{"record":{"id":"4857db2ef9b610a6","repo":"ruvnet/ruflo","slug":"mcp-rejected-servers-by-url-safety","errorCode":null,"errorMessage":"[mcp] rejected servers by URL safety","messagePattern":"\\[mcp\\] rejected servers by URL safety","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts","lineNumber":160,"sourceCode":"\tif (servers.length === 0) {\n\t\tlogger.warn({}, \"[mcp] no MCP servers selected after merge/name filter\");\n\t\treturn \"not_applicable\";\n\t}\n\n\t// Enforce server-side safety (public HTTPS only, no private ranges)\n\t{\n\t\tconst before = servers.slice();\n\t\tservers = servers.filter((s) => {\n\t\t\ttry {\n\t\t\t\treturn isValidUrl(s.url);\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t});\n\t\ttry {\n\t\t\tconst rejected = before.filter((b) => !servers.includes(b));\n\t\t\tif (rejected.length > 0) {\n\t\t\t\tlogger.warn(\n\t\t\t\t\t{ rejected: rejected.map((r) => ({ name: r.name, url: r.url })) },\n\t\t\t\t\t\"[mcp] rejected servers by URL safety\"\n\t\t\t\t);\n\t\t\t}\n\t\t} catch {}\n\t}\n\tif (servers.length === 0) {\n\t\tlogger.warn({}, \"[mcp] all selected MCP servers rejected by URL safety guard\");\n\t\treturn \"not_applicable\";\n\t}\n\n\t// Optionally attach the logged-in user's HF token to the official HF MCP server only.\n\t// Never override an explicit Authorization header, and require token to look like an HF token.\n\ttry {\n\t\tconst shouldForward = config.MCP_FORWARD_HF_USER_TOKEN === \"true\";\n\t\tconst userToken =\n\t\t\t(locals as unknown as { hfAccessToken?: string } | undefined)?.hfAccessToken ??\n\t\t\t(locals as unknown as { token?: string } | undefined)?.token;","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts#L142-L178","documentation":"Log warning in runMcpFlow: the URL safety guard rejected some configured MCP servers (non-public-HTTPS endpoints); the rejected name/URL pairs are logged and those servers are removed from the flow.","triggerScenarios":"Thrown at ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts:160 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Review the rejected server URLs; use HTTPS public URLs that pass the URL safety guard."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}