The check that decides which MCP server addresses an administrator may type refuses a credential written into the userinfo, and accepts the same credential written two characters to the right.
ACCEPTED https://mcp.example.com/mcp?token=sk-live-abcdef
ACCEPTED https://mcp.example.com/mcp?api_key=SECRET
ACCEPTED https://mcp.example.com/mcp#token=sk-live-abcdef
refused https://oauth:hunter2@mcp.example.com/mcp
The harm is the one the userinfo rule was written for, not request forgery. addCustomServer writes input.url verbatim into mcp_servers.url and into the configuration.changed audit payload. Redaction in server/src/audit.ts keys on the field name and url is not in sensitiveKeys, so a token in the query sits in an append-only trail in clear text, where it cannot be removed by design. A fragment never reaches the server and is stored and audited just the same, so it carries the identical disclosure.
Separately, metadata.goog clears the floor:
ACCEPTED https://metadata.goog/computeMetadata/v1/instance/service-accounts/default/token
refused https://metadata.google.internal/computeMetadata/v1/
It is Google's own alias for the metadata server, published beside metadata.google.internal and 169.254.169.254. It carries a dot and none of the suffixes the check lists, so it reads as an ordinary vendor name; the long spelling is refused only incidentally, by the .internal rule. Worth being accurate about the reach: Google documents the short alias over http, and this function already requires https, so today this closes the name rather than a live path.
Both were named as follow-ups on #206 when it was approved.
The check that decides which MCP server addresses an administrator may type refuses a credential written into the userinfo, and accepts the same credential written two characters to the right.
The harm is the one the userinfo rule was written for, not request forgery.
addCustomServerwritesinput.urlverbatim intomcp_servers.urland into theconfiguration.changedaudit payload. Redaction inserver/src/audit.tskeys on the field name andurlis not insensitiveKeys, so a token in the query sits in an append-only trail in clear text, where it cannot be removed by design. A fragment never reaches the server and is stored and audited just the same, so it carries the identical disclosure.Separately,
metadata.googclears the floor:It is Google's own alias for the metadata server, published beside
metadata.google.internaland169.254.169.254. It carries a dot and none of the suffixes the check lists, so it reads as an ordinary vendor name; the long spelling is refused only incidentally, by the.internalrule. Worth being accurate about the reach: Google documents the short alias over http, and this function already requires https, so today this closes the name rather than a live path.Both were named as follow-ups on #206 when it was approved.