You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Boards: add an Incoming status to both boards, adopt the v2 Priority field, and document the triage rubric #1891
Two gaps surfaced while triaging the 154 unlabeled open issues.
1. There is no board state for "filed but not yet triaged."AGENTS.md defines four Status options — Todo, In Progress, In Review, Done — and describes Todo as "approved-but-not-started work." So a newly filed issue has nowhere to sit that distinguishes nobody has looked at this yet from a maintainer approved it and it is queued. During the sweep this mattered: the 22 issues left open as v2 are awaiting maintainer review, and parking them in Todo would have falsely asserted they were approved.
2. The board's Priority field exists but is unused and undocumented. Board #28 carries a Priority single-select left over from the project template. Zero of the 264 items had it set, AGENTS.md never mentions it, and its options (P0/P1/P2) match no vocabulary used anywhere in the repo. Meanwhile there is no written rule for how to decide that an issue is urgent — priority has been implicit in whoever was triaging.
Adopt the Priority field with the vocabulary Urgent / High / Medium / Low.
Document a scoring rubric so priority is derived rather than asserted: severity (1-5) + urgency/staleness (1-5) + signal bonuses, summed and banded into the four levels.
Document all of it in AGENTS.md — the new Status option in the board recipes table, the Priority field and option IDs alongside the Status ones, and the rubric as its own section.
Notes
Both board mutations are done and verified. updateProjectV2Field full-replaces the option list, so each ran with every existing option's id echoed back; the Status mutation was verified card-by-card afterward (all 264 statuses unchanged, all four prior option IDs preserved). See the hazard callout in AGENTS.md.
The Priority re-option was risk-free in ordering terms because no card had a value set.
The board recipes and their IDs are deliberately not mirrored into .github/copilot-instructions.md — that file is scoped to what a reviewer cites against a diff.
changed the title [-]Board: add an Incoming status, adopt the Priority field, and document the triage scoring rubric[/-][+]Boards: add an Incoming status to both boards, adopt the v2 Priority field, and document the triage rubric[/+]on Aug 1, 2026
Scope widened to cover the v1 board (#11) as well. Retitled accordingly.
Board #11 had the same gap #28 did — no state for "filed but not yet triaged" — so a v1 security-fix issue had nowhere to sit that didn't assert maintainer approval. Incoming has been added there (831820cf), with all four existing option ids echoed back; a before/after item-list diff confirms all 74 cards kept their Status.
AGENTS.md also carried no v1 board recipes at all, only a link to the project. Anyone boarding a v1 issue had to discover the project and field ids by hand, and was liable to reach for #28's — which are rejected, but only after the attempt. The PR adds a V1 board section with its ids, states that Incoming is the default status for new items on both boards, and records that Priority is v2-only (#11 has no such field).
Two incidental notes:
Three cards on get tools working #11 already carry no Status. That predates this change — confirmed by the before/after diff — and is not evidence of an orphaning event.
The rubric scored this 11/15 (severity 4 + urgency 4 + 2 signals), landing it in High. Overriding to Urgent per maintainer judgment — recording the reason here, as the rubric itself requires of any override.
The justification: this issue is now load-bearing for the board's own integrity. It carries the Incoming column both boards depend on, the option IDs that recipes are copied from verbatim, and — after the Done deletion incident — the snapshot-and-recover procedure. Until it merges, AGENTS.md documents a Done option ID that no longer exists (248a3910), so anyone following the merge step today fails. That's a documentation defect actively misdirecting work, which the severity axis doesn't capture well: it scores impact on users of the Inspector, and this one's blast radius is the contributor workflow instead.
Also cleared the org-level Fields → Priority value that had been set to Urgent on this issue. That field is a modelcontextprotocol org-wide issue field (IFSS_kgDOAdAWeg, shared with typescript-sdk, servers, registry) and is not the board Priority — nothing syncs the two, which is how this issue came to show Urgent in Fields and High on the board at the same time. The board card is the source of truth; PR #1892 documents the distinction so the next person doesn't have to rediscover it.
Deleting a label removes it from every issue that carried it, and GitHub keeps no record. This comment is that record, so the deletion stays reversible from a durable location rather than a scratch directory.
Deleted 2026-08-01 as part of this issue: the four p* labels were an earlier, undocumented priority scheme superseded by the board Priority field, and needs-triage was superseded by the Incoming column. Two mechanisms for one decision is how #929 came to carry p1-high while the rubric scored it Medium.
Every affected issue was already closed — verified before deletion, 0 open across all five labels — so nothing in the live queue lost a signal.
Recreate each definition with the colour and description above, then re-apply it to the issues listed. Re-applying a label to a closed issue does not reopen it, so a restore would not disturb the #1872 deprecation sweep.
# Example for one label; repeat per row above.
gh api -X POST repos/modelcontextprotocol/inspector/labels \
-f name='p1-high' -f color='d93f0b' -f description='High priority - should be addressed soon'fornin<numbers>;do gh issue edit "$n" --repo modelcontextprotocol/inspector --add-label p1-high; sleep 0.5;done
Closed by #1892, squash-merged into v2/main. (Auto-close doesn't fire here — Closes #N only closes on PRs targeting the default branch, and v2 PRs target v2/main.)
Activity
docs: correct the Done option id and harden the deleted-column guidan…
[-]Board: add an Incoming status, adopt the Priority field, and document the triage scoring rubric[/-][+]Boards: add an Incoming status to both boards, adopt the v2 Priority field, and document the triage rubric[/+]cliffhall commentedon Aug 1, 2026
Scope widened to cover the v1 board (#11) as well. Retitled accordingly.
Board #11 had the same gap #28 did — no state for "filed but not yet triaged" — so a v1 security-fix issue had nowhere to sit that didn't assert maintainer approval.
Incominghas been added there (831820cf), with all four existing option ids echoed back; a before/afteritem-listdiff confirms all 74 cards kept their Status.AGENTS.mdalso carried no v1 board recipes at all, only a link to the project. Anyone boarding a v1 issue had to discover the project and field ids by hand, and was liable to reach for #28's — which are rejected, but only after the attempt. The PR adds a V1 board section with its ids, states that Incoming is the default status for new items on both boards, and records that Priority is v2-only (#11 has no such field).Two incidental notes:
Doneoption on get tools working #11 isPURPLE, the same colour asIn Progress. Cosmetic, and left alone, but it makes the two columns harder to tell apart at a glance than on Add tab and approval flow for server -> client sampling #28 where Done isGRAY.docs: add Incoming to the v1 board and document its recipes (#1891)
cliffhall commentedon Aug 1, 2026
Priority overridden: High → Urgent.
The rubric scored this 11/15 (severity 4 + urgency 4 + 2 signals), landing it in High. Overriding to Urgent per maintainer judgment — recording the reason here, as the rubric itself requires of any override.
The justification: this issue is now load-bearing for the board's own integrity. It carries the
Incomingcolumn both boards depend on, the option IDs that recipes are copied from verbatim, and — after theDonedeletion incident — the snapshot-and-recover procedure. Until it merges,AGENTS.mddocuments aDoneoption ID that no longer exists (248a3910), so anyone following the merge step today fails. That's a documentation defect actively misdirecting work, which the severity axis doesn't capture well: it scores impact on users of the Inspector, and this one's blast radius is the contributor workflow instead.Also cleared the org-level
Fields → Priorityvalue that had been set to Urgent on this issue. That field is amodelcontextprotocolorg-wide issue field (IFSS_kgDOAdAWeg, shared with typescript-sdk, servers, registry) and is not the board Priority — nothing syncs the two, which is how this issue came to showUrgentin Fields andHighon the board at the same time. The board card is the source of truth; PR #1892 documents the distinction so the next person doesn't have to rediscover it.docs: distinguish the board Priority from the org-level issue field (#…
docs: mark the org Priority field untrusted and cap it at a +1 signal (…
docs: drop the /15 denominator caveat now the recorded scores are res…
cliffhall commentedon Aug 1, 2026
Archive: deleted priority + triage labels
Deleting a label removes it from every issue that carried it, and GitHub keeps no record. This comment is that record, so the deletion stays reversible from a durable location rather than a scratch directory.
Deleted 2026-08-01 as part of this issue: the four
p*labels were an earlier, undocumented priority scheme superseded by the board Priority field, andneeds-triagewas superseded by theIncomingcolumn. Two mechanisms for one decision is how #929 came to carryp1-highwhile the rubric scored it Medium.Every affected issue was already closed — verified before deletion, 0 open across all five labels — so nothing in the live queue lost a signal.
Definitions
p0-critical#b60205p1-high#d93f0bp2-medium#fbca04p3-low#0e8a16needs-triage#a35033Which issues carried what
All closed. Listed newest first.
p0-critical— never applied to any issue.p1-high(18) — SSE transport crashes with "Not connected" error when multiple connections occur #1014 v0.18.0 in Streamable HTTP direct failed on OAuth 401 #982 [BUG] TypeError: Controller is already closed when connecting to fastmcp Streamable HTTP transport #951 Add Support for SEP-1330: Elicitation Enum Schema Improvements to Inspector #933 Add Support for SEP-1686: Tasks to Inspector #931 Regression from 0.16.8 to 0.17 regarding default null values in tools #846 Duplicate redirect URIs generated by DebugInspectorOAuthClientProvider cause DCR failure #825 Regression in OAuth 2.0 Flow with Client ID in 0.16.8 #824 OAuth Quick Flow lands on blank page #785 "Connect button" OAuth flow does not honor scopes_supported like Auth Settings does #748 MCP Inspector OAuth Flow – Handling Unsupported resource Parameter with AAD Federation #737 Regression (OAuth flow): Calling token endpoint does not honor "token_endpoint_auth_methods_supported" #726 The inspector does not follow the spec according to authorization senarios #675 Token refresh flow is not implemented #665 [Auth] Fails to Use JWT Token, Enters Infinite OAuth Loop #633 [Auth] OAuth flow does not supportresourceMetadataUrl#576 Metadata discovery - handlingopenid-configurationnot justoauth-authorization-server#563 npx @modelcontextprotocol/inspector not using current PATH #375p2-medium(25) — Streamable HTTP WWW-Authenticate Challenge Broken on 0.17.5 #960 Allow for string values in token response #912 CLI: Progress notifications not captured, preventing timeout reset functionality #880 Phantom dependencies in@modelcontextprotocol/inspector#873 OAuth 2.0 Flow scopes are ignored when building authorization URL #863 Bug Report: Windows Path Parsing Error in commend parameters #853 Authentication Header not coming through with TypeScript SDK 1.18.2 #829 Inspector OAuth token request fails on public hosted authorization server #759 Missing MCP-Protocol-Version: <protocol-version> during Server Metadata Discovery #758 CLI tools/list command can be incomplete #753 UNABLE_TO_GET_ISSUER_CERT_LOCALLY #743 Inspector auth debug view shows incorrect metadata URL path in details #742 SSE reconnect does not include Last-Event-ID header #723 Published docker image loads 0.3.0 instead of true latest version #721 OAuth Dynamic Client Registration fails with strict providers due to client_uri mismatch #710 Inspector does not check client_secret_expires_at #691 Negotiated mcp-protocol-version gets lost at the proxy layer #679 Incorrect call for resource_metadata_url #663 MCP inspector abruptly stopping authentication flow after PRM discovery #659 MCP inspector UI hangs / times out if the MCP server throws an error #655 STDIO server not restarting after disconnect #654 The "Clear OAuth State" button doesn't actually seem to clear thelastBearerToken#628 Structured form not rendering for complex input objects in v0.10.2 (regression from v0.9.0) #332 SettingSERVER_PORTdoesn't cascade through to launching the client endpoint #256 Specify transport type on startup #255p3-low(7) — UI not using full window width due to place-items: center on <body> #876 Copy button overlaps long text in Inspector output #769 Version publishing lag between components to NPM #725 Auth Discussion - Support Azure Auth Server #685 Running in dev mode broken on Windows #550 inspector does not send the sampling capability as available in the initialize command #382 return error: _b.throwIfAborted is not a function. #319needs-triage(14) — # MCP Inspector Bug Report: URL Scheme Error in Web UI #943 MCP Inspector starts Authorization Code Flow with wrong redirect_uri #930 Inspector adds invalid trailing slash if resource is pathless URL #927 Missing or invalid access token error when using HOST and ALLOWED_ORIGINS #923 Inspector does not update CLient ID field after DCR /register call #910 Client Secret Bug: Confidential OAuth Clients Fail Due to Missing client_id Parameter #909 Connection Error - Check if your MCP server is running and proxy token is correct #908 Streamable HTTP: header Mcp-Session-Id is not set for "notifications/initialized" request #905 OAuth 2.0 Flow scopes are ignored when building authorization URL #863 "Clear OAuth State" should clear all discovered URLs #857 Too strict resource name validation 0.17.0 #855 Direct connection with streamable http transport on stateful servers fails #841 Authenticating error with OAuth2.1 using FastMCP with AzureProvider #783 Token refresh flow is not implemented #665To restore
Recreate each definition with the colour and description above, then re-apply it to the issues listed. Re-applying a label to a closed issue does not reopen it, so a restore would not disturb the #1872 deprecation sweep.
docs: describe the board-option hazard per field, not Status-only (#1891
docs: add Incoming to both boards, adopt the v2 Priority field, and d…
cliffhall commentedon Aug 2, 2026
Closed by #1892, squash-merged into
v2/main. (Auto-close doesn't fire here —Closes #Nonly closes on PRs targeting the default branch, and v2 PRs targetv2/main.)