[BUG] MCP tool calls with complete URLs are rewritten into malformed gateway URLs
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
### Current Behavior
MCP tool request configuration can return a complete URL from tool input, but the callback later treats that value as a path and prepends the gateway request scheme and authority.
`RequestConfigHelper.buildPath()` explicitly short-circuits when an input argument is already a complete URL:
```java
if (isCompleteUrl(argsPosition, inputJson)) {
return getCompleteUrl(argsPosition, inputJson);
}
```
`ShenyuToolCallback.setTargetUri()` then always builds the target URI as:
```java
final URI oldUri = originExchange.getRequest().getURI();
final String newUriStr = oldUri.getScheme() + "://" + oldUri.getAuthority() + path;
requestBuilder.uri(new URI(newUriStr));
```
If `path` is `https://target.example/api`, the constructed URI becomes malformed, for example:
```text
http://gateway.examplehttps://target.example/api
```
### Expected Behavior
When the built path is already an absolute URL, the MCP callback should use it directly instead of prefixing the gateway origin.
### Impact
MCP tool flows that rely on absolute/complete target URLs cannot dispatch correctly because the gateway rewrites them into invalid gateway-host URLs.
### Code Location
- `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java`
- `buildPath()` returns complete URLs from input.
- `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java`
- `setTargetUri()` always prefixes the gateway scheme and authority.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with RequestConfigHelper.buildPath() and ShenyuToolCallback.setTargetUri() in the two paths named by the issue, comparing how complete and relative URLs are produced and consumed. Verify that an absolute MCP target is used without the gateway origin, while relative paths retain existing behavior; done means both forms produce valid target URIs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100