You'll notice
Useful3 Signal0
MCP URL allowlist patterns that could be rewritten by dot segments are now flagged with fix instructions.
What's wrong with this entry?
Anonymous. No account, no email.
What
Expansion safety analysis now catches allowlist patterns whose expanded path would be silently rewritten by URL parsing.
Details
- A pattern containing
$whose expanded path carries a..or.segment is treated as unsafe. - The diagnostic explains how to fix it and distinguishes patterns where the
$is not a real ${NAME} reference. - The variable list in the diagnostic now includes missing variables, and the analysis result exposes missingVars to callers.
- Allowlist entries using an unsafe expansion continue to fail closed.
Evidence
the expanded entry's path carries a dot segment ('..' or '.') that URL parsing would collapse
Strings lifted out of the shipped bundle, so the claim above can be checked against them.