Search results

MCPB Desktop Extensions Submission Form is not accessible

Status: Open.

#275 In modelcontextprotocol/mcpb;

· gangchzu opened on Jun 10, 2026

Minor correctness/robustness fixes: empty-string override, secret logging, version precedence, ZIP bounds

Status: Open.

#267 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

mcpb unpack: unbounded in-memory decompression (zip-bomb DoS)

Status: Open.

#266 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

Resolved mcp_config still contains the full platform_overrides map

Status: Open.

#265 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

mcpb clean silently drops unknown nested manifest keys (loose .passthrough() is top-level only)

Status: Open.

#264 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

Strict 0.4 schema still requires server.mcp_config for uv type (contradicts spec + loose schema; incomplete fix of #201)

Status: Open.

#263 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

replaceVariables interpolates the variable key into a RegExp unescaped (over-match + crash/ReDoS)

Status: Open.

#262 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

mcpb unpack fails on archives containing directory entries (unusable on standard ZIP/.mcpb files)

Status: Open.

#261 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

Signing/verification is non-functional: PKCS#7 signature never verified (node-forge stub), fails closed

Status: Open.

#260 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

replaceVariables corrupts user_config values containing $ (String.replace replacement-pattern footgun)

Status: Open.

#258 In modelcontextprotocol/mcpb;

· aosmcleod opened on Jun 8, 2026

Textos en ingles con idioma español

bugSomething isn't workingSomething isn't working

Status: Open.

#256 In modelcontextprotocol/mcpb;

· jlurbieta opened on Jun 5, 2026

Claude Desktop: substitute ${HOME} in user_config defaults

bugSomething isn't workingSomething isn't working

Status: Open.

#251 In modelcontextprotocol/mcpb;

· pl4nty opened on May 29, 2026