Issues

• modern stdlib API opportunities: duplicated manual last_four slicing, retain() eviction count discarded

  enhancementlibP4tap
  bug-ops/tap-mcp-bridge#257 · Filter by author bug-ops opened on Aug 8, 2026

• tap-mcp-server main.rs duplicates the ACRO consumer-context block across ~9 MCP request structs

  binenhancementmcpP2
  bug-ops/tap-mcp-bridge#256 · Filter by author bug-ops opened on Aug 8, 2026

• APC payment data fields are unvalidated Strings; PaymentMethod::to_json hand-rolls serde tag

  enhancementlibP3tap
  bug-ops/tap-mcp-bridge#255 · Filter by author bug-ops opened on Aug 8, 2026

• transport HTTP method dispatch uses &str instead of http::Method, unknown methods fail at runtime

  enhancementlibP3
  bug-ops/tap-mcp-bridge#254 · Filter by author bug-ops opened on Aug 8, 2026

• ACRO and APC signing logic (create/compute_signature/signature_base) is structurally duplicated

  enhancementlibP3tap
  bug-ops/tap-mcp-bridge#253 · Filter by author bug-ops opened on Aug 8, 2026

• Ed25519 JWK thumbprint computation duplicated between jwk.rs and signer.rs

  enhancementlibP2tap
  bug-ops/tap-mcp-bridge#252 · Filter by author bug-ops opened on Aug 8, 2026

• reliability::retry_with_backoff and CircuitBreaker are never invoked from any merchant call path

  enhancementlibP2
  bug-ops/tap-mcp-bridge#251 · Filter by author bug-ops opened on Aug 8, 2026

• process_payment MCP tool bypasses rate limiting entirely — process_payment_rate_limited never called

  buglibmcpP1security
  bug-ops/tap-mcp-bridge#250 · Filter by author bug-ops opened on Aug 8, 2026

• no mutation-testing coverage on crypto/signing critical paths

  enhancementlibP3test
  bug-ops/tap-mcp-bridge#249 · Filter by author bug-ops opened on Aug 8, 2026

• 60 test sites use assert!(matches!(...)) instead of stable assert_matches! (needs MSRV 1.94 -> 1.96+)

  enhancementlibP3test
  bug-ops/tap-mcp-bridge#247 · Filter by author bug-ops opened on Aug 8, 2026

• no criterion benchmark coverage for any RFC 9421/JWE/ACRO/APC/JWT/nonce-cache critical path

  enhancementlibP2test
  bug-ops/tap-mcp-bridge#246 · Filter by author bug-ops opened on Aug 8, 2026

• unbounded response body reads allow memory-exhaustion DoS from merchant responses

  buglibmcpP2security
  bug-ops/tap-mcp-bridge#245 · Filter by author bug-ops opened on Aug 8, 2026

• currency fields are unvalidated Strings, no Money type pairs amount with currency

  enhancementlibmcpP2
  bug-ops/tap-mcp-bridge#244 · Filter by author bug-ops opened on Aug 8, 2026

• execute_tap_request_with_acro discards ACRO on every body-bearing call (add_to_cart, update_cart_item, remove_from_cart, subscription mutations)

  buglibmcpP1
  bug-ops/tap-mcp-bridge#242 · Filter by author bug-ops opened on Aug 8, 2026

• audit-log redaction helpers panic on non-ASCII input and near-end dashes (CWE-190 / char-boundary slicing)

  buglibP2security
  bug-ops/tap-mcp-bridge#241 · Filter by author bug-ops opened on Aug 8, 2026

• mcp/http.rs: near-duplicate TAP request executors, merchant error body discarded on non-2xx

  enhancementlibmcpP2
  bug-ops/tap-mcp-bridge#240 · Filter by author bug-ops opened on Aug 8, 2026
  1

• process_payment discards ACRO/ID-token signature, never transmits contextual fraud-signal data

  buglibmcpP1tap
  bug-ops/tap-mcp-bridge#239 · Filter by author bug-ops opened on Aug 8, 2026
  1

• Prometheus metrics documented as delivered but never wired to any endpoint

  binbugdocumentationP2
  bug-ops/tap-mcp-bridge#238 · Filter by author bug-ops opened on Aug 8, 2026

• track Google AP2 / x402 as an emerging parallel agent-payments standard alongside Visa TAP

  enhancementP4
  bug-ops/tap-mcp-bridge#237 · Filter by author bug-ops opened on Aug 8, 2026
  1

• no RSA-PSS-SHA256 signing support; official TAP reference agent supports it alongside Ed25519

  enhancementP2securitytap
  bug-ops/tap-mcp-bridge#236 · Filter by author bug-ops opened on Aug 8, 2026

• ed25519-dalek pinned to 3.0.0-rc.0 in Cargo.toml even though stable 3.0.0 is resolved and published

  dependenciesP3
  bug-ops/tap-mcp-bridge#235 · Filter by author bug-ops opened on Aug 8, 2026

• refresh Cargo.lock: 26 transitive packages behind (rmcp 3.1.0→3.1.2, aws-lc-rs, thiserror, etc.)

  dependenciesP2
  bug-ops/tap-mcp-bridge#234 · Filter by author bug-ops opened on Aug 8, 2026
  2

• Low: unreachable RUSTSEC-2026-0235 (rkyv) lock entry and duplicate dependency versions in Cargo.lock

  dependenciesP3security
  bug-ops/tap-mcp-bridge#233 · Filter by author bug-ops opened on Aug 8, 2026

• High: merchant AuthConfig (API key / Bearer / OAuth2) is parsed and validated but never applied to outgoing requests

  bugP1security
  bug-ops/tap-mcp-bridge#232 · Filter by author bug-ops opened on Aug 8, 2026

• High: TapVerifier commits replay-protection nonce before verifying signature, enabling unauthenticated cache-exhaustion DoS

  bugP1security
  bug-ops/tap-mcp-bridge#231 · Filter by author bug-ops opened on Aug 8, 2026