Repository navigation
Graph UI stats panel broken in v0.10.5: /rpc returns 403 for get_graph_schema ('UI RPC method is not allowed') #1663
Description
Environment
- Windows 11, v0.10.5 (exe install), UI at http://127.0.0.1:9749
- Agents connected via MCP (Claude Code, Codex, Hermes)
Symptom
The Projects tab's summary tiles show Projects: 45, nodes: 0, edges: 0 and each project row shows 0 nodes / 0 edges. The general/stats panel previously showed correct totals and language counts. The MCP channel is fully functional: list_projects returns per-project node/edge counts, and index_status reports ready for every project.
Root cause
The SPA (served from the same binary, assets/index-*.js) fetches the projects list and then calls, per project:
POST /rpc
{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_graph_schema","arguments":{"project":"<name>"}}}The server responds 403 with:
{"jsonrpc":"2.0","error":{"code":-32601,"message":"UI RPC method is not allowed"},"id":null}Only list_projects is permitted over the HTTP /rpc route; get_graph_schema and get_code_snippet are both rejected. The SPA swallows the failure (schema: null → contributes 0), so the panel sums to zero without any visible error.
Repro
curl -s -X POST http://127.0.0.1:9749/rpc -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_graph_schema","arguments":{"project":"<any indexed project>"}}}'
# -> HTTP 403, "UI RPC method is not allowed"
# same request with "list_projects" -> 200 OK
Notes
config listexposes onlyauto_index / auto_index_limit / auto_watch / ui-lang / ui_enabled / ui_port— no allowlist or auth knob.- If the HTTP-rpc lockdown is intentional loopback hardening (the UI listener replies with
Access-Control-Allow-Origin: *), the UI still needs a sanctioned path for its own stats queries — either allowget_graph_schema/read-only graph tools on loopback, or serve the aggregate through a dedicated/apiendpoint. - This regressed between v0.9.0 (panel worked) and v0.10.5.
Activity
DeusData commentedon Aug 18, 2026
Thank you for tracing the browser request through to the exact 403 response. This is confirmed directly in current main:
useProjects()callsget_graph_schemafor every project, whilerpc_is_allowed_for_ui()permits onlylist_projectsandget_code_snippet. The frontend then catches that rejection and converts it toschema: null, which explains the silent zero totals.This is a deterministic high-priority UI regression. The fix must preserve the localhost host and request defenses, and should either expose the minimum read-only data through a dedicated endpoint or add a narrowly tested read-only allowlist entry. It should not broadly reopen MCP tools over HTTP. Thank you for identifying both sides of the contract mismatch.
fix(ui): render the Projects page immediately; fetch schemas lazily
fix(ui): allow graph schema through UI RPC
DeusData commentedon Sep 4, 2026
Closing as superseded together with #1817, which fixed exactly this and was approved on merit: the graph UI is being reimplemented from the ground up, and the current app with its RPC allowlist will be replaced rather than patched. The stats panel's schema request is on the requirements list for the new version. Thank you for the precise report.
Merge origin/main into feat/atlas-r1
feat(ui): open the /rpc allowlist to the read-only query surface