MCP Server - All POST/UPDATE operations broken on current main (worked on a6d25a0cb)

[jledoze]

Environment:

OS: macOS
Package manager: uv
MCP Client: Claude Desktop
Repository: CISO-Assistant MCP Server (cli directory)

Issue Summary:
The MCP server's POST and UPDATE operations are completely broken on current main branch. All write operations return GET responses instead of performing create/update actions. The CISO Assistant API itself works correctly - this is purely an MCP server implementation bug.
Last Working MCP Server Version:

✅ Commit: a6d25a0
All POST and UPDATE operations functioned correctly

Current Broken Version:

❌ Branch: main (current HEAD)
All POST and UPDATE operations broken in MCP server

Affected MCP Tools:

create_risk_scenario - returns list of scenarios instead of creating
create_task_template - broken
update_task_template - broken
ALL other POST/UPDATE MCP tools - broken

Steps to Reproduce:

Clone CISO-Assistant MCP repository
Checkout current main branch
Install with uv --directory /path/to/cli
Configure Claude Desktop:

json {
"mcpServers": {
"CISO-Assistant-MCP": {
"command": "uv",
"args": ["--directory", "/path/to/cli", "run", "ca_mcp.py"]
}
}
}

Attempt any create or update operation via MCP

Expected Behavior:
MCP server sends POST request to CISO Assistant API, resource is created/updated, returns success.
Actual Behavior:

MCP server sends wrong request (GET instead of POST)
Returns HTTP 200 with GET response (list of existing resources)
Example: create_risk_scenario returns all existing scenarios instead of creating new one
The CISO Assistant API is working correctly - this is a bug in the MCP server request construction

Impact:
Complete loss of write functionality through MCP interface - only read operations work.
Root Cause (suspected):
A regression in the MCP server code between a6d25a0 and current main broke how POST/UPDATE requests are constructed. Likely:

Wrong HTTP method being used
Wrong endpoint being called
Incorrect request payload formatting

Workaround:
bashcd /path/to/ciso-assistant-community/cli
git checkout a6d25a0
Files to investigate:

ca_mcp.py and related MCP server implementation files
Request construction functions (make_post_request, make_put_request, etc.)

[ab-smith]

Hello,
what kind of prompts are using to experiment this? I've just did a quick check to ask Claude to create a folder and assets within it and the POST went through.
Regards

[jledoze]

Here is an example made with Claude and a function not developed by me:

Payload :

{
  `name`: `Test Risk Scenario - MCP Debug`,
  `folder_id`: `5b67edaa-3eec-45cc-9e22-681d2b193aba`,
  `description`: `This is a test risk scenario to verify if the creation bug affects other objects besides tasks.

**Scenario:** Unauthorized access to production database through compromised credentials.`,
  `current_proba`: 3,
  `current_impact`: 4
}

As a response, I have:

[ERROR] HTTP 200
Details: {"count":42,"next":null,"previous":null,"results":[{"id":"b149b631-2401-461d-aaaf-0e0c16aa79fa","risk_matrix":{"str":"4x4 risk matrix from EBIOS-RM","id":"ed1af8fb-8d15-47d8-91e1-5afa55f700b8"},"risk_assessment":{"str":"CompanyName ISMS Risk Analysis - 2025 - 1.4","id":"c0d6e925-383d-4d36-99d4-72c4c2e62ff2","name":"CompanyName ISMS Risk Analysis - 2025","is_locked":false},"perimeter":{"str":"Company Domain/Company Asset","id":"69c8bf20-8d97-484c-a04a-98f5df121bd9","name":"Company asset","folder":{"str":"Currency software automation platform","id":"e723e71a-b3bb-447f-8b56-f4e4d2bf0eba"}},"version":"1.4","operational_scenario":null,"threats":[{"str":"Internal organizational threats","id":"48978bb9-0f46-43f1-952c-b5692b66da24"}],"assets":[{"str":"Platform Core (CompanyName-process)","id":"adc0078b-a4f9-48b6-8fe1-b0154a6e7573"}],"qualifications":

And with the creation of the task, I can share with you this picture showing the bug explained by Claude (There is too many informations to anonymized 🙄 )

The same requests worked perfectly on commit a6d25a0cb.
I originally built my custom MCP server on the non-forked repo, everything worked great. Then I forked it to submit a PR, copied over all my changes, synced with current main... and suddenly all POST/PATCH requests stopped working from Claude.

The weird part? Curl requests to the API work fine. And when I pointed my Claude MCP config back to the old repo (still on a6d25a0), everything works again immediately.

I did a bunch of diffs on the cli/ca_mcp folder but couldn't spot any obvious changes. My best guess is that something between a6d25a0 and current main is somehow making POST/PATCH requests behave like GET requests (which sounds crazy, I know...).

If you want, you can try the version with the bug by pulling this PR : #2919

If it works, ok, it might be just me but I have no explaination why it works with my custom version based on the short-sha a6d25a0cb. and not with my version based on the main branch. 😆

For now I'm just using my custom version based on the sha a6d25a0cb as a workaround.