matimo

TypeScript Hard

tallclub/matimo

10 stars

7 forks

3 open issues

Active Mar 2026

Beginner-Friendly Issues 3

Issues tagged for new contributors

View all on GitHub

[BUG] matimo-instance.ts — reloadTools() has a quarantine logic gap

#71 · Mar 22, 2026

Hard

[BUG] Policy validation - all rules only fire when context.source === 'untrusted'.

#70 · Mar 22, 2026

Hard

bug help wanted good first issue

Matimo treats `_matimo_approved: true` from the MCP request as authoritative and bypasses the server-side approval callback. If the LLM/client can set that flag automatically, it defeats the safety guarantee of approvals. Mandatory: do not allow client-supplied args to bypass approval by default; instead introduce an explicit server option (e.g., `trustClientApproval`) defaulting to false, or require server-side ApprovalHandler/HITL confirmation even when `_matimo_approved` is true (use the flag only as a user-confirmed signal when the transport guarantees it).

#69 · Mar 20, 2026

Hard

bug help wanted good first issue

Sign in required

Authenticate to use favourites & bookmarks

5