ruvnet/ruflo · error

[mcp] rejected servers by URL safety

Error message

[mcp] rejected servers by URL safety

What it means

Log warning in runMcpFlow: the URL safety guard rejected some configured MCP servers (non-public-HTTPS endpoints); the rejected name/URL pairs are logged and those servers are removed from the flow.

Source

Thrown at ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts:160

	if (servers.length === 0) {
		logger.warn({}, "[mcp] no MCP servers selected after merge/name filter");
		return "not_applicable";
	}

	// Enforce server-side safety (public HTTPS only, no private ranges)
	{
		const before = servers.slice();
		servers = servers.filter((s) => {
			try {
				return isValidUrl(s.url);
			} catch {
				return false;
			}
		});
		try {
			const rejected = before.filter((b) => !servers.includes(b));
			if (rejected.length > 0) {
				logger.warn(
					{ rejected: rejected.map((r) => ({ name: r.name, url: r.url })) },
					"[mcp] rejected servers by URL safety"
				);
			}
		} catch {}
	}
	if (servers.length === 0) {
		logger.warn({}, "[mcp] all selected MCP servers rejected by URL safety guard");
		return "not_applicable";
	}

	// Optionally attach the logged-in user's HF token to the official HF MCP server only.
	// Never override an explicit Authorization header, and require token to look like an HF token.
	try {
		const shouldForward = config.MCP_FORWARD_HF_USER_TOKEN === "true";
		const userToken =
			(locals as unknown as { hfAccessToken?: string } | undefined)?.hfAccessToken ??
			(locals as unknown as { token?: string } | undefined)?.token;

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Review the rejected server URLs; use HTTPS public URLs that pass the URL safety guard.

When it happens

Trigger: Thrown at ruflo/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts:160 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/4857db2ef9b610a6. Report an issue: GitHub.