cloudflare / cloudflare/cloudflare-os
MCP connector lists two identical "Any MCP server" resource types when MCP_ALLOW_INSECURE=true
- Dominant language
- TypeScript
- Stars
- 9.9k
- Forks
- 1.2k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 107
Description
**What happens**
With `MCP_ALLOW_INSECURE=true` (local development), the MCP connector's detail view ("What this gatekeeper can do") shows two rows with the same title and description:
- Any MCP server — An MCP endpoint you supply. Tools are discovered automatically, and writes need approval.
- Any MCP server — An MCP endpoint you supply. Tools are discovered automatically, and writes need approval.
Nothing tells the user how the two differ.
**Cause**
`packages/gatekeeper-mcp/src/resources.ts` builds `HTTP_RESOURCE` by spreading `HTTPS_RESOURCE` and only changing `urlPattern`, so title and description are identical. `mcpResources(true)` returns both.
**Suggestion**
Give the http entry its own title/description, e.g. "Any MCP server (http, local development only)", or collapse the two into a single entry whose pattern list depends on `allowInsecure`.
**Environment**
cloudflare-os main @ c0b6f3e (2026-09-04), `pnpm run-local`, macOS 26.6, Node 22.22. Still present in current main (`resources.ts` unchanged).
Contributor guide
Research direction
Start in packages/gatekeeper-mcp/src/resources.ts and inspect HTTP_RESOURCE, HTTPS_RESOURCE, and mcpResources(true), then reproduce the connector detail view with MCP_ALLOW_INSECURE=true using pnpm run-local. Done means the two resource options are distinguishable or represented as one appropriate option, with no duplicate title and description.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100