Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug]: Deleting an MCP proxy leaves its API keys in the gateway's memory and in the policy engine

Open Beginner friendly
  • Is something wrong?
#3,852 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
83/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
backend, security

Research direction

In gateway/gateway-controller/pkg/eventlistener, start with handleEvent and compare MCP proxy DELETE handling with the REST API path. The issue names TestHandleEvent_APIDelete_RemovesAPIKeysFromMemoryAndXDS as the existing reference; add a corresponding MCP proxy test using the described config store and mock. Done means the proxy’s keys are removed from the store and RemoveAPIKeysByAPI is called once.

Written by the indexing model from the issue text.

Description

Aspect/API Aspect/Other Severity/Minor Type/Bug
Please select the area the issue is related to

Gateway

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI), Aspect/Other (Anything else which does not match above categories)

Description

When a REST API is deleted, the gateway controller removes the API's keys from three places: the database, the in-memory store, and the policy engine's API key state (xDS). When an MCP proxy is deleted, only the database rows are removed. The keys stay in the controller's in-memory store and in the policy engine until the gateway controller restarts.

On delete REST API MCP proxy
Database rows (api_keys) Removed by DeleteConfig Removed by DeleteConfig
In-memory store (store.RemoveAPIKeysByAPI) Removed Kept
Policy engine API key state (apiKeyXDSManager.RemoveAPIKeysByAPI) Removed Kept
Steps to Reproduce

The leftover state is internal: the policy engine's config_dump does not list API keys. So the clearest reproduction is the unit-level one below. It uses the same setup as the existing REST test.

  1. In gateway/gateway-controller/pkg/eventlistener, build an EventListener with a storage.NewConfigStore(), a mock apiKeyXDSManager, and an MCP proxy config (testMCPStoredConfig(...)) added to the store.
  2. Add an API key for the proxy to the store: store.StoreAPIKey(&models.APIKey{ArtifactUUID: <proxy uuid>, ...}).
  3. Send eventhub.Event{EventType: eventhub.EventTypeMCPProxy, Action: "DELETE", EntityID: <proxy uuid>} to listener.handleEvent.
  4. Check the store's API keys for the proxy, and the mock's recorded RemoveAPIKeysByAPI calls.

Expected: the key is gone from the store, and RemoveAPIKeysByAPI was called once for the proxy, as for a REST API in TestHandleEvent_APIDelete_RemovesAPIKeysFromMemoryAndXDS.

Actual: the key is still in the store, and RemoveAPIKeysByAPI is never called.

Severity Level of the Issue

Severity/Minor (Non-critical functionality. Can be fixed in future releases)

Environment Details (with versions)

gateway-controller

Dominant language
Go
Stars
76
Forks
126
Avg merge
2d 10h
Merged PRs (30d)
183

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from wso2/api-platform

All issues in wso2/api-platform

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.