Hmbown/CodeWhale · error · anyhow::Error

reviewed plugin MCP endpoint must not contain user informati

Error message

reviewed plugin MCP endpoint must not contain user information

What it means

reviewed_remote_endpoint_identity parses the remote MCP endpoint URL of a reviewed plugin and rejects any URL carrying user information, i.e. a `user:pass@host` (or bare `user@`) component (crates/tui/src/mcp.rs:995-997). Reviewed plugins are trusted as byte-exact bundles with pinned origins; credentials embedded in the URL would leak into reviews and logs and diverge from the approved origin, so validation fails closed.

Source

Thrown at crates/tui/src/mcp.rs:996

        .context("open reviewed launch file without following links")
}

#[cfg(windows)]
fn open_reviewed_launch_file(path: &Path) -> Result<fs::File> {
    crate::plugins::manifest::open_bundle_file(path)
        .context("open reviewed launch file without links, hard links, or write/delete sharing")
}

#[cfg(all(not(unix), not(windows)))]
fn open_reviewed_launch_file(path: &Path) -> Result<fs::File> {
    fs::File::open(path).context("open reviewed launch file")
}

fn reviewed_remote_endpoint_identity(endpoint: &str) -> Result<(String, String)> {
    let endpoint =
        reqwest::Url::parse(endpoint).context("reviewed plugin MCP endpoint is invalid")?;
    if !endpoint.username().is_empty() || endpoint.password().is_some() {
        anyhow::bail!("reviewed plugin MCP endpoint must not contain user information");
    }
    if endpoint.query().is_some() || endpoint.fragment().is_some() {
        anyhow::bail!("reviewed plugin MCP endpoint must not contain a query or fragment");
    }
    let origin = reviewed_remote_origin(&endpoint)
        .ok_or_else(|| anyhow::anyhow!("reviewed plugin MCP endpoint has an unsafe origin"))?;
    Ok((endpoint.to_string(), origin))
}

fn reviewed_remote_origin(endpoint: &reqwest::Url) -> Option<String> {
    if !endpoint.username().is_empty() || endpoint.password().is_some() {
        return None;
    }
    let host = endpoint.host_str()?;
    let allowed_scheme = endpoint.scheme() == "https"
        || (endpoint.scheme() == "http"
            && (host.eq_ignore_ascii_case("localhost")
                || host

View on GitHub (pinned to 8880682c63)

Solutions

1. Strip the userinfo from the URL: use https://api.example.com/mcp.
2. Move credentials to the supported channels: env_headers (e.g. Authorization: Bearer sourced from an env var) or the server's oauth config.
3. Re-trust the plugin after fixing the manifest (/plugin reload, then /plugin trust <name> <token>).

Example fix

# before
url = "https://apikey:x-oauth-basic@company.example.com/mcp"
# after: credentials supplied via env_headers, not the URL
url = "https://company.example.com/mcp"
[env_headers]
Authorization = "Bearer ${COMPANY_MCP_TOKEN}"

fn endpoint_has_userinfo(endpoint: &str) -> bool {
    reqwest::Url::parse(endpoint)
        .map(|u| !u.username().is_empty() || u.password().is_some())
        .unwrap_or(true) // unparseable endpoints fail later anyway; treat as invalid
}

When it happens

Trigger: A reviewed plugin manifest declares an MCP endpoint like https://user:pass@api.example.com/mcp or https://pat@example.com/mcp.

Common situations: Copying an endpoint from a provider dashboard that embeds an API key as basic-auth userinfo; migrating older configs that used URL-embedded credentials.

Related errors

• reviewed plugin MCP endpoint must not contain a query or fra
• reviewed plugin MCP endpoint has an unsafe origin
• MCP config path cannot contain '..' components
• reviewed plugin stage could not be opened for launch
• reviewed plugin stdio cwd escaped its staged root

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/4a4a505d10dc34eb. Report an issue: GitHub.