Problem
The MCP create_finding tool accepts finding content/severity/scope fields but fails under API-key authentication with User ID is required. The tool schema has no userId input, and an API-key auth context does not provide the user identity required by the controller/service.
Reproduction
- Authenticate to the Comp MCP with an organization API key.
- Call
create_finding with valid content, severity, framework type, and an optional task/area reference.
- Observe
User ID is required.
Expected
Either:
- API-key finding creation should attribute the record to a supported API-key/system actor, or
- the MCP auth flow/tool should obtain and forward an authorized user identity through a documented mechanism.
The published tool schema and supported API-key authentication path should be mutually satisfiable, with an integration test for finding creation through MCP.
Security/privacy
No organization IDs, task IDs, finding content, or customer details are included in this report.
Problem
The MCP
create_findingtool accepts finding content/severity/scope fields but fails under API-key authentication withUser ID is required. The tool schema has nouserIdinput, and an API-key auth context does not provide the user identity required by the controller/service.Reproduction
create_findingwith valid content, severity, framework type, and an optional task/area reference.User ID is required.Expected
Either:
The published tool schema and supported API-key authentication path should be mutually satisfiable, with an integration test for finding creation through MCP.
Security/privacy
No organization IDs, task IDs, finding content, or customer details are included in this report.