feat(mcp): warn on hidden whitespace in MCP config values (Claude Code v2.1.219-inspired) - #75736
Merged
Merged
Conversation
Inspired by Claude Code v2.1.219: MCP config string values with hidden
leading/trailing whitespace (pasted tokens with trailing newlines, URLs
with leading spaces) now trigger a startup warning naming the server and
the dotted key path, instead of failing later as an opaque auth/connect
error.
Advisory only: values are never mutated, secrets are never logged (only
key paths), and warnings dedupe to once per process per (server, path).
Checked after ${VAR} interpolation so whitespace inside referenced env
vars is caught too.
Contributor
૮ >ﻌ< ა ci reviewran on 1dac21a ℹ️ InfoDesktop E2E visual evidence · View test artifacts · View job3 visual diffs. inline evidence upload failed. Failed to upload diff-1508682a2ae8-boot-ready-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-1508682a2ae8-boot-ready-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso) |
alt-glitch
added
type/feature
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MCP server config values with hidden leading/trailing whitespace (a token pasted with a trailing newline, a URL copied with a leading space) now produce a startup warning naming the server and the exact dotted key path — instead of surfacing later as an opaque 401 or connect failure.
Inspired by Claude Code v2.1.219: "a warning for MCP config values with hidden leading or trailing whitespace" (changelog).
How Claude Code does it vs. our adaptation
claude mcp list//mcp/ startup_load_mcp_config()— every discovery pass, deduped to once per process per (server, key path)args[1]), env maps — checked after${VAR}interpolation so whitespace inside a referenced env var is caught tooChanges
tools/mcp_tool.py: new_warn_hidden_whitespace()helper + call in_load_mcp_config()after env interpolation; process-level dedupe set.tests/tools/test_mcp_config_whitespace_warning.py: 11 tests (flag paths, nesting, list indexing, secret non-leakage, non-mutation, dedupe, E2E through_load_mcp_config).Validation
test_mcp_tool.py+ new)HERMES_HOME, real config.yaml)Infographic