Skip to content

MCP Security And Troubleshooting

Security and permissions

  • visibility checks use standard Easy8 visibility rules
  • tool actions respect regular Easy8 permissions such as issue creation and editing
  • the endpoint should only be enabled when it is intended for API clients or agent integrations

Write-tool safety

Write tools use Easy8 model visibility, permissions, validations, and safe_attributes where available.

The MCP server does not expose delete tools.

Validation errors and permission failures are returned as tool-level errors with isError: true.

Error handling

Expect both HTTP-level and JSON-RPC-level errors.

HTTP level examples:

  • 401 - missing or invalid API authentication
  • 404 - MCP disabled
  • 405 - unsupported HTTP method on /mcp

JSON-RPC level examples:

  • parse error for invalid JSON payloads
  • invalid request for malformed JSON-RPC payloads
  • method not found for unsupported MCP methods
  • tool-level business errors returned in tool output

/mcp returns 404

Check that Settings -> AI -> Enable MCP is enabled.

POST /mcp returns 401

Check that the request includes a valid Easy8 API key.

Tool call returns permission errors

Check the permissions of the API key owner in Easy8. The MCP server does not bypass Easy8 authorization.

Tool is missing from tools/list

For core tools, check that the service class loads successfully.

For plugin tools, check that the plugin is installed, enabled, and that its available_if predicate returns true.

Tool call returns validation errors

Check required fields, required custom fields, and project-specific workflow restrictions. MCP write tools reuse Easy8 model validations.