{"record":{"id":"8851929117b33f1f","repo":"Hmbown/CodeWhale","slug":"reviewed-plugin-mcp-endpoint-must-not-contain-a-qu","errorCode":null,"errorMessage":"reviewed plugin MCP endpoint must not contain a query or fragment","messagePattern":"reviewed plugin MCP endpoint must not contain a query or fragment","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp.rs","lineNumber":999,"sourceCode":"#[cfg(windows)]\nfn open_reviewed_launch_file(path: &Path) -> Result<fs::File> {\n    crate::plugins::manifest::open_bundle_file(path)\n        .context(\"open reviewed launch file without links, hard links, or write/delete sharing\")\n}\n\n#[cfg(all(not(unix), not(windows)))]\nfn open_reviewed_launch_file(path: &Path) -> Result<fs::File> {\n    fs::File::open(path).context(\"open reviewed launch file\")\n}\n\nfn reviewed_remote_endpoint_identity(endpoint: &str) -> Result<(String, String)> {\n    let endpoint =\n        reqwest::Url::parse(endpoint).context(\"reviewed plugin MCP endpoint is invalid\")?;\n    if !endpoint.username().is_empty() || endpoint.password().is_some() {\n        anyhow::bail!(\"reviewed plugin MCP endpoint must not contain user information\");\n    }\n    if endpoint.query().is_some() || endpoint.fragment().is_some() {\n        anyhow::bail!(\"reviewed plugin MCP endpoint must not contain a query or fragment\");\n    }\n    let origin = reviewed_remote_origin(&endpoint)\n        .ok_or_else(|| anyhow::anyhow!(\"reviewed plugin MCP endpoint has an unsafe origin\"))?;\n    Ok((endpoint.to_string(), origin))\n}\n\nfn reviewed_remote_origin(endpoint: &reqwest::Url) -> Option<String> {\n    if !endpoint.username().is_empty() || endpoint.password().is_some() {\n        return None;\n    }\n    let host = endpoint.host_str()?;\n    let allowed_scheme = endpoint.scheme() == \"https\"\n        || (endpoint.scheme() == \"http\"\n            && (host.eq_ignore_ascii_case(\"localhost\")\n                || host\n                    .trim_matches(['[', ']'])\n                    .parse::<std::net::IpAddr>()\n                    .is_ok_and(|address| address.is_loopback())));","sourceCodeStart":981,"sourceCodeEnd":1017,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/crates/tui/src/mcp.rs#L981-L1017","documentation":"reviewed_remote_endpoint_identity rejects reviewed-plugin MCP endpoints whose URL contains a query string or fragment (crates/tui/src/mcp.rs:998-1000). Only the origin (scheme+host+port) and path are trusted; query/fragment parts are mutable request details that could carry credentials or bypass the pinned-origin redirect policy, so they are refused outright.","triggerScenarios":"An endpoint declared as https://api.example.com/mcp?token=abc or https://api.example.com/mcp#section in a reviewed plugin manifest.","commonSituations":"Providers that hand out connect URLs with API keys in the query string; anchors accidentally pasted from documentation pages.","solutions":["Remove everything from '?' onwards and from '#' onwards: declare https://api.example.com/mcp only.","Move any needed auth material to env_headers or oauth config instead of the URL.","Re-trust the plugin after the manifest change (/plugin reload, /plugin trust <name> <token>)."],"exampleFix":"# before\nurl = \"https://mcp.example.com/sse?api_key=secret#prod\"\n# after\nurl = \"https://mcp.example.com/sse\"","handlingStrategy":"validation","validationCode":"fn endpoint_has_query_or_fragment(endpoint: &str) -> bool {\n    reqwest::Url::parse(endpoint)\n        .map(|u| u.query().is_some() || u.fragment().is_some())\n        .unwrap_or(true)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Declare only scheme://host[:port]/path in plugin endpoints.","Put auth and routing parameters in headers, not the URL.","Strip pasted anchors (#...) from documentation URLs before use."],"tags":["url","plugin","mcp","validation"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}