wso2 / wso2/api-platform

[Bug]: MCP Proxy: AI Workspace accepts an invalid proxy Name at creation; deployment to the gateway then fails validation

Open
#3,205 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Aspect/API Severity/Major Type/Bug
Dominant language
Go
Stars
71
Forks
111
Avg merge
1d 14h
Merged PRs (30d)
110

Description

Please select the area the issue is related to

AI Workspace

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Description

Creating an MCP Proxy in AI Workspace using the official @modelcontextprotocol/server-everything reference server succeeds without any warning, even though the server reports its name as mcp-servers/everything. Because this name contains /, it is not valid under the gateway's URL-safe naming rules.

The problem only becomes visible later, when the proxy is deployed to a gateway. At that stage, the gateway-controller validates the proxy's displayName against a stricter, URL-friendly naming pattern and rejects it. AI Workspace does not perform the same validation when the proxy is created. As a result, the proxy appears to have been created successfully but is actually undeployable. The user only discovers the problem during deployment, several steps after the invalid name was accepted.

server-everything is not an obscure edge case. It is an official MCP reference and testing server maintained by the Model Context Protocol community (Anthropic/MCP maintainers). Its purpose is to demonstrate and test the features supported by MCP in a single server. Since its self-reported name directly triggers this issue, users following the standard MCP testing flow can encounter the problem on their first attempt to create an MCP Proxy in AI Workspace.

Expected Behavior
  • A name that will fail gateway validation should be rejected or automatically corrected when the MCP Proxy is created in AI Workspace, rather than being accepted and failing later during deployment.
  • When the Name field is pre-filled using the server's self-reported name, the pre-filled value should already comply with the naming rules required for deployment.
Actual Behavior
  • AI Workspace's create-form validation only verifies that the Name field is non-empty. It does not validate the allowed characters or naming format.
  • The gateway-controller applies a stricter, URL-friendly naming pattern, but this validation occurs only during deployment.
  • Fetch Server Info copies the server's reported name into the Name field verbatim, without sanitizing or validating it.
Steps to Reproduce
  1. MCP → MCP Proxies → select project → Create MCP Proxy.
  2. Enter the server URL (http://host.docker.internal:3001/mcp) → Fetch Server InfoNext.
  3. On the review screen, Name is pre-filled from the server's raw reported name: mcp-servers/everything. Leave it unchanged.
  4. Click Create. Result: succeeds. The proxy is created as a managed artifact with displayName = "mcp-servers/everything", no warning or error shown.
  5. Click Deploy to GatewayDeploy on the target gateway's card. Result: fails. The gateway-controller rejects the configuration because displayName doesn't match its URL-friendly pattern.
Severity Level of the Issue

Severity/Major (Important functionality is broken. Should be prioritized. Doesn't need immediate attention)

Environment Details (with versions)
  • WSO2 AI Workspace

  • MCP server used to reproduce:

    npx -y @modelcontextprotocol/server-everything@2026.7.4 streamableHttp
    

    reachable from AI Workspace at http://host.docker.internal:3001/mcp.

    This server's initialize response reports:

    "serverInfo": {
      "name": "mcp-servers/everything",
      "title": "Everything Reference Server"
    }
    

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the AI Workspace Create MCP Proxy form and its Fetch Server Info flow, then trace the gateway-controller validation reached by Deploy to Gateway. Reproduce with @modelcontextprotocol/server-everything and the reported name mcp-servers/everything; done means creation rejects or normalizes names that deployment would reject, with coverage for the pre-filled name path.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, nodejs
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.