apache / apache/shenyu

[BUG] MCP tool calls with complete URLs are rewritten into malformed gateway URLs

Open Beginner friendly
#6,472 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Current Behavior

MCP tool request configuration can return a complete URL from tool input, but the callback later treats that value as a path and prepends the gateway request scheme and authority.

`RequestConfigHelper.buildPath()` explicitly short-circuits when an input argument is already a complete URL:

```java
if (isCompleteUrl(argsPosition, inputJson)) {
return getCompleteUrl(argsPosition, inputJson);
}
```

`ShenyuToolCallback.setTargetUri()` then always builds the target URI as:

```java
final URI oldUri = originExchange.getRequest().getURI();
final String newUriStr = oldUri.getScheme() + "://" + oldUri.getAuthority() + path;
requestBuilder.uri(new URI(newUriStr));
```

If `path` is `https://target.example/api`, the constructed URI becomes malformed, for example:

```text
http://gateway.examplehttps://target.example/api
```

### Expected Behavior

When the built path is already an absolute URL, the MCP callback should use it directly instead of prefixing the gateway origin.

### Impact

MCP tool flows that rely on absolute/complete target URLs cannot dispatch correctly because the gateway rewrites them into invalid gateway-host URLs.

### Code Location

- `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java`
- `buildPath()` returns complete URLs from input.
- `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java`
- `setTargetUri()` always prefixes the gateway scheme and authority.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with RequestConfigHelper.buildPath() and ShenyuToolCallback.setTargetUri() in the two paths named by the issue, comparing how complete and relative URLs are produced and consumed. Verify that an absolute MCP target is used without the gateway origin, while relative paths retain existing behavior; done means both forms produce valid target URIs.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.