{"version":"2.1.221","anchor":"mcp-policy-url-predicates-flag-collapsible-dot-segments","canonical_anchor":"mcp-policy-url-predicates-flag-collapsible-dot-segments","heading":"MCP policy URL predicates flag collapsible dot segments","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/mcp-policy-url-predicates-flag-collapsible-dot-segments","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### MCP policy URL predicates flag collapsible dot segments\n\nMCP URL allowlist patterns that could be rewritten by dot segments are now flagged with fix instructions.\n\n**What**\n\nExpansion safety analysis now catches allowlist patterns whose expanded path would be silently rewritten by URL parsing.\n\n**Details**\n\n- A pattern containing `$` whose expanded path carries a `..` or `.` segment is treated as unsafe.\n- The diagnostic explains how to fix it and distinguishes patterns where the `$` is not a real ${NAME} reference.\n- The variable list in the diagnostic now includes missing variables, and the analysis result exposes missingVars to callers.\n- Allowlist entries using an unsafe expansion continue to fail closed.\n\n**Evidence**\n\n`the expanded entry's path carries a dot segment ('..' or '.') that URL parsing would collapse`\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}