-
Notifications
You must be signed in to change notification settings - Fork 628
Pull requests: IBM/mcp-context-forge
Author
Label
Projects
Milestones
Reviews
Assignee
Sort
Pull requests list
[Security][ICACF-16] Strengthen account lockout to prevent brute-force attacks
#4348
opened Apr 20, 2026 by
MohanLaksh
Collaborator
Loading…
8 tasks done
feat: implement dark/light mode theme toggle
#4347
opened Apr 20, 2026 by
vishu-bh
Collaborator
Loading…
fix: Move JWT from the session storage to cookie
#4345
opened Apr 20, 2026 by
gcgoncalves
Collaborator
Loading…
5 of 10 tasks
fix(security): prevent admin bypass from accessing private resources
api
REST API Related item
MUST
P1: Non-negotiable, critical requirements without which the product is non-functional or unsafe
rbac
Role-based Access Control
security
Improves security
#4341
opened Apr 20, 2026 by
bogdanmariusc10
Collaborator
Loading…
5 of 10 tasks
fix(security): add comprehensive input validation to all router query parameters
api
REST API Related item
MUST
P1: Non-negotiable, critical requirements without which the product is non-functional or unsafe
security
Improves security
#4337
opened Apr 20, 2026 by
bogdanmariusc10
Collaborator
Loading…
3 of 10 tasks
fix(security): block URL-encoded injection patterns in SecurityValidator.validate_url()
api
REST API Related item
MUST
P1: Non-negotiable, critical requirements without which the product is non-functional or unsafe
security
Improves security
#4335
opened Apr 20, 2026 by
bogdanmariusc10
Collaborator
Loading…
5 of 10 tasks
feat: Add SpanAttributeCustomizer plugin for customizable OpenTelemetry span attributes
#4331
opened Apr 20, 2026 by
vishu-bh
Collaborator
Loading…
[ICACF-15] Restrict gateway test endpoint to approved hosts - SSRF protection
bug
Something isn't working
enhancement
New feature or request
security
Improves security
#4329
opened Apr 20, 2026 by
MohanLaksh
Collaborator
Loading…
9 tasks done
fix(auth): resolve proxy auth database lookup for team/admin context
api
REST API Related item
MUST
P1: Non-negotiable, critical requirements without which the product is non-functional or unsafe
rbac
Role-based Access Control
chore(tests): remove plugin integration tests migrated to cpex-plugins
chore
Linting, formatting, dependency hygiene, or project maintenance chores
plugins
testing
Testing (unit, e2e, manual, automated, etc)
fix: enable MCP session pool and set max sessions per key to resolve stateful MCP server session isolation
#4283
opened Apr 17, 2026 by
Lang-Akshay
Collaborator
•
Draft
fix: rewrite bare /mcp to /mcp/ in MCPPathRewriteMiddleware so stream…
#4282
opened Apr 17, 2026 by
omorros
Contributor
Loading…
4 of 10 tasks
fix(sso): generic OIDC providers can now promote users to platform_admin
#4277
opened Apr 17, 2026 by
marekdano
Collaborator
Loading…
feat: add detailed plugin violation information to OTEL spans
#4272
opened Apr 17, 2026 by
vishu-bh
Collaborator
Loading…
6 tasks done
fix(testing): playwright admin_api fixture to stop duplicating JWT auth, fix linting
#4265
opened Apr 17, 2026 by
marekdano
Collaborator
Loading…
1 of 11 tasks
bugfix/3825-playwright-htmx-dom-detach
#4264
opened Apr 17, 2026 by
Nayana-R-Gowda
Collaborator
Loading…
4 tasks done
fix: clean up server_tool_association before tool deletion
bug
Something isn't working
ica
ICA related issues
release-fix
Critical bugfix required for the release
#4263
opened Apr 17, 2026 by
madhav165
Collaborator
Loading…
3 tasks done
fix(ui): A2A agent list now refreshes correctly after deletion
a2a
Support for A2A protocol
bug
Something isn't working
release-fix
Critical bugfix required for the release
ui
User Interface
#4260
opened Apr 17, 2026 by
rakdutta
Collaborator
Loading…
Feat/typescript playwright e2e 4246
#4255
opened Apr 16, 2026 by
omorros
Contributor
Loading…
6 of 10 tasks
fix: implement LRU eviction for SSL context cache and unify OAuth error handling
api
REST API Related item
SHOULD
P2: Important but not vital; high-value items that are not crucial for the immediate release
fix(observability): resolve A2A and plugin post-invoke silent-success traps
observability
Observability, logging, monitoring
SHOULD
P2: Important but not vital; high-value items that are not crucial for the immediate release
feat: resolve virtual servers by name in RFC 9728 well-known and MCP endpoints
#4237
opened Apr 16, 2026 by
smorand
Loading…
7 tasks done
fix(ui): Normalize team_id whitespace checks across all edit functions and server-side visibility guard
#4235
opened Apr 16, 2026 by
shoummu1
Collaborator
Loading…
4 tasks done
fix(admin): allow clearing passthrough_headers via gateway edit form
#4229
opened Apr 15, 2026 by
ecthelion77
Contributor
Loading…
5 tasks done
Previous Next
ProTip!
Exclude everything labeled
bug with -label:bug.