exemptMcpEndpoint's URL/origin comparison has no property-based or fuzz test

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

All / shared core

Inspector version

2.7.0 (git tag) — static code-review finding, not run locally

Node version

N/A — static code review, no live run performed

Operating system (and browser, for the web client)

N/A — static code review

Transport

Streamable HTTP

MCP server under inspection

N/A — this is a static code-review finding against the 2.7.0 tag source (core/auth/requestTimeout.ts), not a live reproduction against a running MCP server.

Steps to reproduce

Found via static review of the 2.7.0 tag source, not a live run.

1. exemptMcpEndpoint (in core/auth/requestTimeout.ts) decides whether a request is bounded by the OAuth request timeout or left unbounded as MCP traffic.
2. Its doc comment hand-enumerates known edge cases (unparseable URL, missing server URL, legacy SSE) rather than being covered by a generative test.
3. Reviewed the test file alongside it and did not find a property-based/fuzz test exercising this comparison.

I have not attempted to construct an adversarial URL that defeats the classification; flagging the absence of this test category itself, given the function is a security-and-correctness-adjacent decision point.

Expected behavior

exemptMcpEndpoint's URL/origin comparison is covered by a property-based or fuzz test (e.g. using fast-check) feeding it malformed URLs, IDN homograph hosts, unusual ports, and mixed-case origins, asserting the fail-open behavior holds in every case, not only the cases currently named in the doc comment.

Actual behavior

The function's correctness rests on a hand-enumerated list of edge cases in a comment rather than a generative test, so the list can silently drift out of sync as the function evolves.

Suggested fix: add a property-based/fuzz test asserting the exemption/timeout classification is fail-safe against malformed and adversarially-shaped URLs, not just the cases currently documented.

Logs, errors, or screenshots

No response

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).

Start with exemptMcpEndpoint in core/auth/requestTimeout.ts and read the adjacent test file to understand the existing URL/origin cases and fail-open expectations. Add a property-based or fuzz test, potentially using fast-check, covering malformed URLs, IDN homograph hosts, unusual ports, and mixed-case origins. Done means the exemption and timeout classification is exercised generatively rather than relying only on the documented examples.