[mcp] all selected MCP servers rejected by URL safety guard

Error message

[mcp] all selected MCP servers rejected by URL safety guard

What it means

Log warning in runMcpFlow: every selected MCP server was rejected by the URL safety guard (public HTTPS only), so no servers remain, the MCP flow returns not_applicable, and generation proceeds without tools.

Source

Thrown at ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts:168

		servers = servers.filter((s) => {
			try {
				return isValidUrl(s.url);
			} catch {
				return false;
			}
		});
		try {
			const rejected = before.filter((b) => !servers.includes(b));
			if (rejected.length > 0) {
				logger.warn(
					{ rejected: rejected.map((r) => ({ name: r.name, url: r.url })) },
					"[mcp] rejected servers by URL safety"
				);
			}
		} catch {}
	}
	if (servers.length === 0) {
		logger.warn({}, "[mcp] all selected MCP servers rejected by URL safety guard");
		return "not_applicable";
	}

	// Optionally attach the logged-in user's HF token to the official HF MCP server only.
	// Never override an explicit Authorization header, and require token to look like an HF token.
	try {
		const shouldForward = config.MCP_FORWARD_HF_USER_TOKEN === "true";
		const userToken =
			(locals as unknown as { hfAccessToken?: string } | undefined)?.hfAccessToken ??
			(locals as unknown as { token?: string } | undefined)?.token;

		if (shouldForward && hasNonEmptyToken(userToken)) {
			const overlayApplied: string[] = [];
			servers = servers.map((s) => {
				try {
					if (isStrictHfMcpLogin(s.url) && !hasAuthHeader(s.headers)) {
						overlayApplied.push(s.name);
						return {

View on GitHub (pinned to fa13ee4ad6)

Solutions

Replace the selected MCP server URLs with safe HTTPS public endpoints; the flow is skipped when all servers are rejected.

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts:168 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/6113225580e58f23. Report an issue: GitHub.