modelcontextprotocol/servers · error · Error

Unsupported URL protocol for ${dataUri}. Only http, https, a

Error message

Unsupported URL protocol for ${dataUri}. Only http, https, and data URLs are supported.

What it means

Thrown by `validateDataURI` when the parsed URL's protocol is not `http:`, `https:`, or `data:`. This guards the gzip tool against fetching from unsupported schemes (e.g. `file://`, `ftp://`) which `fetch()` may reject or, worse, resolve to local resources.

Source

Thrown at src/everything/tools/gzip-file-as-resource.ts:144

};

/**
 * Validates a given data URI to ensure it follows the appropriate protocols and rules.
 *
 * @param {string} dataUri - The data URI to validate. Must be an HTTP, HTTPS, or data protocol URL. If a domain is provided, it must match the allowed domains list if applicable.
 * @return {URL} The validated and parsed URL object.
 * @throws {Error} If the data URI does not use a supported protocol or does not meet allowed domains criteria.
 */
function validateDataURI(dataUri: string): URL {
  // Validate Inputs
  const url = new URL(dataUri);
  try {
    if (
      url.protocol !== "http:" &&
      url.protocol !== "https:" &&
      url.protocol !== "data:"
    ) {
      throw new Error(
        `Unsupported URL protocol for ${dataUri}. Only http, https, and data URLs are supported.`
      );
    }
    if (
      GZIP_ALLOWED_DOMAINS.length > 0 &&
      (url.protocol === "http:" || url.protocol === "https:")
    ) {
      const domain = url.hostname;
      const domainAllowed = GZIP_ALLOWED_DOMAINS.some((allowedDomain) => {
        return domain === allowedDomain || domain.endsWith(`.${allowedDomain}`);
      });
      if (!domainAllowed) {
        throw new Error(`Domain ${domain} is not in the allowed domains list.`);
      }
    }
  } catch (error) {
    throw new Error(
      `Error processing file ${dataUri}: ${

View on GitHub (pinned to 76d64c822f)

Solutions

1. Use an `http://` or `https://` URL, or a well-formed `data:` URI for the `data` argument.
2. For local files, host them over http or inline them as a `data:` URI (base64).
3. Validate the protocol client-side before calling the tool: `['http:','https:','data:'].includes(new URL(u).protocol)`.

Example fix

// before
toolHandler({ data: 'file:///tmp/big.txt' });
// after
toolHandler({ data: 'https://example.com/big.txt' });

function isSupportedFetchUrl(s: string): boolean {
  try {
    const p = new URL(s).protocol;
    return p === 'http:' || p === 'https:' || p === 'data:';
  } catch { return false; }
}
if (!isSupportedFetchUrl(args.data)) { /* surface error */ }

function isHttpDataUrl(s: string): boolean {
  return /^(https?:|data:)/i.test(s);
}

When it happens

Trigger: Calling `gzip-file-as-resource` with a `data` argument whose URL uses an unsupported scheme — e.g. `file:///etc/passwd`, `ftp://host/file`, `javascript:...`, or a malformed string that `new URL()` still parses into an unexpected protocol.

Common situations: Users pointing the tool at a local file path (`file://`), copy-pasting an `ftp://` link, or a malicious/erroneous `data:` URI whose scheme parsing yields something unexpected. Also triggered by relative URLs resolved against an unintended base.

Related errors

• Domain ${domain} is not in the allowed domains list.
• Error processing file ${dataUri}: ${error instanceof Error ?
• Invalid resourceType: ${args?.resourceType}. Must be ${RESOU
• Invalid resourceId: ${args?.resourceId}. Must be a finite po
• Unknown resource: ${uri.toString()}

AI-assisted analysis of modelcontextprotocol/servers@76d64c822f (2026-08-12). Data as JSON: /api/errors/5e1cc303df006e30. Report an issue: GitHub.