fix(cli): path-escape server names in security subcommands (#1753)

# Pull Request

## Description

`cmd/mcpproxy/security_cmd.go` builds every per-server request as
`"/api/v1/servers/"+serverName+"/…"`. The daemon decodes a `%2F`-encoded
`{id}` on `/api/v1/servers/{id}/*` (MCP-1118), but only if the client
sends one. With an official-registry id like `io.github.owner/repo`, the
raw slash splits the name across path segments and the request lands on
another route.

**Trigger.** `mcpproxy security
scan|status|report|approve|reject|integrity io.github.owner/repo`. Ten
call sites: `/scan`, `/scan/status` (x3), `/scan/files`, `/scan/report`
(x2), `/security/approve`, `/security/reject`, `/integrity`.

All ten now go through one `serverAPIPath(name, suffix)` helper using
`url.PathEscape`, so a new subcommand doesn't add an eleventh raw
concatenation. `security_cmd.go` isn't touched by any open PR.

## Testing

- [x] I have tested these changes locally
- [x] I have added/updated tests that prove my fix is effective or my
feature works
- [x] All existing tests pass

`cmd/mcpproxy/security_cmd_path_escape_test.go`:
- `TestSecurityCmd_EscapesSlashServerName` runs
`fetchFailedScannerInfo`, `printScanSummary` and `printScanDryRunPlan`
against an `httptest` daemon and checks every per-server `EscapedPath()`
carries `io.github.owner%2Frepo`.
- `TestServerAPIPath` covers the helper, including the unchanged
plain-name case.

```
go vet ./cmd/mcpproxy                                        # clean
go test ./cmd/mcpproxy -count=1                              # ok
# with the original call sites restored (helper kept so the test compiles):
go test ./cmd/mcpproxy -run TestSecurityCmd_EscapesSlashServerName -count=1
#   FAIL: per-server request path "/api/v1/servers/io.github.owner/repo/scan/status" ...
gofmt -l <changed files>                                     # clean
```

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rudycelekli

cmd/mcpproxy/security_cmd.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -643,7 +644,7 @@ func runSecurityScan(_ *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), hardTimeout)
 	defer cancel()
 
-	resp, err := client.DoRaw(ctx, http.MethodPost, "/api/v1/servers/"+serverName+"/scan", body)
+	resp, err := client.DoRaw(ctx, http.MethodPost, serverAPIPath(serverName, "/scan"), body)
 	if err != nil {
 		return fmt.Errorf("failed to start scan: %w", err)
 	}
@@ -717,7 +718,7 @@ func runSecurityScan(_ *cobra.Command, args []string) error {
 		case <-ticker.C:
 		}
 
-		statusResp, err := client.DoRaw(ctx, http.MethodGet, "/api/v1/servers/"+serverName+"/scan/status", nil)
+		statusResp, err := client.DoRaw(ctx, http.MethodGet, serverAPIPath(serverName, "/scan/status"), nil)
 		if err != nil {
 			return fmt.Errorf("failed to check scan status: %w", err)
 		}
@@ -905,7 +906,7 @@ func printScanDryRunPlan(client *cliclient.Client, serverName, scannerFlag strin
 	// 3. Best-effort: fetch the server's last scan context for source info.
 	//    This may 404 if the server has never been scanned — that's fine.
 	var scanContext map[string]interface{}
-	filesResp, err := client.DoRaw(ctx, http.MethodGet, "/api/v1/servers/"+serverName+"/scan/files", nil)
+	filesResp, err := client.DoRaw(ctx, http.MethodGet, serverAPIPath(serverName, "/scan/files"), nil)
 	if err == nil {
 		filesRaw, _ := io.ReadAll(filesResp.Body)
 		filesResp.Body.Close()
@@ -1389,7 +1390,7 @@ func runSecurityStatus(_ *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	resp, err := client.DoRaw(ctx, http.MethodGet, "/api/v1/servers/"+serverName+"/scan/status", nil)
+	resp, err := client.DoRaw(ctx, http.MethodGet, serverAPIPath(serverName, "/scan/status"), nil)
 	if err != nil {
 		return fmt.Errorf("failed to get scan status: %w", err)
 	}
@@ -1453,7 +1454,7 @@ func runSecurityReport(_ *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	resp, err := client.DoRaw(ctx, http.MethodGet, "/api/v1/servers/"+serverName+"/scan/report", nil)
+	resp, err := client.DoRaw(ctx, http.MethodGet, serverAPIPath(serverName, "/scan/report"), nil)
 	if err != nil {
 		return fmt.Errorf("failed to get scan report: %w", err)
 	}
@@ -1522,7 +1523,7 @@ type failedScannerInfo struct {
 // complete in the most recent scan job for `serverName`. Returns nil on any
 // error so the caller can render the report without per-scanner names.
 func fetchFailedScannerInfo(client *cliclient.Client, ctx context.Context, serverName string) []failedScannerInfo {
-	resp, err := client.DoRaw(ctx, http.MethodGet, "/api/v1/servers/"+serverName+"/scan/status", nil)
+	resp, err := client.DoRaw(ctx, http.MethodGet, serverAPIPath(serverName, "/scan/status"), nil)
 	if err != nil {
 		return nil
 	}
@@ -1581,7 +1582,7 @@ func runSecurityApprove(_ *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	resp, err := client.DoRaw(ctx, http.MethodPost, "/api/v1/servers/"+serverName+"/security/approve", body)
+	resp, err := client.DoRaw(ctx, http.MethodPost, serverAPIPath(serverName, "/security/approve"), body)
 	if err != nil {
 		return fmt.Errorf("failed to approve server: %w", err)
 	}
@@ -1628,7 +1629,7 @@ func runSecurityReject(_ *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	resp, err := client.DoRaw(ctx, http.MethodPost, "/api/v1/servers/"+serverName+"/security/reject", nil)
+	resp, err := client.DoRaw(ctx, http.MethodPost, serverAPIPath(serverName, "/security/reject"), nil)
 	if err != nil {
 		return fmt.Errorf("failed to reject server: %w", err)
 	}
@@ -1741,7 +1742,7 @@ func runSecurityIntegrity(_ *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	resp, err := client.DoRaw(ctx, http.MethodGet, "/api/v1/servers/"+serverName+"/integrity", nil)
+	resp, err := client.DoRaw(ctx, http.MethodGet, serverAPIPath(serverName, "/integrity"), nil)
 	if err != nil {
 		return fmt.Errorf("failed to check integrity: %w", err)
 	}
@@ -1815,7 +1816,7 @@ func runSecurityIntegrity(_ *cobra.Command, args []string) error {
 
 // printScanSummary fetches and prints a compact summary after a scan completes.
 func printScanSummary(client *cliclient.Client, ctx context.Context, serverName string) error {
-	resp, err := client.DoRaw(ctx, http.MethodGet, "/api/v1/servers/"+serverName+"/scan/report", nil)
+	resp, err := client.DoRaw(ctx, http.MethodGet, serverAPIPath(serverName, "/scan/report"), nil)
 	if err != nil {
 		fmt.Println("Scan completed. Use 'mcpproxy security report " + serverName + "' to view results.")
 		return nil
@@ -2973,3 +2974,10 @@ func formatTimestamp(ts string) string {
 	}
 	return ts
 }
+
+// serverAPIPath returns the REST path of a per-server sub-resource. The name is
+// path-escaped: official-registry ids are namespace/name, and the daemon only
+// decodes a %2F-encoded {id} (MCP-1118).
+func serverAPIPath(serverName, suffix string) string {
+	return "/api/v1/servers/" + url.PathEscape(serverName) + suffix
+}

cmd/mcpproxy/security_cmd_path_escape_test.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"go.uber.org/zap"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/cliclient"
+)
+
+// `mcpproxy security status|report|scan io.github.owner/repo` must address the
+// server as one %2F-encoded path segment; an unescaped slash splits it and the
+// request lands on another route.
+func TestSecurityCmd_EscapesSlashServerName(t *testing.T) {
+	const name = "io.github.owner/repo"
+
+	var (
+		mu    sync.Mutex
+		paths []string
+	)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		paths = append(paths, r.URL.EscapedPath())
+		mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"success":true,"data":{}}`))
+	}))
+	defer ts.Close()
+
+	client := cliclient.NewClient(ts.URL, zap.NewNop().Sugar())
+	ctx := context.Background()
+
+	_ = fetchFailedScannerInfo(client, ctx, name)
+	_ = printScanSummary(client, ctx, name)
+	_ = printScanDryRunPlan(client, name, "")
+
+	mu.Lock()
+	defer mu.Unlock()
+	var perServer []string
+	for _, p := range paths {
+		if strings.HasPrefix(p, "/api/v1/servers/") {
+			perServer = append(perServer, p)
+		}
+	}
+	if len(perServer) < 3 {
+		t.Fatalf("expected per-server requests, got %v", paths)
+	}
+	for _, p := range perServer {
+		if !strings.HasPrefix(p, "/api/v1/servers/io.github.owner%2Frepo/") {
+			t.Errorf("per-server request path %q does not carry the escaped server name", p)
+		}
+	}
+}
+
+func TestServerAPIPath(t *testing.T) {
+	if got, want := serverAPIPath("io.github.owner/repo", "/scan"), "/api/v1/servers/io.github.owner%2Frepo/scan"; got != want {
+		t.Errorf("serverAPIPath = %q, want %q", got, want)
+	}
+	if got, want := serverAPIPath("github", "/integrity"), "/api/v1/servers/github/integrity"; got != want {
+		t.Errorf("serverAPIPath = %q, want %q", got, want)
+	}
+}