{"record":{"id":"6113225580e58f23","repo":"ruvnet/ruflo","slug":"mcp-all-selected-mcp-servers-rejected-by-url-saf","errorCode":null,"errorMessage":"[mcp] all selected MCP servers rejected by URL safety guard","messagePattern":"\\[mcp\\] all selected MCP servers rejected by URL safety guard","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts","lineNumber":168,"sourceCode":"\t\tservers = servers.filter((s) => {\n\t\t\ttry {\n\t\t\t\treturn isValidUrl(s.url);\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t});\n\t\ttry {\n\t\t\tconst rejected = before.filter((b) => !servers.includes(b));\n\t\t\tif (rejected.length > 0) {\n\t\t\t\tlogger.warn(\n\t\t\t\t\t{ rejected: rejected.map((r) => ({ name: r.name, url: r.url })) },\n\t\t\t\t\t\"[mcp] rejected servers by URL safety\"\n\t\t\t\t);\n\t\t\t}\n\t\t} catch {}\n\t}\n\tif (servers.length === 0) {\n\t\tlogger.warn({}, \"[mcp] all selected MCP servers rejected by URL safety guard\");\n\t\treturn \"not_applicable\";\n\t}\n\n\t// Optionally attach the logged-in user's HF token to the official HF MCP server only.\n\t// Never override an explicit Authorization header, and require token to look like an HF token.\n\ttry {\n\t\tconst shouldForward = config.MCP_FORWARD_HF_USER_TOKEN === \"true\";\n\t\tconst userToken =\n\t\t\t(locals as unknown as { hfAccessToken?: string } | undefined)?.hfAccessToken ??\n\t\t\t(locals as unknown as { token?: string } | undefined)?.token;\n\n\t\tif (shouldForward && hasNonEmptyToken(userToken)) {\n\t\t\tconst overlayApplied: string[] = [];\n\t\t\tservers = servers.map((s) => {\n\t\t\t\ttry {\n\t\t\t\t\tif (isStrictHfMcpLogin(s.url) && !hasAuthHeader(s.headers)) {\n\t\t\t\t\t\toverlayApplied.push(s.name);\n\t\t\t\t\t\treturn {","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts#L150-L186","documentation":"Log warning in runMcpFlow: every selected MCP server was rejected by the URL safety guard (public HTTPS only), so no servers remain, the MCP flow returns not_applicable, and generation proceeds without tools.","triggerScenarios":"Thrown at ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts:168 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Replace the selected MCP server URLs with safe HTTPS public endpoints; the flow is skipped when all servers are rejected."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}