Issues

• Claude Code guards for main and secret files never block: $CLAUDE_TOOL_INPUT and $CLAUDE_FILE_PATHS are unset, and they exit 1

  fiscaltec/vitally-mcp#192 · Filter by author faizjamal0111-svg opened on Oct 18, 2026

• content: describe trait merge and null-to-remove on create/update tools

  contentpriority: mediumstatus: ready
  fiscaltec/vitally-mcp#191 · Filter by author searledan opened on Oct 15, 2026

• ops: measure how many audit records trace sampling dropped before #178 deployed

  opspriority: lowstatus: ready
  fiscaltec/vitally-mcp#185 · Filter by author searledan opened on Oct 2, 2026

• ops: verify #94 phase 6 signals in Application Insights, and where exception-bearing logs land

  opspriority: mediumstatus: blocked
  fiscaltec/vitally-mcp#184 · Filter by author searledan opened on Oct 2, 2026
  1

• security: caller-typed path segments reach AppDependencies through outbound HttpClient spans

  priority: mediumsecuritystatus: ready
  fiscaltec/vitally-mcp#183 · Filter by author searledan opened on Oct 2, 2026

• security: record how stale a permission tier was, not only whether (tierAgeSeconds)

  priority: lowsecuritystatus: ready
  fiscaltec/vitally-mcp#176 · Filter by author searledan opened on Sep 29, 2026

• tech-debt: one tools/call asks Graph three times during an outage — the SDK evaluates [Authorize] twice

  priority: lowstatus: readytech-debt
  fiscaltec/vitally-mcp#175 · Filter by author searledan opened on Sep 29, 2026

• ops: build the observability dashboards and alerts once the signals exist

  opspriority: mediumstatus: blocked
  fiscaltec/vitally-mcp#159 · Filter by author searledan opened on Sep 22, 2026
  2

• documentation: the two-switch Key Vault window is described but not runnable — its code block elides the commands

  documentationpriority: mediumstatus: ready
  fiscaltec/vitally-mcp#154 · Filter by author searledan opened on Sep 21, 2026

• security: replace the Entra client secret with a federated identity credential, removing the rotation obligation

  priority: mediumsecuritystatus: ready
  fiscaltec/vitally-mcp#153 · Filter by author searledan opened on Sep 21, 2026
  2

• ops: run the staging read-only guard procedure once, then decide whether it should be this complex

  opspriority: mediumstatus: ready
  fiscaltec/vitally-mcp#135 · Filter by author searledan opened on Sep 16, 2026
  1

• tech-debt: publish nullable tool parameters as anyOf rather than an array-valued type

  priority: lowstatus: readytech-debt
  fiscaltec/vitally-mcp#128 · Filter by author searledan opened on Sep 3, 2026

• security: reject ID tokens at /mcp by requiring a scope claim

  priority: lowsecuritystatus: ready
  fiscaltec/vitally-mcp#126 · Filter by author searledan opened on Sep 3, 2026

• chore: strip and clamp OAuth parameter names case-insensitively in the proxy forwarding loops

  priority: lowstatus: readytech-debt
  fiscaltec/vitally-mcp#123 · Filter by author searledan opened on Sep 1, 2026

• Decide whether Azure environment identifiers should stay in the repo, then apply it consistently

  priority: lowsecuritystatus: ready
  fiscaltec/vitally-mcp#96 · Filter by author searledan opened on Aug 21, 2026

• ops: apply per-tier retention, with the audit table at 365 days against a one-year requirement

  opspriority: highstatus: blocked
  fiscaltec/vitally-mcp#93 · Filter by author searledan opened on Aug 21, 2026
  4

• Add MRTR confirmation prompts before destructive tool calls

  featurepriority: lowstatus: blocked
  fiscaltec/vitally-mcp#91 · Filter by author searledan opened on Aug 21, 2026