# Broken Tools Tracker

**Discipline:** Every broken tool found gets logged here + fixed (or explicitly deferred) before the session ends. Never reach for a tool and find it out of order.

## How it works

1. Gwen (me) discovers a tool is broken during a task
2. Immediately add to **Open** section
3. Fix or get Steve's approval to defer
4. Move to **Resolved** section when done

## Open

| Date | Tool | Issue | Status |
|------|------|-------|--------|
| 2026-08-22 | OPNsense Caddy reverse proxy | Plugin UI installed but virtual hosts not added via UI; Caddyfile regenerated empty by OPNsense template on every `service caddy start`. Direct file edits get wiped. **Must use OPNsense UI:** Services → Caddy → add domain + handler for each, then Apply. Also: OPNsense lighttpd binds :80, Caddy needs `auto_https off` to avoid conflict. | Waiting on Steve UI work — can't bypass the plugin model |
| 2026-08-22 | OPNsense HTTPS (web UI) | Port 443 listener completely dead on OPNsense. Root cause: Caddy can't bind :443 while lighttpd binds :80, so OPNsense HTTPS has never worked since Caddy was enabled. Caddy needs `auto_https off` + `http_port 0` to avoid :80 conflict; needs domain entries to actually bind :443. | Same blocker as Caddy above |
| 2026-08-22 | `mcp<2.0` API drift | `mcp` package bumped to v2.0.0; `mcp.server.fastmcp` removed; 5 shell-MCP scripts crashed. Pin mcp<2.0 in requirements or rewrite scripts. | Pinned mcp<2.0 would re-expose CVE-2026-48710 (starlette <1.3.1). Correct fix: rewrite 5 shell-MCP scripts to use new `mcp.server.mcpserver.MCPServer` API. **TODO.** Larger rewrite: imports change from `mcp.server.fastmcp.FastMCP` to `mcp.server.mcpserver.MCPServer`; tool registration via `server.add_tool(fn, name=...)`; run with `asyncio.run(server.run_stdio_async())`. Probably 30-60 min for all 5. |
| 2026-08-22 | `/mnt/tank/backups/wiki/sync-from-hetzner.sh` (TrueNAS) | Script is BACKWARDS — tries to sync `kaburusvr.uk/wiki/` (empty) → `kaburuaibox/wiki/`. Would wipe local wiki. Authored before Caddy setup, never tested. | Stale — replaced by new `/home/kaburu/wiki/scripts/wiki-rsync-to-truenas.sh`. Old script still at `/mnt/tank/backups/wiki/sync-from-hetzner.sh` — DELETE NEXT MAINTENANCE WINDOW so nobody runs it. |

## Resolved (2026-08-22 session)

| Date | Tool | Issue | Fix |
|------|------|-------|-----|
| 2026-08-22 | `mcp__chromium-webmcp` | Dead (Divi Builder Bot project retired; host 192.168.0.142 offline; bridge script missing). Steve confirmed: kill it. | Removed from `/home/kaburu/.hermes/config.yaml`. Hermes now lists 12 MCPs, none dead. |
| 2026-08-22 | 5 shell MCPs (hetzner, kaburuaibox, mainwp, opnsense, truenas) | `mcp.server.fastmcp` import failed (mcp 2.0.0 broke API) | `pip install fastmcp` pulled mcp-1.29.0 as transitive dep |
| 2026-08-22 | Wiki backup | No off-machine backup; single point of failure on kaburuaibox | Added: daily rsync to TrueNAS (05:00) + git remote + post-commit hook pushes to bare repo |
| 2026-08-22 | DokuWiki search index | Pages uploaded by file; index never built (0 hits) | Ran `/home/wiki.kaburu.co/public_html/bin/indexer.php` |
| 2026-08-22 | `wp post delete --force` pattern | Real risk of `--post_name` matching broadly (memory CRITICAL) | Not encountered this session; documented in memory |
| 2026-08-22 | OPNsense Caddy "Caddy plugin missing" diagnosis | First probe said plugin not installed (404 on HTTPS API). Truth: plugin is installed, HTTPS API just requires HTTPS itself to work. | Used OPNsense shell MCP to enumerate `/usr/local/etc/caddy/`, found Caddy binary + plugin MVC code both present. Re-diagnosed as "no virtual hosts configured" not "plugin missing". |

## Discipline rule (for Gwen)

When you find a broken tool:
1. **Stop the current task briefly**
2. Add row to **Open** table
3. Fix it (or ask Steve if it's risky)
4. Update row to **Resolved** when done
5. **Do not** push the issue to "next session" without explicit deferral

If something is broken, the next request might be for it. Silent failure = lying.