Dev

[h3xxit]

Summary by cubic

Turns protocol streaming and discovery paths into reliable, bounded operations instead of leaving unsupported generators, unbounded reconnects, or opaque failures. It also tightens endpoint and MCP authentication checks while preserving local loopback development.

Bug Fixes

• CLI now yields completed command results as one chunk; MCP awaits the result; TCP and UDP return proper async generators.
• MCP reuses one client per server and authentication configuration, tracks ownership per calling client, and closes sessions only when no manual still uses them.
• MCP manual OAuth2 now supplies bearer credentials when needed; token endpoints and HTTP/WS server URLs are validated before use.
• SSE resumes dropped streams with Last-Event-ID, retries at most 5 times with 60-second delays, and bounds handshakes to 30 seconds; initial failures still fail fast and POST streams are not replayed.
• SSE parsing handles CRLF and split UTF-8, validates the exact media type, and rejects oversized or malformed frames without reconnecting.
• Failed HTTP calls, discovery, and streaming paths include bounded server error/message/detail bodies.
• Remote manuals cannot point tools at loopback services; manuals discovered from loopback remain allowed.

Dependencies

• utcp_mcp pins mcp to <2 because mcp 2 removed APIs the plugin uses.
• Stdio MCP child stderr is suppressed by default; set UTCP_MCP_CHILD_STDERR=inherit to restore it while debugging.

^{Written for commit de9ef55. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 17 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="plugins/communication_protocols/http/tests/test_sse_communication_protocol.py">

<violation number="1" location="plugins/communication_protocols/http/tests/test_sse_communication_protocol.py:154">
P3: slow_handshake_handler sleeps a hard-coded 5s, but test_initial_handshake_timeout_raises patches HANDSHAKE_TIMEOUT_SECONDS to 0.3, so the client aborts the handshake at ~0.3s while the server-side handler coroutine keeps sleeping ~4.7s longer. After the test returns the handler is still pending on the event loop, and when it wakes it writes a 204 to a client that already disconnected. This leaves a dangling task that can emit "Task was destroyed but it is pending" noise and slow teardown. Reduce the sleep so it finishes near the timeout, or sleep until the transport is closed instead of a fixed 5s.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: slow_handshake_handler sleeps a hard-coded 5s, but test_initial_handshake_timeout_raises patches HANDSHAKE_TIMEOUT_SECONDS to 0.3, so the client aborts the handshake at ~0.3s while the server-side handler coroutine keeps sleeping ~4.7s longer. After the test returns the handler is still pending on the event loop, and when it wakes it writes a 204 to a client that already disconnected. This leaves a dangling task that can emit "Task was destroyed but it is pending" noise and slow teardown. Reduce the sleep so it finishes near the timeout, or sleep until the transport is closed instead of a fixed 5s.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/http/tests/test_sse_communication_protocol.py, line 154:

<comment>slow_handshake_handler sleeps a hard-coded 5s, but test_initial_handshake_timeout_raises patches HANDSHAKE_TIMEOUT_SECONDS to 0.3, so the client aborts the handshake at ~0.3s while the server-side handler coroutine keeps sleeping ~4.7s longer. After the test returns the handler is still pending on the event loop, and when it wakes it writes a 204 to a client that already disconnected. This leaves a dangling task that can emit "Task was destroyed but it is pending" noise and slow teardown. Reduce the sleep so it finishes near the timeout, or sleep until the transport is closed instead of a fixed 5s.</comment>

<file context>
@@ -105,6 +105,91 @@ async def token_header_auth_handler(request):
+
+async def slow_handshake_handler(request):
+    """Accepts the connection but does not send response headers for a long time."""
+    await asyncio.sleep(5)
+    return web.Response(status=204)
+
</file context>

[h3xxit]

Disposition of the 7 findings, all handled in #104 (targets dev, so this PR picks them up once it merges):

• Failed initialize leaves the child running: fixed, the session is disconnected and removed from active_sessions.
• RecursionError from a deeply nested body: fixed.
• Unterminated trailing SSE event: fixed to match the spec (discarded), with a test.
• Stale UDP comment: removed.
• 5 s slow-handshake handler: reduced to 1 s.
• retry: digits only, empty id:: fixed.

#104 also carries fixes from my own review: the MCP client is reused across calls instead of spawning a new server process per call (pre-existing), close() no longer raises on a missing attribute (pre-existing), POST streams are never re-issued on reconnect, event_type "message" matches untyped events, non-event-stream 200s fail instead of yielding nothing, and control characters in server error text are collapsed.

[cubic-dev-ai]

9 issues found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="plugins/communication_protocols/mcp/src/utcp_mcp/mcp_communication_protocol.py">

<violation number="1" location="plugins/communication_protocols/mcp/src/utcp_mcp/mcp_communication_protocol.py:281">
P2: When a manual has OAuth2 metadata but no server needs the manual bearer token, registration still contacts the token endpoint and can fail before starting an otherwise valid stdio server. Fetch the token only when a URL server lacks `auth_token` and an `Authorization` header.</violation>

<violation number="2" location="plugins/communication_protocols/mcp/src/utcp_mcp/mcp_communication_protocol.py:284">
P1: When two manuals reuse a `client_id` with different token endpoints or secrets, this new path sends the first manual's cached bearer token to the second server. The same cache returns expiring tokens forever, so calls fail after token expiry; scope the cache by issuer/credentials and refresh tokens before reuse.</violation>

<violation number="3" location="plugins/communication_protocols/mcp/src/utcp_mcp/mcp_communication_protocol.py:297">
P2: When a server config uses mcp-use's supported `auth` credential, this guard still injects the manual token because it checks only `auth_token` and `headers`. Preserve the server's `auth` value before injecting manual OAuth credentials.</violation>
</file>

<file name="plugins/communication_protocols/http/src/utcp_http/_security.py">

<violation number="1" location="plugins/communication_protocols/http/src/utcp_http/_security.py:500">
P2: When a loopback discovery URL redirects to a remote manual, this exemption trusts the initial URL rather than the origin that supplied the manual. Track the final response URL through discovery and apply the loopback check to that URL, or reject cross-origin redirects from loopback discovery.</violation>

<violation number="2" location="plugins/communication_protocols/http/src/utcp_http/_security.py:505">
P1: This misses resolver-valid loopback aliases such as `https://127.1/...`: `is_loopback_url` returns false, while the invocation's HTTPS check allows the request and the resolver maps the host to `127.0.0.1`. Canonicalize numeric host forms or resolve and reject loopback destinations before allowing a remote manual.</violation>

<violation number="3" location="plugins/communication_protocols/http/src/utcp_http/_security.py:505">
P1: A remote manual can bypass this check with a templated authority such as `https://{host}/...`: the check runs before `{host}` is resolved, then the invocation path substitutes `127.0.0.1` and `ensure_secure_url` permits it. Reject dynamic hosts for remote manuals or retain the manual's remote trust state and repeat this check after URL substitution.</violation>
</file>

<file name="plugins/communication_protocols/http/src/utcp_http/sse_communication_protocol.py">

<violation number="1" location="plugins/communication_protocols/http/src/utcp_http/sse_communication_protocol.py:177">
P1: When a loopback discovery URL redirects to a remote origin, this passes the original loopback URL, so the remote manual is exempted and can target loopback tools. Classify the manual using the final response origin instead.</violation>
</file>

<file name="plugins/communication_protocols/mcp/tests/test_mcp_oauth_security.py">

<violation number="1" location="plugins/communication_protocols/mcp/tests/test_mcp_oauth_security.py:41">
P2: This test performs real OAuth requests and can wait on connection timeouts or fail if port 1 is occupied; it also accepts any exception unrelated to URL validation. Seed the protocol’s token cache or mock the HTTP session, then assert the cached result so the secure-URL guard is tested without network I/O.</violation>
</file>

<file name="plugins/communication_protocols/http/src/utcp_http/http_communication_protocol.py">

<violation number="1" location="plugins/communication_protocols/http/src/utcp_http/http_communication_protocol.py:229">
P1: When a loopback discovery URL redirects to a remote manual, this call still classifies the response by the original loopback URL. The helper then exempts the manual, so its remote tool definitions can target loopback services; track whether any discovery redirect left the loopback origin before granting the exemption.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When two manuals reuse a client_id with different token endpoints or secrets, this new path sends the first manual's cached bearer token to the second server. The same cache returns expiring tokens forever, so calls fail after token expiry; scope the cache by issuer/credentials and refresh tokens before reuse.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/mcp/src/utcp_mcp/mcp_communication_protocol.py, line 284:

<comment>When two manuals reuse a `client_id` with different token endpoints or secrets, this new path sends the first manual's cached bearer token to the second server. The same cache returns expiring tokens forever, so calls fail after token expiry; scope the cache by issuer/credentials and refresh tokens before reuse.</comment>

<file context>
@@ -187,6 +267,37 @@ async def _ensure_mcp_client(self, manual_call_template: 'McpCallTemplate') -> M
+        if isinstance(manual_call_template.auth, OAuth2Auth):
+            # Fetches (and validates the token endpoint of) the manual's OAuth2
+            # credentials before any server connection is dialed.
+            token = await self._handle_oauth2(manual_call_template.auth)
+        for server_name, server_config in servers.items():
+            if not isinstance(server_config, dict):
</file context>

[cubic-dev-ai]

P1: This misses resolver-valid loopback aliases such as https://127.1/...: is_loopback_url returns false, while the invocation's HTTPS check allows the request and the resolver maps the host to 127.0.0.1. Canonicalize numeric host forms or resolve and reject loopback destinations before allowing a remote manual.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/http/src/utcp_http/_security.py, line 505:

<comment>This misses resolver-valid loopback aliases such as `https://127.1/...`: `is_loopback_url` returns false, while the invocation's HTTPS check allows the request and the resolver maps the host to `127.0.0.1`. Canonicalize numeric host forms or resolve and reject loopback destinations before allowing a remote manual.</comment>

<file context>
@@ -478,3 +478,35 @@ async def safe_request_with_redirects(
+    for tool in getattr(manual, "tools", None) or []:
+        call_template = getattr(tool, "tool_call_template", None)
+        url = getattr(call_template, "url", None)
+        if isinstance(url, str) and is_loopback_url(url):
+            raise ValueError(
+                f"Security error during {context}: a manual fetched from "
</file context>

[cubic-dev-ai]

P1: A remote manual can bypass this check with a templated authority such as https://{host}/...: the check runs before {host} is resolved, then the invocation path substitutes 127.0.0.1 and ensure_secure_url permits it. Reject dynamic hosts for remote manuals or retain the manual's remote trust state and repeat this check after URL substitution.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/http/src/utcp_http/_security.py, line 505:

<comment>A remote manual can bypass this check with a templated authority such as `https://{host}/...`: the check runs before `{host}` is resolved, then the invocation path substitutes `127.0.0.1` and `ensure_secure_url` permits it. Reject dynamic hosts for remote manuals or retain the manual's remote trust state and repeat this check after URL substitution.</comment>

<file context>
@@ -478,3 +478,35 @@ async def safe_request_with_redirects(
+    for tool in getattr(manual, "tools", None) or []:
+        call_template = getattr(tool, "tool_call_template", None)
+        url = getattr(call_template, "url", None)
+        if isinstance(url, str) and is_loopback_url(url):
+            raise ValueError(
+                f"Security error during {context}: a manual fetched from "
</file context>

[cubic-dev-ai]

P1: When a loopback discovery URL redirects to a remote origin, this passes the original loopback URL, so the remote manual is exempted and can target loopback tools. Classify the manual using the final response origin instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/http/src/utcp_http/sse_communication_protocol.py, line 177:

<comment>When a loopback discovery URL redirects to a remote origin, this passes the original loopback URL, so the remote manual is exempted and can target loopback tools. Classify the manual using the final response origin instead.</comment>

<file context>
@@ -174,6 +174,7 @@ async def register_manual(self, caller, manual_call_template: CallTemplate) -> R
                     await raise_for_status_with_body(response)
                     response_data = await response.json()
                     utcp_manual = UtcpManualSerializer().validate_dict(response_data)
+                    reject_remote_loopback_tool_urls(url, utcp_manual)
                     return RegisterManualResult(
                         success=True,
</file context>

Suggested change

	reject_remote_loopback_tool_urls(url, utcp_manual)
	reject_remote_loopback_tool_urls(str(response.url), utcp_manual)

[cubic-dev-ai]

P1: When a loopback discovery URL redirects to a remote manual, this call still classifies the response by the original loopback URL. The helper then exempts the manual, so its remote tool definitions can target loopback services; track whether any discovery redirect left the loopback origin before granting the exemption.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/http/src/utcp_http/http_communication_protocol.py, line 229:

<comment>When a loopback discovery URL redirects to a remote manual, this call still classifies the response by the original loopback URL. The helper then exempts the manual, so its remote tool definitions can target loopback services; track whether any discovery redirect left the loopback origin before granting the exemption.</comment>

<file context>
@@ -226,6 +226,7 @@ async def register_manual(self, caller, manual_call_template: CallTemplate) -> R
                         if "utcp_version" in response_data and "tools" in response_data:
                             logger.info(f"Detected UTCP manual from '{manual_call_template.name}'.")
                             utcp_manual = UtcpManualSerializer().validate_dict(response_data)
+                            reject_remote_loopback_tool_urls(manual_call_template.url, utcp_manual)
                         else:
                             logger.info(f"Assuming OpenAPI spec from '{manual_call_template.name}'. Converting to UTCP manual.")
</file context>

[cubic-dev-ai]

P2: When a manual has OAuth2 metadata but no server needs the manual bearer token, registration still contacts the token endpoint and can fail before starting an otherwise valid stdio server. Fetch the token only when a URL server lacks auth_token and an Authorization header.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/mcp/src/utcp_mcp/mcp_communication_protocol.py, line 281:

<comment>When a manual has OAuth2 metadata but no server needs the manual bearer token, registration still contacts the token endpoint and can fail before starting an otherwise valid stdio server. Fetch the token only when a URL server lacks `auth_token` and an `Authorization` header.</comment>

<file context>
@@ -187,6 +267,37 @@ async def _ensure_mcp_client(self, manual_call_template: 'McpCallTemplate') -> M
+        """
+        servers = copy.deepcopy(manual_call_template.config.mcpServers)
+        token: Optional[str] = None
+        if isinstance(manual_call_template.auth, OAuth2Auth):
+            # Fetches (and validates the token endpoint of) the manual's OAuth2
+            # credentials before any server connection is dialed.
</file context>

Suggested change

	if isinstance(manual_call_template.auth, OAuth2Auth):
	# Fetches (and validates the token endpoint of) the manual's OAuth2
	# credentials before any server connection is dialed.
	token = await self._handle_oauth2(manual_call_template.auth)
	if (
	isinstance(manual_call_template.auth, OAuth2Auth)
	and any(
	isinstance(server_config, dict)
	and "url" in server_config
	and not server_config.get("auth_token")
	and not _has_authorization_header(server_config)
	for server_config in servers.values()
	)
	):
	token = await self._handle_oauth2(manual_call_template.auth)

[cubic-dev-ai]

P2: When a loopback discovery URL redirects to a remote manual, this exemption trusts the initial URL rather than the origin that supplied the manual. Track the final response URL through discovery and apply the loopback check to that URL, or reject cross-origin redirects from loopback discovery.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/http/src/utcp_http/_security.py, line 500:

<comment>When a loopback discovery URL redirects to a remote manual, this exemption trusts the initial URL rather than the origin that supplied the manual. Track the final response URL through discovery and apply the loopback check to that URL, or reject cross-origin redirects from loopback discovery.</comment>

<file context>
@@ -478,3 +478,35 @@ async def safe_request_with_redirects(
+    tool's call-template URL. A manual fetched from loopback (local dev) is
+    exempt, exactly as the converter exempts a local spec.
+    """
+    if is_loopback_url(discovery_url):
+        return
+    for tool in getattr(manual, "tools", None) or []:
</file context>

[cubic-dev-ai]

P2: This test performs real OAuth requests and can wait on connection timeouts or fail if port 1 is occupied; it also accepts any exception unrelated to URL validation. Seed the protocol’s token cache or mock the HTTP session, then assert the cached result so the secure-URL guard is tested without network I/O.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/mcp/tests/test_mcp_oauth_security.py, line 41:

<comment>This test performs real OAuth requests and can wait on connection timeouts or fail if port 1 is occupied; it also accepts any exception unrelated to URL validation. Seed the protocol’s token cache or mock the HTTP session, then assert the cached result so the secure-URL guard is tested without network I/O.</comment>

<file context>
@@ -0,0 +1,108 @@
+    proto = McpCommunicationProtocol()
+    # Validation passes for a loopback token URL; the fetch then fails with a
+    # connection error, which must NOT be the security-guard message.
+    with pytest.raises(Exception) as excinfo:
+        await proto._handle_oauth2(_oauth("http://127.0.0.1:1/token"))
+    assert "Security error" not in str(excinfo.value)
</file context>

[cubic-dev-ai]

P2: When a server config uses mcp-use's supported auth credential, this guard still injects the manual token because it checks only auth_token and headers. Preserve the server's auth value before injecting manual OAuth credentials.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At plugins/communication_protocols/mcp/src/utcp_mcp/mcp_communication_protocol.py, line 297:

<comment>When a server config uses mcp-use's supported `auth` credential, this guard still injects the manual token because it checks only `auth_token` and `headers`. Preserve the server's `auth` value before injecting manual OAuth credentials.</comment>

<file context>
@@ -187,6 +267,37 @@ async def _ensure_mcp_client(self, manual_call_template: 'McpCallTemplate') -> M
+            # already carry their own credentials. mcp-use turns ``auth_token``
+            # into an ``Authorization: Bearer`` header on the connection.
+            if token is not None and "url" in server_config:
+                if not server_config.get("auth_token") and not _has_authorization_header(server_config):
+                    server_config["auth_token"] = token
+        return servers
</file context>

Suggested change

	if not server_config.get("auth_token") and not _has_authorization_header(server_config):
	if not server_config.get("auth_token") and not server_config.get("auth") and not _has_authorization_header(server_config):