Fix MCP URL probe: connection failure was reported as PASS

curl writes "000" to -w '%{http_code}' on a connection failure AND exits
nonzero. The previous fallback put the echo inside the command
substitution — both wrote, the captured value was "000000", and the
case statement's 000) arm didn't match, so dead hosts fell through to
PASS. Move the fallback assignment outside the substitution so the
captured value is exactly "000" and connection failures fail.

Also skip entries with an empty url field — those are placeholders
awaiting user config, not dead endpoints, and would false-fail.

.github/workflows/check-mcp-urls.yml

@@ -55,12 +55,14 @@ jobs:
                 # config, or wrapped under a top-level "mcpServers" key (also
                 # the shape inside plugin.json). Normalize, then keep entries
                 # with an http/sse type and a string url.
+                # Skip entries with empty url — those are placeholders awaiting
+                # user config, not dead endpoints, and would false-fail.
                 jq -r --arg plugin "$plugin" '
                   (if (type == "object" and has("mcpServers")) then .mcpServers else . end)
                   | to_entries[]
                   | select((.value | type) == "object")
                   | select(.value.type == "http" or .value.type == "sse")
-                  | select(.value.url | type == "string")
+                  | select(.value.url | type == "string" and . != "")
                   | "\($plugin)\t\(.key)\t\(.value.url)"
                 ' "$cfg" 2>/dev/null || true
               done
@@ -73,10 +75,16 @@ jobs:
             local code
             # HEAD first — cheap and covers plain web endpoints. -L follows
             # redirects so a permanent redirect to a live page still passes.
+            #
+            # On a connection-level failure curl writes "000" to -w AND exits
+            # nonzero. The fallback assignment must happen OUTSIDE the command
+            # substitution — `... || echo "000"` inside $() would *append* a
+            # second "000", producing "000000" which falls through the case
+            # statement and silently passes a dead host.
             code="$(curl -sS -o /dev/null -w '%{http_code}' \
                       --connect-timeout 10 --max-time 10 \
                       --retry 2 --retry-delay 2 \
-                      -L -I "$url" 2>/dev/null || echo "000")"
+                      -L -I "$url" 2>/dev/null)" || code="000"
 
             # MCP endpoints typically reject HEAD (404/405) but answer POST
             # with a JSON-RPC body. Retry as a real MCP client would.
@@ -88,7 +96,7 @@ jobs:
                         -H 'Content-Type: application/json' \
                         -H 'Accept: application/json, text/event-stream' \
                         --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}' \
-                        "$url" 2>/dev/null || echo "000")"
+                        "$url" 2>/dev/null)" || code="000"
             fi
 
             case "$code" in