diff --git a/.github/workflows/check-mcp-urls.yml b/.github/workflows/check-mcp-urls.yml
index 5bcdabf..a91b312 100644
--- a/.github/workflows/check-mcp-urls.yml
+++ b/.github/workflows/check-mcp-urls.yml
@@ -55,12 +55,14 @@ jobs:
                 # config, or wrapped under a top-level "mcpServers" key (also
                 # the shape inside plugin.json). Normalize, then keep entries
                 # with an http/sse type and a string url.
+                # Skip entries with empty url — those are placeholders awaiting
+                # user config, not dead endpoints, and would false-fail.
                 jq -r --arg plugin "$plugin" '
                   (if (type == "object" and has("mcpServers")) then .mcpServers else . end)
                   | to_entries[]
                   | select((.value | type) == "object")
                   | select(.value.type == "http" or .value.type == "sse")
-                  | select(.value.url | type == "string")
+                  | select(.value.url | type == "string" and . != "")
                   | "\($plugin)\t\(.key)\t\(.value.url)"
                 ' "$cfg" 2>/dev/null || true
               done
@@ -73,10 +75,16 @@ jobs:
             local code
             # HEAD first — cheap and covers plain web endpoints. -L follows
             # redirects so a permanent redirect to a live page still passes.
+            #
+            # On a connection-level failure curl writes "000" to -w AND exits
+            # nonzero. The fallback assignment must happen OUTSIDE the command
+            # substitution — `... || echo "000"` inside $() would *append* a
+            # second "000", producing "000000" which falls through the case
+            # statement and silently passes a dead host.
             code="$(curl -sS -o /dev/null -w '%{http_code}' \
                       --connect-timeout 10 --max-time 10 \
                       --retry 2 --retry-delay 2 \
-                      -L -I "$url" 2>/dev/null || echo "000")"
+                      -L -I "$url" 2>/dev/null)" || code="000"
 
             # MCP endpoints typically reject HEAD (404/405) but answer POST
             # with a JSON-RPC body. Retry as a real MCP client would.
@@ -88,7 +96,7 @@ jobs:
                         -H 'Content-Type: application/json' \
                         -H 'Accept: application/json, text/event-stream' \
                         --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}' \
-                        "$url" 2>/dev/null || echo "000")"
+                        "$url" 2>/dev/null)" || code="000"
             fi
 
             case "$code" in