Issues

• Bearer challenge and auth status details deviate from RFC 6750 and the MCP authorization spec

  platformatic/mcp#384 · Filter by author mcollina opened on Oct 24, 2026

• Memory task store: the global cap evicts other principals' finished but unread task results

  platformatic/mcp#383 · Filter by author mcollina opened on Oct 24, 2026

• Legacy tasks/cancel reports a store failure as -32602 'task reached a terminal status'

  platformatic/mcp#382 · Filter by author mcollina opened on Oct 24, 2026

• Legacy tasks/cancel sends notifications/tasks/status to the cancelling session, not the session that created the task

  platformatic/mcp#381 · Filter by author mcollina opened on Oct 24, 2026

• With Redis, DELETE on one instance leaves the session's SSE stream open on another instance

  platformatic/mcp#380 · Filter by author mcollina opened on Oct 24, 2026

• Redis session store: two concurrent legacy SSE GETs on one instance both get 200 and every message goes to both streams

  platformatic/mcp#379 · Filter by author mcollina opened on Oct 24, 2026

• A plugin registration failure after the Redis client is created leaves Redis connections open and the process never exits

  platformatic/mcp#378 · Filter by author mcollina opened on Oct 24, 2026

• stdio shutdown runs not-yet-started batch entries against a closed app

  platformatic/mcp#375 · Filter by author mcollina opened on Oct 23, 2026

• A tool with a non-object outputSchema is served unchanged to 2025-11-25 clients

  platformatic/mcp#374 · Filter by author mcollina opened on Oct 23, 2026

• Client ID Metadata Document does not work when resourceUri has a path

  platformatic/mcp#373 · Filter by author mcollina opened on Oct 23, 2026

• OAuth token requests omit the RFC 8707 resource parameter

  platformatic/mcp#372 · Filter by author mcollina opened on Oct 23, 2026

• prompts/get accepts non-string argument values

  platformatic/mcp#371 · Filter by author mcollina opened on Oct 23, 2026

• Legacy list methods ignore invalid cursors

  platformatic/mcp#370 · Filter by author mcollina opened on Oct 23, 2026

• Declaring logging makes legacy clients call logging/setLevel, which is not implemented

  platformatic/mcp#369 · Filter by author mcollina opened on Oct 23, 2026

• Memory session store replays nothing when Last-Event-ID has been trimmed

  platformatic/mcp#368 · Filter by author mcollina opened on Oct 23, 2026

• With Redis, a legacy session can hold an SSE stream on two instances at once

  platformatic/mcp#367 · Filter by author mcollina opened on Oct 23, 2026

• Broadcasts sent while a legacy SSE client reconnects are lost

  platformatic/mcp#366 · Filter by author mcollina opened on Oct 23, 2026

• OAuth callback does not validate the RFC 9207 iss parameter

  platformatic/mcp#365 · Filter by author mcollina opened on Oct 23, 2026

• Redis session history streams never expire

  platformatic/mcp#364 · Filter by author mcollina opened on Oct 23, 2026

• Redis broker unsubscribe() never releases the Redis channel

  platformatic/mcp#363 · Filter by author mcollina opened on Oct 23, 2026

• README: the Resource URI Schemas example's file://documents/* pattern only matches that literal URI

  platformatic/mcp#361 · Filter by author mcollina opened on Oct 21, 2026

• Legacy tasks/get, tasks/result and tasks/cancel accept a non-string taskId

  platformatic/mcp#360 · Filter by author mcollina opened on Oct 21, 2026

• Legacy tools/call treats any task value, including null, as a task request

  platformatic/mcp#359 · Filter by author mcollina opened on Oct 21, 2026

• Legacy POST accepts messages that are not JSON-RPC 2.0

  platformatic/mcp#344 · Filter by author mcollina opened on Oct 19, 2026

• HEAD /mcp with enableSSE opens an SSE session and never sends headers

  platformatic/mcp#343 · Filter by author mcollina opened on Oct 19, 2026