{"version":"2.1.247","anchor":"cloud-bridge-mcp-server-urls-are-checked-against-this-sessio","canonical_anchor":"cloud-bridge-mcp-server-urls-are-checked-against-this-sessio","heading":"Cloud bridge MCP server URLs are checked against this session's own route","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247\/e\/cloud-bridge-mcp-server-urls-are-checked-against-this-sessio","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247","markdown":"### Cloud bridge MCP server URLs are checked against this session's own route\n\nMCP URLs from the cloud bridge must match your own session route or they're dropped.\n\n**What**\n\nThe MCP server URL handed over by the cloud bridge previously only had to sit on the bridge's origin. It now has to be this session's own proxy route or it is dropped with a warning, closing off a bridge-supplied URL pointing at another session or a crafted path.\n\n**Details**\n\n- The URL must parse to that exact origin, carry no credentials and no fragment, and match the `\/v2\/ccr-sessions\/<sessionId>\/mcp` path for the current session.\n- Only allow-listed query parameters are permitted, with a fixed toolbox server id.\n- The nested inner URL must itself be the canonical path on the same origin, and the server id must match a fixed pattern.\n\n**Evidence**\n\n`[bridge:server-config] meta url is not this session's meta proxy route on the bridge origin`\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 3\/5"}