What
Server-supplied error text reaching MCP UI surfaces is now normalized and scrubbed before it is interpolated into user-visible strings, and an invalid URL is no longer echoed back.
Details
- Reconnect failures pass the tools-list error through a sanitizer (NFKC normalize, strip angle brackets and quote characters, collapse whitespace, truncate with an ellipsis) before interpolation into "Reconnected to ..., but fetching tools failed: ...".
- The same sanitizer applies to a caught error message in the artifact/QR surface, and to messages embedded in
Error reconnecting toandFailed to reconnect to. - Bearer, api-key and password-looking values are rewritten to
[redacted]. - MCP conflict notices in the transcript run their
messageandsuggestionthrough a control-character stripper. - Schema-validation error formatting for MCP goes through the same path.
- An invalid MCP
urlno longer echoes the URL back; the message is now a fixed string.
Evidence
'url' is not a valid URL. Update the server's config and reconnect., Error reconnecting to
Strings lifted out of the shipped bundle, so the claim above can be checked against them.