googleapis / googleapis/mcp-toolbox

Resource template URIs are never scheme-normalized

Open
#3,992 0 comments 0 reactions 1 assignee Claimed by @Yuan325 View on GitHub
priority: p2 type: bug
Dominant language
Go
Stars
16.4k
Forks
1.7k
Avg merge
4d 9h
Merged PRs (30d)
85

Description

[`ResourceConfigBase.Validate`](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/resources/resources.go#L178-L181) lowercases the scheme and host and rewrites `c.URI`. [`ResourceTemplateConfigBase.Validate`](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/resources/resources.go#L273) does neither, so `FILE://Queries/{path}` is stored exactly as written.

**Impact** is minor, and only when a config uses an uppercase scheme:

- the manifest advertises the uppercase form
- [dedup on the raw template string](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/server/config.go#L371) treats `FILE://x/{path}` and `file://x/{path}` as two distinct templates

No serving bug — [matching](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/server/mcp/v20260728/method.go#L990) builds its regex from the same string the manifest advertised, so server and client agree on whatever form was configured.

**Don't fix it by mirroring the resource path.** A `url.Parse` round trip corrupts templates:

```go
url.Parse("file://{path}") // error: invalid character "{" in host name
url.Parse("FILE://Q/{path}") // String() => "file://Q/%7Bpath%7D"
```

The first form is the common one in existing configs, and the second stops `{path}` being a variable at all. That is why [the current code](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/resources/resources.go#L296) validates a `dummy`-substituted copy and never assigns it back.

**Suggested fix** — lowercase the scheme textually, no round trip:

```go
if i := strings.Index(c.URITemplate, "://"); i > 0 {
c.URITemplate = strings.ToLower(c.URITemplate[:i]) + c.URITemplate[i:]
}
```

Affects every resource-template type, not just `file`. Found reviewing #3989; links pinned to `4474b8b`, since this code is not yet on `main`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.