{"record":{"id":"52b04c0dad9ac6e1","repo":"different-ai/openwork","slug":"an-enterprise-mcp-server-url-cannot-contain-a-frag","errorCode":null,"errorMessage":"An enterprise MCP server URL cannot contain a fragment.","messagePattern":"An enterprise MCP server URL cannot contain a fragment\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/enterprise-mcp-client/src/enterprise-mcp-client.ts","lineNumber":110,"sourceCode":"\nfunction requestInit(authorization: EnterpriseMcpAuthorization): RequestInit | undefined {\n  if (authorization.type !== \"api-key\") return undefined\n  return { headers: { authorization: `Bearer ${authorization.token}` } }\n}\n\nfunction validateConnection(connection: EnterpriseMcpConnection): URL {\n  const parsed = connectionSchema.parse({ id: connection.id, serverUrl: connection.serverUrl })\n  if (connection.authorization.type === \"api-key\" && !connection.authorization.token.trim()) {\n    throw new Error(\"An API key connection requires a non-empty token.\")\n  }\n  const url = new URL(parsed.serverUrl)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP server URL must use HTTP or HTTPS.\")\n  }\n  if (url.username || url.password) {\n    throw new Error(\"An enterprise MCP server URL cannot contain embedded credentials.\")\n  }\n  if (url.hash) throw new Error(\"An enterprise MCP server URL cannot contain a fragment.\")\n  return url\n}\n\nfunction validateRedirectUri(redirectUri: string): string {\n  const parsed = redirectUriSchema.parse(redirectUri)\n  const url = new URL(parsed)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP OAuth redirect URI must use HTTP or HTTPS.\")\n  }\n  if (url.username || url.password || url.hash) {\n    throw new Error(\"An enterprise MCP OAuth redirect URI cannot contain credentials or a fragment.\")\n  }\n  return parsed\n}\n\nfunction configurationValue<T>(parse: () => T): T {\n  try {\n    return parse()","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/enterprise-mcp-client/src/enterprise-mcp-client.ts#L92-L128","documentation":"validateConnection in packages/enterprise-mcp-client/src/enterprise-mcp-client.ts throws when the server URL contains a fragment (#...). Fragments are never sent to servers by HTTP clients, so a URL with one cannot identify a valid MCP endpoint and is rejected to avoid silently connecting to the wrong path.","triggerScenarios":"Creating a connection with serverUrl such as \"https://mcp.example.com/mcp#section\" or a URL copied from an HTML page that included an anchor.","commonSituations":"Copy-pasting a URL from documentation or a browser address bar where an anchor was included; template configs with a trailing \"#\" comment accidentally left in the value.","solutions":["Strip the fragment (and anything after #) from the server URL.","Re-copy the endpoint URL from the MCP server's documentation without the anchor.","If a query is needed, use query parameters (?key=value) which are permitted, not a fragment."],"exampleFix":"// before\nserverUrl: \"https://mcp.example.com/mcp#tools\"\n\n// after\nserverUrl: \"https://mcp.example.com/mcp\"","handlingStrategy":"validation","validationCode":"function stripFragment(serverUrl: string): string {\n  const u = new URL(serverUrl)\n  if (u.hash) throw new Error(`remove fragment '${u.hash}' from serverUrl`)\n  return serverUrl\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy endpoint URLs from documentation plain-text, not from browser address bars","Reject '#' in URL-typed config values at load time","Use query parameters instead of fragments when the endpoint needs extra routing info"],"tags":["configuration","url","validation"],"backgroundTag":"invalid-url-scheme","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}