What happens
With MCP_ALLOW_INSECURE=true (local development), the MCP connector's detail view ("What this gatekeeper can do") shows two rows with the same title and description:
- Any MCP server — An MCP endpoint you supply. Tools are discovered automatically, and writes need approval.
- Any MCP server — An MCP endpoint you supply. Tools are discovered automatically, and writes need approval.
Nothing tells the user how the two differ.
Cause
packages/gatekeeper-mcp/src/resources.ts builds HTTP_RESOURCE by spreading HTTPS_RESOURCE and only changing urlPattern, so title and description are identical. mcpResources(true) returns both.
Suggestion
Give the http entry its own title/description, e.g. "Any MCP server (http, local development only)", or collapse the two into a single entry whose pattern list depends on allowInsecure.
Environment
cloudflare-os main @ c0b6f3e (2026-09-04), pnpm run-local, macOS 26.6, Node 22.22. Still present in current main (resources.ts unchanged).
What happens
With
MCP_ALLOW_INSECURE=true(local development), the MCP connector's detail view ("What this gatekeeper can do") shows two rows with the same title and description:Nothing tells the user how the two differ.
Cause
packages/gatekeeper-mcp/src/resources.tsbuildsHTTP_RESOURCEby spreadingHTTPS_RESOURCEand only changingurlPattern, so title and description are identical.mcpResources(true)returns both.Suggestion
Give the http entry its own title/description, e.g. "Any MCP server (http, local development only)", or collapse the two into a single entry whose pattern list depends on
allowInsecure.Environment
cloudflare-os main @ c0b6f3e (2026-09-04),
pnpm run-local, macOS 26.6, Node 22.22. Still present in current main (resources.tsunchanged).