Skip to content

MCP create_finding cannot satisfy required user identity with API-key auth #3540

Description

@filipenevola

Problem

The MCP create_finding tool accepts finding content/severity/scope fields but fails under API-key authentication with User ID is required. The tool schema has no userId input, and an API-key auth context does not provide the user identity required by the controller/service.

Reproduction

  1. Authenticate to the Comp MCP with an organization API key.
  2. Call create_finding with valid content, severity, framework type, and an optional task/area reference.
  3. Observe User ID is required.

Expected

Either:

  • API-key finding creation should attribute the record to a supported API-key/system actor, or
  • the MCP auth flow/tool should obtain and forward an authorized user identity through a documented mechanism.

The published tool schema and supported API-key authentication path should be mutually satisfiable, with an integration test for finding creation through MCP.

Security/privacy

No organization IDs, task IDs, finding content, or customer details are included in this report.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions