Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Ducarv/mcpmoat

Sign in to follow View on GitHub

Personal MCP firewall: offline scanner for malicious or tampered MCP servers (Go CLI)

Is Ducarv/mcpmoat beginner-friendly?

The maintainers of Ducarv/mcpmoat usually reply to a pull request within 1 day. 4 beginner-friendly issues are open now.

Stars
1
Forks
0
Open beginner issues
4
Indexed issues
87
Avg merge
6h 31m
Merged PRs (30d)
9
Dominant language
Go
License
Apache-2.0
Last GitHub push
Oct 17, 2026
Latest indexed
Oct 17, 2026
Contributing guide
No code of conduct
Beginner labels
help wanted good first issue

How to contribute to Ducarv/mcpmoat

  1. Read the contributing guide first: it says how the maintainers want changes proposed, tested and reviewed.
  2. Your contributions will be published under the project's Apache-2.0 license.
  3. Pick one of the 4 open beginner-friendly issues below and comment that you want to work on it before you start.
Beginner friendly Everything
Open All

Issues somebody may already be working on are listed last. List everything by date

  • Working directory of trusted project servers: ProjectPath vs fetching launchers (npx --yes)
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 30/100

    Ducarv/mcpmoat#104 ·

    Maintainers usually reply within 1 day

  • List resource templates (resources/templates/list) for the T1 rules
    Open
    • Is something wrong?
    area:inspect effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 62/100

    Ducarv/mcpmoat#103 ·

    Maintainers usually reply within 1 day

  • Pin the resolved IP of a remote MCP server for one inspection (DNS rebinding)
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 54/100

    Ducarv/mcpmoat#102 ·

    Maintainers usually reply within 1 day

  • Bound the decoded size of MCP list pages, not only the wire size
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 46/100

    Ducarv/mcpmoat#101 ·

    Maintainers usually reply within 1 day

  • Attribute HTTP status and blocked errors to the request that failed
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#100 ·

    Maintainers usually reply within 1 day

  • Keep MCP tool annotations in inspect.Result for rules and pins
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 45/100

    Ducarv/mcpmoat#99 ·

    Maintainers usually reply within 1 day

  • Warn when secrets go to a remote server over plain http://
    Open
    • Is something wrong?
    area:inspect effort:high model:sonnet phase:1 security type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 46/100

    Ducarv/mcpmoat#98 ·

    Maintainers usually reply within 1 day

  • Stop a server from hiding its tools from mcpmoat (client name, capability gating)
    Open
    • Is something wrong?
    area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 30/100

    Ducarv/mcpmoat#97 ·

    Maintainers usually reply within 1 day

  • Discover: check and read a project Codex config (<WorkDir>/.codex/config.toml)
    Open
    • Is something wrong?
    area:discover effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 45/100

    Ducarv/mcpmoat#90 ·

    Maintainers usually reply within 1 day

  • Discover: honour $CLAUDE_CONFIG_DIR and $CODEX_HOME
    Open
    • Is something wrong?
    area:cli area:discover effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#89 ·

    Maintainers usually reply within 1 day

  • Expand ${VAR} placeholders in server configs before inspect and rules
    Open
    • Is something wrong?
    area:inspect area:rules effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 35/100

    Ducarv/mcpmoat#88 ·

    Maintainers usually reply within 1 day

  • Discover: read the enabled and approval state of servers (Codex enabled = false)
    Open
    • Is something wrong?
    area:discover area:inspect effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 35/100

    Ducarv/mcpmoat#87 ·

    Maintainers usually reply within 1 day

  • Codex reader: map env var name keys (bearer_token_env_var, env_http_headers, env_vars)
    Open
    • Is something wrong?
    area:discover effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#84 ·

    Maintainers usually reply within 1 day

  • Config readers for VS Code, Claude Desktop, Windsurf
    Open
    • Is something wrong?
    area:discover effort:high good first issue help wanted model:haiku phase:2 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#81 ·

    Maintainers usually reply within 1 day

  • Phase 4 spec: data-flow control (lethal trifecta policies in the proxy)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:4 type:docs

    Difficulty 5/5 Over a week Newbie friendliness 52/100

    Ducarv/mcpmoat#80 ·

    Maintainers usually reply within 1 day

  • Phase 3 spec: trust score (mcpmoat vet <package>)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:3 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 68/100

    Ducarv/mcpmoat#79 ·

    Maintainers usually reply within 1 day

  • Phase 2 spec: local firewall (proxy, approve, quarantine, allowlist, local log)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:2 type:docs

    Difficulty 5/5 Over a week Newbie friendliness 38/100

    Ducarv/mcpmoat#78 ·

    Maintainers usually reply within 1 day

  • Test that no network calls happen without --llm
    Open
    • Is something wrong?
    effort:high model:opus phase:1 security type:test

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#77 ·

    Maintainers usually reply within 1 day

  • --llm risk classification per tool (opt-in, key from env, clear warning)
    Open
    • Is something wrong?
    effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#76 ·

    Maintainers usually reply within 1 day

  • Tag and publish v1.0.0
    Open
    • Is something wrong?
    area:release effort:high model:haiku phase:1 type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 35/100

    Ducarv/mcpmoat#75 ·

    Maintainers usually reply within 1 day

  • Show HN and Reddit post drafts
    Open
    • Is something wrong?
    effort:high model:haiku phase:1 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 68/100

    Ducarv/mcpmoat#74 ·

    Maintainers usually reply within 1 day

  • Launch blog post draft
    Open
    • Is something wrong?
    effort:high model:sonnet phase:1 type:docs

    Difficulty 3/5 1-2 days Newbie friendliness 46/100

    Ducarv/mcpmoat#73 ·

    Maintainers usually reply within 1 day

  • Record the "three attacks detected" demo with vhs
    Open
    • Is something wrong?
    effort:high model:haiku phase:1 type:docs

    Difficulty 3/5 1-2 days Newbie friendliness 72/100

    Ducarv/mcpmoat#72 ·

    Maintainers usually reply within 1 day

  • Final README: demo GIF, one-line install, limitations, credits
    Open
    • Is something wrong?
    effort:high model:sonnet phase:1 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 62/100

    Ducarv/mcpmoat#71 ·

    Maintainers usually reply within 1 day

  • End-to-end acceptance test: mcpmoat scan detects T1 to T5
    Open
    • Is something wrong?
    effort:high model:opus phase:1 type:test

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#70 ·

    Maintainers usually reply within 1 day

  • Docs: using mcpmoat in CI and as a git/pre-commit hook
    Open
    • Is something wrong?
    area:report effort:high model:haiku phase:1 type:docs

    Difficulty 2/5 1-3 hours Newbie friendliness 84/100

    Ducarv/mcpmoat#69 ·

    Maintainers usually reply within 1 day

  • Homebrew tap Ducarv/homebrew-tap and GoReleaser formula publishing
    Open
    • Is something wrong?
    area:release area:report effort:high model:sonnet phase:1 type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#68 ·

    Maintainers usually reply within 1 day

  • Release workflow with GitHub artifact attestation and pinned actions
    Open
    • Is something wrong?
    area:release area:report effort:high model:opus phase:1 security type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 54/100

    Ducarv/mcpmoat#67 ·

    Maintainers usually reply within 1 day

  • GoReleaser: static binaries for darwin/linux amd64/arm64 with checksums
    Open
    • Is something wrong?
    area:release area:report effort:high model:sonnet phase:1 type:chore

    Difficulty 4/5 3-5 days Newbie friendliness 62/100

    Ducarv/mcpmoat#66 ·

    Maintainers usually reply within 1 day

  • Exit codes 0/1/2 and --fail-on (default high), with tests
    Open
    • Is something wrong?
    area:report effort:high model:opus phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#65 ·

    Maintainers usually reply within 1 day

  • --json output with a stable, versioned schema and a JSON Schema file
    Open
    • Is something wrong?
    area:report effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#64 ·

    Maintainers usually reply within 1 day

  • Terminal report: per-server summary, findings by severity, colours, risk + remediation
    Open
    • Is something wrong?
    area:report effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#63 ·

    Maintainers usually reply within 1 day

  • Rug-pull fixture and integration test
    Open
    • Is something wrong?
    area:pins effort:high model:haiku phase:1 type:test

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#62 ·

    Maintainers usually reply within 1 day

  • `mcpmoat pin --accept <server>`
    Open
    • Is something wrong?
    area:cli area:pins effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#61 ·

    Maintainers usually reply within 1 day

  • Detect new, removed and changed tools and show a text diff
    Open
    • Is something wrong?
    area:pins effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#60 ·

    Maintainers usually reply within 1 day

  • pins.json store with versioned format and atomic writes (XDG_CONFIG_HOME)
    Open
    • Is something wrong?
    area:pins effort:high model:sonnet phase:1 type:feature

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#59 ·

    Maintainers usually reply within 1 day

  • Canonical serialisation and SHA-256 per tool, stable across key order
    Open
    • Is something wrong?
    area:pins effort:high model:opus phase:1 security type:feature

    Difficulty 5/5 Over a week Newbie friendliness 45/100

    Ducarv/mcpmoat#58 · 1 comment ·

    Maintainers usually reply within 1 day

  • Malicious fixture servers reproducing T1 to T5
    Open
    • Is something wrong?
    area:rules effort:high model:sonnet phase:1 type:test

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#57 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T5-001: Server or package name close to a popular server
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#56 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-004: Auto-install flags (--yes / -y) on package runners
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 52/100

    Ducarv/mcpmoat#55 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-003: Unpinned package version (@latest or no version)
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#54 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-002: Plaintext secret in env or headers
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#53 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T4-001: Remote server over plain http://
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 50/100

    Ducarv/mcpmoat#52 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T3-001: Description changes the behaviour of another tool (shadowing)
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 55/100

    Ducarv/mcpmoat#51 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-008: Base64 payload in description
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 52/100

    Ducarv/mcpmoat#49 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-007: Oversized tool description
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#48 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-006: Invisible or bidirectional Unicode characters
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 55/100

    Ducarv/mcpmoat#47 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-005: Description asks to send data to a URL (exfiltration)
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 55/100

    Ducarv/mcpmoat#46 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-004: Description mentions reading sensitive local files
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 3/5 1-2 days Newbie friendliness 55/100

    Ducarv/mcpmoat#45 ·

    Maintainers usually reply within 1 day

  • Rule MOAT-T1-003: Tool description tells the model to hide actions from the user
    Open
    • Is something wrong?
    area:rules effort:high good first issue help wanted model:haiku phase:1 type:rule

    Difficulty 4/5 3-5 days Newbie friendliness 48/100

    Ducarv/mcpmoat#44 ·

    Maintainers usually reply within 1 day

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.