Hmbown/CodeWhale · error

reviewed plugin MCP endpoint must not contain user…

Error message

reviewed plugin MCP endpoint must not contain user information

What it means

reviewed_remote_endpoint_identity parses the plugin's remote MCP endpoint URL and rejects any URL carrying user information (username or password). Credentials embedded in an approved endpoint could leak through review records or logs and enable credential smuggling, so such URLs are refused before review comparison.

Solutions

  1. Remove the username/password from the endpoint URL and authenticate via headers or an OAuth flow instead
  2. If the token must travel with the request, put it in a query-free header configured separately, not in the URL userinfo
  3. Move credentials into an environment-backed secret the MCP client injects at request time

Example fix

// before
"endpoint": "https://alice:secret@api.example.com/mcp"
// after
"endpoint": "https://api.example.com/mcp"  // auth via headers/token store
Defensive patterns

Strategy: validation

Validate before calling

import re

def endpoint_has_no_userinfo(endpoint: str) -> bool:
    m = re.match(r'^[a-z][a-z0-9+.-]*://', endpoint)
    if not m:
        return False
    scheme_end = m.end()
    at = endpoint.find('@', scheme_end)
    authority = endpoint[scheme_end:endpoint.find('/', scheme_end)]
    return not (at != -1 and at < scheme_end + len(authority))

Prevention

When it happens

Trigger: Thrown when endpoint.username() is non-empty or endpoint.password() is Some — i.e. the URL looks like https://user:pass@host/mcp — while normalizing the endpoint for review/approval comparison.

Common situations: Developer pasted a URL with basic-auth credentials copied from a curl example; a config template kept a user:pass prefix; a reverse-proxy URL included a token in the userinfo position.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/4a4a505d10dc34eb. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/mcp.rs:1111

        .context("open reviewed launch file without following links")
}

#[cfg(windows)]
fn open_reviewed_launch_file(path: &Path) -> Result<fs::File> {
    crate::plugins::manifest::open_bundle_file(path)
        .context("open reviewed launch file without links, hard links, or write/delete sharing")
}

#[cfg(all(not(unix), not(windows)))]
fn open_reviewed_launch_file(path: &Path) -> Result<fs::File> {
    fs::File::open(path).context("open reviewed launch file")
}

fn reviewed_remote_endpoint_identity(endpoint: &str) -> Result<(String, String)> {
    let endpoint =
        reqwest::Url::parse(endpoint).context("reviewed plugin MCP endpoint is invalid")?;
    if !endpoint.username().is_empty() || endpoint.password().is_some() {
        anyhow::bail!("reviewed plugin MCP endpoint must not contain user information");
    }
    if endpoint.query().is_some() || endpoint.fragment().is_some() {
        anyhow::bail!("reviewed plugin MCP endpoint must not contain a query or fragment");
    }
    let origin = reviewed_remote_origin(&endpoint)
        .ok_or_else(|| anyhow::anyhow!("reviewed plugin MCP endpoint has an unsafe origin"))?;
    Ok((endpoint.to_string(), origin))
}

fn reviewed_remote_origin(endpoint: &reqwest::Url) -> Option<String> {
    if !endpoint.username().is_empty() || endpoint.password().is_some() {
        return None;
    }
    let host = endpoint.host_str()?;
    let allowed_scheme = endpoint.scheme() == "https"
        || (endpoint.scheme() == "http"
            && (host.eq_ignore_ascii_case("localhost")
                || host

View on GitHub (pinned to 73e0f67d83)