessageTransport: Race condition with srcdoc iframes — host misses ui/initialize | (unlabeled) | 2 | 129d |
| #558 | ui/update-model-context: How should hosts handle multiple instances of the same app resource? | (unlabeled) | 1 | 116d |
| #566 | [Proposal] Support web workers (`worker-src`) via `workerDomains` on `McpUiResourceCsp` | enhancement | 0 | 112d |
| #574 | `downloadFile` not implemented on Claude iOS (error -32601) | (unlabeled) | 1 | 108d |
| #598 | Feature Request: Contextual Inline Citations with Modal/Dialog Popups for MCP Apps | enhancement | 0 | 103d |
| #611 | Version negotiation mechanism exists but HOST behavior doesn't change based on negotiated version | (unlabeled) | 0 | 93d |
| #617 | server-pdf: get_viewer_state always returns pageCount: 1 and get_text returns empty in VS Code | (unlabeled) | 0 | 86d |
| #635 | Feature: Add Angular basic example | enhancement | 3 | 84d |
| #634 | Spec 2026-01-26: misleading "View initialize" example uses `initialize` + `clientInfo` instead of `ui/initialize` + `appInfo` | bug | 0 | 84d |
| #633 | bug: Safari/WebKit event.source identity mismatch in sandbox.ts relay breaks PostMessageTransport | (unlabeled) | 0 | 84d |
| #646 | basic-host does not forward toolResult _meta to the ui. | bug | 0 | 78d |
| #644 | v1.7.0 refreshRoots() clears allowedLocalDirs when host advertises roots capability but returns empty list — wipes CLI-arg directories | (unlabeled) | 1 | 78d |
| #647 | `tools/call` requests no longer echo `Mcp-Session-Id` (violates Streamable HTTP spec) | bug | 1 | 76d |
| #649 | app-bridge pulls in entire Zod library (~1.4MB pre-minified) - most of it unused | (unlabeled) | 0 | 74d |
| #652 | unsafe-eval warning is thrown from AJV via @modelcontextprotocol/sdk dependency | bug | 0 | 70d |
| #655 | McpUiHostCapabilities missing tools field — widget-declared tools unimplementable by hosts | (unlabeled) | 0 | 69d |
| #659 | Proposal: Allow Views to subscribe to server resource updates via resources/subscribe | (unlabeled) | 1 | 66d |
| #661 | ,. | enhancement | 1 | 58d |
| #664 | Clarification Request: Standardized Guidance for Detecting Malicious Patterns in Widget HTML | (unlabeled) | 0 | 53d |
| #665 | @modelcontextprotocol/ext-apps consumers ship ~140K of unused zod v4 locale files in browser bundles | (unlabeled) | 1 | 52d |
| #671 | Bug Report: MCP Apps UI Resource Not Rendering in Claude Desktop / claude.ai | bug | 5 | 49d |
| #676 | Should hostCapabilities.appTools exist? | (unlabeled) | 2 | 48d |
| #678 | Support configuring approved redirect domains for ui/open-link | enhancement | 4 | 46d |
| #682 | د | enhancement | 0 | 43d |
| #684 | Pinned or Split Screen MCP Apps | enhancement | 1 | 42d |
| #687 | fresh install of basic-host example fails | bug | 0 | 34d |
| #686 | autoResize misses absolutely-positioned portal growth (popover opens → no size-changed) | (unlabeled) | 0 | 34d |
| #688 | Minimal preferred size | (unlabeled) | 2 | 33d |
| #689 | Guidelines for hosts to support Command Line (CLI) MCP Apps | enhancement | 0 | 30d |
| #694 | Clarify host behavior for rendering an MCP App view when the tool result is an error (isError: true) | (unlabeled) | 2 | 14d |
| #696 | Claude Desktop strips structuredContent from ui/notifications/tool-result — views built per SDK examples render blank | (unlabeled) | 0 | 8d |
| #701 | Bug: file_manager widget renders content then infinite re-render loop (oncalltool handler replaced storm) in Claude Desktop | (unlabeled) | 1 | 7d |
| #702 | Migrate `ext-apps` to `@modelcontextprotocol/server` v2 SDK | enhancement | 1 | 6d |
| #704 | Emitted .d.ts use extensionless relative imports — types break under NodeNext/Node16 (addEventListener invisible, TS2339) | (unlabeled) | 0 | 4d |
| #703 | Add ui.homepage field for redirecting to the app's homepage | (unlabeled) | 0 | 4d |
| #708 | Align MCP Apps capability negotiation with SEP-2133 | (unlabeled) | 0 | 2d |
| #707 | Help | bug | 0 | 2d |
| #706 | Spec: Deprecate Sampling | (unlabeled) | 0 | 2d |
| #711 | Add your HVTrust badge to the README? | (unlabeled) | 0 | 0d |