googleapis / googleapis/mcp-toolbox
Resource template URIs are never scheme-normalized
- Dominant language
- Go
- Stars
- 16.4k
- Forks
- 1.7k
- Avg merge
- 4d 9h
- Merged PRs (30d)
- 85
Description
[`ResourceConfigBase.Validate`](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/resources/resources.go#L178-L181) lowercases the scheme and host and rewrites `c.URI`. [`ResourceTemplateConfigBase.Validate`](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/resources/resources.go#L273) does neither, so `FILE://Queries/{path}` is stored exactly as written.
**Impact** is minor, and only when a config uses an uppercase scheme:
- the manifest advertises the uppercase form
- [dedup on the raw template string](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/server/config.go#L371) treats `FILE://x/{path}` and `file://x/{path}` as two distinct templates
No serving bug — [matching](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/server/mcp/v20260728/method.go#L990) builds its regex from the same string the manifest advertised, so server and client agree on whatever form was configured.
**Don't fix it by mirroring the resource path.** A `url.Parse` round trip corrupts templates:
```go
url.Parse("file://{path}") // error: invalid character "{" in host name
url.Parse("FILE://Q/{path}") // String() => "file://Q/%7Bpath%7D"
```
The first form is the common one in existing configs, and the second stops `{path}` being a variable at all. That is why [the current code](https://github.com/googleapis/mcp-toolbox/blob/4474b8ba5c1c7a81d6307c30c73f5469b73582d2/internal/resources/resources.go#L296) validates a `dummy`-substituted copy and never assigns it back.
**Suggested fix** — lowercase the scheme textually, no round trip:
```go
if i := strings.Index(c.URITemplate, "://"); i > 0 {
c.URITemplate = strings.ToLower(c.URITemplate[:i]) + c.URITemplate[i:]
}
```
Affects every resource-template type, not just `file`. Found reviewing #3989; links pinned to `4474b8b`, since this code is not yet on `main`.
Contributor guide
Assessment
This issue has not been assessed yet.