[mcp] fix: reject noncanonical RPC routes - #172
Conversation
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughNoncanonical Strict /rpc path enforcement
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the HTTP server to strictly enforce exact matching for the /rpc endpoint. Noncanonical paths, such as those with trailing slashes, parameters, or query strings, are now rejected with a structured JSON 404 "Unknown endpoint" error before any JSON-RPC parsing or static fallback occurs. Relevant documentation and tests have been updated to reflect and verify this behavior. I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
README.md (1)
170-172: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider adding the noncanonical 404 behavior to README for consistency.
The other updated docs (AGENTS.md, docs/guides/mcp.md, docs/reference/cli.md) explicitly mention that noncanonical
/rpcURLs return structured404errors. Adding a brief note here would keep the user-facing docs aligned.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 170 - 172, The README HTTP mode description should mention the noncanonical /rpc 404 behavior so it stays aligned with the other docs. Update the HTTP mode section to note that only the exact /rpc endpoint is accepted and that noncanonical /rpc URLs return structured 404 errors, keeping the wording consistent with the existing HTTP mode explanation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@README.md`:
- Around line 170-172: The README HTTP mode description should mention the
noncanonical /rpc 404 behavior so it stays aligned with the other docs. Update
the HTTP mode section to note that only the exact /rpc endpoint is accepted and
that noncanonical /rpc URLs return structured 404 errors, keeping the wording
consistent with the existing HTTP mode explanation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: be3c559a-6043-4ea5-9a03-82339cfc9e48
📒 Files selected for processing (6)
AGENTS.mdREADME.mddocs/guides/mcp.mddocs/reference/cli.mdsrc/keep_gpu/mcp/server.pytests/mcp/test_http_api.py
|
Resolved the README consistency note in 38185db by documenting that noncanonical /rpc URLs return structured 404 errors. Final local verification remains green. |
1 participant
Summary
/rpcURLs such as/rpc/,/rpc;..., and/rpc?...with structured JSON 404 responses.POST /rpcJSON-RPC behavior andGET /rpc405 behavior intact./rpcendpoint contract in AGENTS, README, and MCP/service docs.Test Plan
PYTHONPATH=src python -m pytest tests/mcp/test_http_api.py::test_http_rpc_trailing_slash_returns_json_404_without_static_fallback tests/mcp/test_http_api.py::test_http_rpc_noncanonical_path_rejects_before_jsonrpc_parse -qPYTHONPATH=src python -m pytest tests/mcp/test_http_api.py -qpython -m ruff check .git diff --checkPYTHONPATH=src python -m pytest tests/mcp -qPYTHONPATH=src mkdocs build --strict --site-dir /tmp/keepgpu-rpc-noncanonical-sitePYTHONPATH=src pre-commit run --all-filesSummary by CodeRabbit
Documentation
/rpcpath./rpcURLs return structured 404 or 405 responses.Bug Fixes
/rpcwith trailing slashes, extra path parts, or query strings are now consistently rejected.GET /rpcnow returns a clear405 Method Not Allowedresponse withAllow: POST./rpcURLs do not fall back to other handlers.