cloudflare / cloudflare/cloudflare-os

MCP connector lists two identical "Any MCP server" resource types when MCP_ALLOW_INSECURE=true

Open Beginner friendly
#485 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
9.9k
Forks
1.2k
Avg merge
1d 20h
Merged PRs (30d)
107

Description

**What happens**
With `MCP_ALLOW_INSECURE=true` (local development), the MCP connector's detail view ("What this gatekeeper can do") shows two rows with the same title and description:

- Any MCP server — An MCP endpoint you supply. Tools are discovered automatically, and writes need approval.
- Any MCP server — An MCP endpoint you supply. Tools are discovered automatically, and writes need approval.

Nothing tells the user how the two differ.

**Cause**
`packages/gatekeeper-mcp/src/resources.ts` builds `HTTP_RESOURCE` by spreading `HTTPS_RESOURCE` and only changing `urlPattern`, so title and description are identical. `mcpResources(true)` returns both.

**Suggestion**
Give the http entry its own title/description, e.g. "Any MCP server (http, local development only)", or collapse the two into a single entry whose pattern list depends on `allowInsecure`.

**Environment**
cloudflare-os main @ c0b6f3e (2026-09-04), `pnpm run-local`, macOS 26.6, Node 22.22. Still present in current main (`resources.ts` unchanged).

Contributor guide

Open the contributing guide

Research direction

Start in packages/gatekeeper-mcp/src/resources.ts and inspect HTTP_RESOURCE, HTTPS_RESOURCE, and mcpResources(true), then reproduce the connector detail view with MCP_ALLOW_INSECURE=true using pnpm run-local. Done means the two resource options are distinguishable or represented as one appropriate option, with no duplicate title and description.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.