Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Owner

Ducarv

Sign in to follow

1 indexed repository · View on GitHub

Beginner friendly Everything
Open All

Issues somebody may already be working on are listed last. List everything by date

  • Working directory of trusted project servers: ProjectPath vs fetching launchers (npx --yes)
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 30/100

    Ducarv/mcpmoat#104 ·

    Maintainers usually reply within 1 day

  • List resource templates (resources/templates/list) for the T1 rules
    Open
    • Is something wrong?
    area:inspect effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 62/100

    Ducarv/mcpmoat#103 ·

    Maintainers usually reply within 1 day

  • Pin the resolved IP of a remote MCP server for one inspection (DNS rebinding)
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 54/100

    Ducarv/mcpmoat#102 ·

    Maintainers usually reply within 1 day

  • Bound the decoded size of MCP list pages, not only the wire size
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 46/100

    Ducarv/mcpmoat#101 ·

    Maintainers usually reply within 1 day

  • Attribute HTTP status and blocked errors to the request that failed
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#100 ·

    Maintainers usually reply within 1 day

  • Keep MCP tool annotations in inspect.Result for rules and pins
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 45/100

    Ducarv/mcpmoat#99 ·

    Maintainers usually reply within 1 day

  • Warn when secrets go to a remote server over plain http://
    Open
    • Is something wrong?
    area:inspect effort:high model:sonnet phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 46/100

    Ducarv/mcpmoat#98 ·

    Maintainers usually reply within 1 day

  • Stop a server from hiding its tools from mcpmoat (client name, capability gating)
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 30/100

    Ducarv/mcpmoat#97 ·

    Maintainers usually reply within 1 day

  • Discover: check and read a project Codex config (<WorkDir>/.codex/config.toml)
    Open
    • Is something wrong?
    area:discover effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 45/100

    Ducarv/mcpmoat#90 ·

    Maintainers usually reply within 1 day

  • Discover: honour $CLAUDE_CONFIG_DIR and $CODEX_HOME
    Open
    • Is something wrong?
    area:cli area:discover effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#89 ·

    Maintainers usually reply within 1 day

  • Expand ${VAR} placeholders in server configs before inspect and rules
    Open
    • Is something wrong?
    area:inspect area:rules effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 35/100

    Ducarv/mcpmoat#88 ·

    Maintainers usually reply within 1 day

  • Discover: read the enabled and approval state of servers (Codex enabled = false)
    Open
    • Is something wrong?
    area:discover area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 35/100

    Ducarv/mcpmoat#87 ·

    Maintainers usually reply within 1 day

  • Codex reader: map env var name keys (bearer_token_env_var, env_http_headers, env_vars)
    Open
    • Is something wrong?
    area:discover effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#84 ·

    Maintainers usually reply within 1 day

  • Config readers for VS Code, Claude Desktop, Windsurf
    Open
    • Is something wrong?
    area:discover effort:high good first issue help wanted model:haiku phase:2 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#81 ·

    Maintainers usually reply within 1 day

  • Phase 4 spec: data-flow control (lethal trifecta policies in the proxy)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:4 type:docs

    Difficulty 5/5 Over a week Newbie friendliness 52/100

    Ducarv/mcpmoat#80 ·

    Maintainers usually reply within 1 day

  • Phase 3 spec: trust score (mcpmoat vet <package>)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:3 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 68/100

    Ducarv/mcpmoat#79 ·

    Maintainers usually reply within 1 day

  • Phase 2 spec: local firewall (proxy, approve, quarantine, allowlist, local log)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:2 type:docs

    Difficulty 5/5 Over a week Newbie friendliness 38/100

    Ducarv/mcpmoat#78 ·

    Maintainers usually reply within 1 day

  • Test that no network calls happen without --llm
    Open
    • Is something wrong?
    effort:high model:opus phase:1 security type:test

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#77 ·

    Maintainers usually reply within 1 day

  • --llm risk classification per tool (opt-in, key from env, clear warning)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#76 ·

    Maintainers usually reply within 1 day

  • Tag and publish v1.0.0
    Open
    • Is something wrong?
    area:release effort:high model:haiku phase:1 type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 35/100

    Ducarv/mcpmoat#75 ·

    Maintainers usually reply within 1 day

  • Show HN and Reddit post drafts
    Open
    • Is something wrong?
    effort:high model:haiku phase:1 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 68/100

    Ducarv/mcpmoat#74 ·

    Maintainers usually reply within 1 day

  • Launch blog post draft
    Open
    • Is something wrong?
    effort:high model:sonnet phase:1 type:docs

    Difficulty 3/5 1-2 days Newbie friendliness 46/100

    Ducarv/mcpmoat#73 ·

    Maintainers usually reply within 1 day

  • Record the "three attacks detected" demo with vhs
    Open
    • Is something wrong?
    effort:high model:haiku phase:1 type:docs

    Difficulty 3/5 1-2 days Newbie friendliness 72/100

    Ducarv/mcpmoat#72 ·

    Maintainers usually reply within 1 day

  • Final README: demo GIF, one-line install, limitations, credits
    Open
    • Is something wrong?
    effort:high model:sonnet phase:1 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 62/100

    Ducarv/mcpmoat#71 ·

    Maintainers usually reply within 1 day

  • End-to-end acceptance test: mcpmoat scan detects T1 to T5
    Open
    • Is something wrong?
    effort:high model:opus phase:1 type:test

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#70 ·

    Maintainers usually reply within 1 day

  • Docs: using mcpmoat in CI and as a git/pre-commit hook
    Open
    • Is something wrong?
    area:report effort:high model:haiku phase:1 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 84/100

    Ducarv/mcpmoat#69 ·

    Maintainers usually reply within 1 day

  • Homebrew tap Ducarv/homebrew-tap and GoReleaser formula publishing
    Open
    • Is something wrong?
    area:release area:report effort:high model:sonnet phase:1 type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#68 ·

    Maintainers usually reply within 1 day

  • Release workflow with GitHub artifact attestation and pinned actions
    Open
    • Is something wrong?
    area:release area:report effort:high model:opus phase:1 security type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 54/100

    Ducarv/mcpmoat#67 ·

    Maintainers usually reply within 1 day

  • GoReleaser: static binaries for darwin/linux amd64/arm64 with checksums
    Open
    • Is something wrong?
    area:release area:report effort:high model:sonnet phase:1 type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 62/100

    Ducarv/mcpmoat#66 ·

    Maintainers usually reply within 1 day

  • Exit codes 0/1/2 and --fail-on (default high), with tests
    Open
    • Is something wrong?
    area:report effort:high model:opus phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#65 ·

    Maintainers usually reply within 1 day

  • --json output with a stable, versioned schema and a JSON Schema file
    Open
    • Is something wrong?
    area:report effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#64 ·

    Maintainers usually reply within 1 day

  • Terminal report: per-server summary, findings by severity, colours, risk + remediation
    Open
    • Is something wrong?
    area:report effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#63 ·

    Maintainers usually reply within 1 day

  • Rug-pull fixture and integration test
    Open
    • Is something wrong?
    area:pins effort:high model:haiku phase:1 type:test

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#62 ·

    Maintainers usually reply within 1 day

  • `mcpmoat pin --accept <server>`
    Open
    • Is something wrong?
    area:cli area:pins effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#61 ·

    Maintainers usually reply within 1 day

  • Detect new, removed and changed tools and show a text diff
    Open
    • Is something wrong?
    area:pins effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#60 ·

    Maintainers usually reply within 1 day

  • pins.json store with versioned format and atomic writes (XDG_CONFIG_HOME)
    Open
    • Is something wrong?
    area:pins effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#59 ·

    Maintainers usually reply within 1 day

  • Canonical serialisation and SHA-256 per tool, stable across key order
    Open
    • Is something wrong?
    area:pins effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 45/100

    Ducarv/mcpmoat#58 · 1 comment ·

    Maintainers usually reply within 1 day

  • Malicious fixture servers reproducing T1 to T5
    Open
    • Is something wrong?
    area:rules effort:high model:sonnet phase:1 type:test

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#57 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T5-001: Server or package name close to a popular server
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#56 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-004: Auto-install flags (--yes / -y) on package runners
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 52/100

    Ducarv/mcpmoat#55 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-003: Unpinned package version (@latest or no version)
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#54 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-002: Plaintext secret in env or headers
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#53 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-001: Remote server over plain http://
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 50/100

    Ducarv/mcpmoat#52 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T3-001: Description changes the behaviour of another tool (shadowing)
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#51 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-008: Base64 payload in description
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#49 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-007: Oversized tool description
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#48 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-006: Invisible or bidirectional Unicode characters
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 55/100

    Ducarv/mcpmoat#47 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-005: Description asks to send data to a URL (exfiltration)
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 55/100

    Ducarv/mcpmoat#46 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-004: Description mentions reading sensitive local files
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 55/100

    Ducarv/mcpmoat#45 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-003: Tool description tells the model to hide actions from the user
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#44 ·

    Maintainers usually reply within 1 day

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.