[rudycelekli]

Bug

findEntryJSONBytes and findEntryTOMLBytes (internal/connect/connect.go) return the first entry in range serversMap whose URL points at this instance. Go randomizes map iteration, so when a client config holds two such entries the answer changes from call to call.

That's a common shape: a legacy ?apikey= entry under a custom key left next to the current mcpproxy entry. findEquivalentJSONServerName was already made deterministic for exactly this reason (Spec 091 FR-005). The status lookup was not.

Trigger

A Cursor mcp.json with these entries:

{"mcpServers": {
  "mcpproxy":  {"url": "http://127.0.0.1:8080/mcp"},
  "old-proxy": {"url": "http://127.0.0.1:8080/mcp?apikey=OLD"}
}}

With this config, GetStatus reports server_name as mcpproxy or old-proxy depending on the call. ClientSecret, which the credential reconciler uses, reads the credential from whichever entry won. So it sometimes sees OLD and sometimes the current key.

Fix

Both finders now scan in a fixed order through a small entryScanOrder helper: the default mcpproxy key first, then the remaining names sorted. The name-only fallback and the PointsHere preference are unchanged.

Verification

• go test -count=1 -run TestFindEntry_TwoEntriesPointingHere ./internal/connect/ passes. The test covers both the JSON (cursor) and TOML (codex) paths and runs 50 lookups each.
• With connect.go reverted (git stash push internal/connect/connect.go), the same test fails: cursor lookup 0: got entry "old-proxy" (pointsHere=true), want "mcpproxy".
• go test -count=1 ./internal/connect/ passes.
• go vet ./internal/connect/ is clean.
• gofmt -l internal/connect/ is clean.

Commands were run with GOFLAGS=-mod=readonly CGO_ENABLED=0.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.

[Dumbris]

Merged. Thank you, @rudycelekli! Duplicate mcpproxy entries in a client config now resolve deterministically.