From dd53af2e4afa4c910caa4693c6bbf288edbfee13 Mon Sep 17 00:00:00 2001
From: tobin <tobin@anthropic.com>
Date: Tue, 19 May 2026 04:01:21 +0000
Subject: [PATCH] Fix MCP URL probe: connection failure was reported as PASS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

curl writes "000" to -w '%{http_code}' on a connection failure AND exits
nonzero. The previous fallback put the echo inside the command
substitution — both wrote, the captured value was "000000", and the
case statement's 000) arm didn't match, so dead hosts fell through to
PASS. Move the fallback assignment outside the substitution so the
captured value is exactly "000" and connection failures fail.

Also skip entries with an empty url field — those are placeholders
awaiting user config, not dead endpoints, and would false-fail.
---
 .github/workflows/check-mcp-urls.yml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/check-mcp-urls.yml b/.github/workflows/check-mcp-urls.yml
index 5bcdabf..a91b312 100644
--- a/.github/workflows/check-mcp-urls.yml
+++ b/.github/workflows/check-mcp-urls.yml
@@ -55,12 +55,14 @@ jobs:
                 # config, or wrapped under a top-level "mcpServers" key (also
                 # the shape inside plugin.json). Normalize, then keep entries
                 # with an http/sse type and a string url.
+                # Skip entries with empty url — those are placeholders awaiting
+                # user config, not dead endpoints, and would false-fail.
                 jq -r --arg plugin "$plugin" '
                   (if (type == "object" and has("mcpServers")) then .mcpServers else . end)
                   | to_entries[]
                   | select((.value | type) == "object")
                   | select(.value.type == "http" or .value.type == "sse")
-                  | select(.value.url | type == "string")
+                  | select(.value.url | type == "string" and . != "")
                   | "\($plugin)\t\(.key)\t\(.value.url)"
                 ' "$cfg" 2>/dev/null || true
               done
@@ -73,10 +75,16 @@ jobs:
             local code
             # HEAD first — cheap and covers plain web endpoints. -L follows
             # redirects so a permanent redirect to a live page still passes.
+            #
+            # On a connection-level failure curl writes "000" to -w AND exits
+            # nonzero. The fallback assignment must happen OUTSIDE the command
+            # substitution — `... || echo "000"` inside $() would *append* a
+            # second "000", producing "000000" which falls through the case
+            # statement and silently passes a dead host.
             code="$(curl -sS -o /dev/null -w '%{http_code}' \
                       --connect-timeout 10 --max-time 10 \
                       --retry 2 --retry-delay 2 \
-                      -L -I "$url" 2>/dev/null || echo "000")"
+                      -L -I "$url" 2>/dev/null)" || code="000"
 
             # MCP endpoints typically reject HEAD (404/405) but answer POST
             # with a JSON-RPC body. Retry as a real MCP client would.
@@ -88,7 +96,7 @@ jobs:
                         -H 'Content-Type: application/json' \
                         -H 'Accept: application/json, text/event-stream' \
                         --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}' \
-                        "$url" 2>/dev/null || echo "000")"
+                        "$url" 2>/dev/null)" || code="000"
             fi
 
             case "$code" in