modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: require an authority for the path-less root form (#2295)

Browse source 
`skill:`, `mailto:` and `skill://` also parse to an empty pathname, with an
empty host, so an empty path alone accepted authority-less URIs the guard
exists to reject. Accept the empty path only when a host is present
(Copilot review round 1).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ2eszDCUqTmhtTMaznw3W
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-14 00:24:10 -04:00
commit 195f209359
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
clients/web/src/test/core/mcp/skills.test.ts
View file

@ -176,6 +176,11 @@ describe("normalizeSkillUri", () => {
expect(normalizeSkillUri("skill:demo/SKILL.md")).toBeUndefined();
// Path-less but still opaque: no authority, so it stays rejected.
expect(normalizeSkillUri("skill:demo")).toBeUndefined();
// Empty path AND no authority — the parser reports `pathname === ""` for
// these too, so an empty path alone must not be read as the root form.
expect(normalizeSkillUri("skill:")).toBeUndefined();
expect(normalizeSkillUri("mailto:")).toBeUndefined();
expect(normalizeSkillUri("skill://")).toBeUndefined();
});
it("accepts a path-less authority URI — a skill's root directory (#2295)", () => {