[rudycelekli]

Pull Request

Description

cmd/mcpproxy/security_cmd.go builds every per-server request as "/api/v1/servers/"+serverName+"/…". The daemon decodes a %2F-encoded {id} on /api/v1/servers/{id}/* (MCP-1118), but only if the client sends one. With an official-registry id like io.github.owner/repo, the raw slash splits the name across path segments and the request lands on another route.

Trigger. mcpproxy security scan|status|report|approve|reject|integrity io.github.owner/repo. Ten call sites: /scan, /scan/status (x3), /scan/files, /scan/report (x2), /security/approve, /security/reject, /integrity.

All ten now go through one serverAPIPath(name, suffix) helper using url.PathEscape, so a new subcommand doesn't add an eleventh raw concatenation. security_cmd.go isn't touched by any open PR.

Testing

• I have tested these changes locally
• I have added/updated tests that prove my fix is effective or my feature works
• All existing tests pass

cmd/mcpproxy/security_cmd_path_escape_test.go:

• TestSecurityCmd_EscapesSlashServerName runs fetchFailedScannerInfo, printScanSummary and printScanDryRunPlan against an httptest daemon and checks every per-server EscapedPath() carries io.github.owner%2Frepo.
• TestServerAPIPath covers the helper, including the unchanged plain-name case.

go vet ./cmd/mcpproxy                                        # clean
go test ./cmd/mcpproxy -count=1                              # ok
# with the original call sites restored (helper kept so the test compiles):
go test ./cmd/mcpproxy -run TestSecurityCmd_EscapesSlashServerName -count=1
#   FAIL: per-server request path "/api/v1/servers/io.github.owner/repo/scan/status" ...
gofmt -l <changed files>                                     # clean

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 33.33333% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/mcpproxy/security_cmd.go	33.33%	8 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.

[Dumbris]

Merged. Thank you, @rudycelekli! mcpproxy security … subcommands now path-escape server names through one helper.