{"record":{"id":"546c082aaedd58f7","repo":"different-ai/openwork","slug":"an-enterprise-mcp-server-url-cannot-contain-embedd","errorCode":null,"errorMessage":"An enterprise MCP server URL cannot contain embedded credentials.","messagePattern":"An enterprise MCP server URL cannot contain embedded credentials\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/enterprise-mcp-client/src/enterprise-mcp-client.ts","lineNumber":108,"sourceCode":"  lifecycle: EnterpriseMcpLifecycle\n}\n\nfunction requestInit(authorization: EnterpriseMcpAuthorization): RequestInit | undefined {\n  if (authorization.type !== \"api-key\") return undefined\n  return { headers: { authorization: `Bearer ${authorization.token}` } }\n}\n\nfunction validateConnection(connection: EnterpriseMcpConnection): URL {\n  const parsed = connectionSchema.parse({ id: connection.id, serverUrl: connection.serverUrl })\n  if (connection.authorization.type === \"api-key\" && !connection.authorization.token.trim()) {\n    throw new Error(\"An API key connection requires a non-empty token.\")\n  }\n  const url = new URL(parsed.serverUrl)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP server URL must use HTTP or HTTPS.\")\n  }\n  if (url.username || url.password) {\n    throw new Error(\"An enterprise MCP server URL cannot contain embedded credentials.\")\n  }\n  if (url.hash) throw new Error(\"An enterprise MCP server URL cannot contain a fragment.\")\n  return url\n}\n\nfunction validateRedirectUri(redirectUri: string): string {\n  const parsed = redirectUriSchema.parse(redirectUri)\n  const url = new URL(parsed)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP OAuth redirect URI must use HTTP or HTTPS.\")\n  }\n  if (url.username || url.password || url.hash) {\n    throw new Error(\"An enterprise MCP OAuth redirect URI cannot contain credentials or a fragment.\")\n  }\n  return parsed\n}\n\nfunction configurationValue<T>(parse: () => T): T {","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/enterprise-mcp-client/src/enterprise-mcp-client.ts#L90-L126","documentation":"validateConnection in packages/enterprise-mcp-client/src/enterprise-mcp-client.ts rejects server URLs containing embedded userinfo credentials (url.username or url.password set, e.g. https://user:pass@host). Embedding secrets in URLs leaks them into logs, error messages, and telemetry, so the library forbids it; credentials must be supplied through the authorization object instead.","triggerScenarios":"Creating a connection whose serverUrl looks like \"https://user:secret@mcp.example.com/mcp\" or \"https://token@host\".","commonSituations":"Older service configs that used basic-auth-in-URL patterns; pasting a connection string (database-style) into an MCP server URL field; curl-style URLs carried over from CLI tooling.","solutions":["Remove user:pass@ from the URL and pass credentials via the connection's authorization field (e.g. api-key token or OAuth).","If the server requires basic auth at the gateway, front it with a proxy or use an authorization mechanism the client supports.","Sanitize config templates so placeholders like https://USER:PASS@host are never shipped literally."],"exampleFix":"// before\nserverUrl: \"https://svc:hunter2@mcp.example.com/mcp\"\n\n// after\nserverUrl: \"https://mcp.example.com/mcp\",\nauthorization: { type: \"api-key\", token: process.env.MCP_TOKEN }","handlingStrategy":"validation","validationCode":"function assertNoUserInfo(serverUrl: string) {\n  const u = new URL(serverUrl)\n  if (u.username || u.password) throw new Error(\"move credentials out of the URL into the authorization config\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass credentials via the authorization field, never in the URL","Lint config files for the 'user:pass@' pattern","Scrub connection strings (database-style URLs) before pasting into MCP config"],"tags":["configuration","url","security","credentials"],"backgroundTag":"credentials-in-url","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}