[GH-ISSUE #6571] [Bug] Browser agent hints misidentify mixed-case well-known resource paths #3960

New issue

Closed

opened 2026-10-31 00:45:36 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:36 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6571

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Source-only finding; runtime reproduction NOT RUN. During inspect_web_page, an observed response from https://example.test/.well-known/MCP produces an agent hint whose mechanism is well_known_resource and whose declaration is /.well-known/mcp. On a case-sensitive HTTP server these are different resources. The uppercase path can serve an ordinary unrelated resource while the lowercase endpoint does not exist.

The hint retains the uppercase URL but attributes the lowercase well-known declaration to it. This report concerns evidence correctness, not a trust or authorization bypass.

Reproduction

Actually performed: inspected the public tool contract, capture adapter, response-event handler, metadata projection, and final result assembly at the source baseline below. No provider, browser, or production helper was executed.

Proposed runtime steps — UNEXECUTED:

Use an ordinary fixture page on https://example.test that requests /.well-known/MCP during the capture window. Serve an unrelated successful response there, with no Link or agent-specific headers; let /.well-known/mcp return 404.
Call MCP inspect_web_page with {"cdp_endpoint":"http://127.0.0.1:9222","target_id":"TARGET_ID_FROM_LIST_BROWSER_TARGETS","observation_ms":5000} for that page.
Inspect normalized_result.metadata.agent_hints. The source-derived result includes {"mechanism":"well_known_resource","declaration":"/.well-known/mcp","url":"https://example.test/.well-known/MCP","trust":"page-declared-untrusted"}.

Frequency: deterministic for this source path and spelling; real-provider frequency NOT_ENOUGH_INFO.

Expected behavior

Classify the observed path without case-folding it into another resource. The mixed-case URL alone should not produce the lowercase well-known-resource hint. An actual response from the exact lowercase path may continue to produce that hint.

RFC 3986 section 6.2.2.1 distinguishes scheme/host case normalization from the other URI components. REA's repository contract requires preserving selected URLs and evidence, and the browser guide describes retained declarations and derived untrusted hints.

Impact and scope

Bounded wrong discovery evidence: ordinary responses at /.well-known/MCP, /.WELL-KNOWN/mcp, or similarly case-varied recognized paths can be reported as agent-protocol resources. Consumers following the metadata can investigate a protocol endpoint that was never observed. The original URL is retained, so a caller can inspect its exact spelling; no target data is modified. Reach on real websites and downstream consumer behavior were not measured.

REA version

Source-only baseline: package 6.7.0, main revision 46111dd091f2ae01baab9eb119b53b9bd309a05b. The supplied release baseline is npm 6.7.0; the published runtime was not run.

Runtime and platform

Source-only; no provider runtime run. Inspection host: Linux x86_64, observed with uname -sm. Node.js and browser runtime: NOT RUN.

Target and artifact context

Ordinary in-origin HTTP response during passive page inspection; synthetic paths only. No private target or captured artifact was used.

Interface

MCP

Earliest failure stage

Capture or observation

Relevant output or evidence

Source-derived proof, not executed output:

Public inspect_web_page contract admits passive inspection of the selected page. Provider dispatch reaches capture.
Response handling supplies the in-scope observed URL to safeResponseMetadata and appends its hints without interpreting their declaration.
Metadata projection unconditionally adds wellKnownHint(url) to the hints. The matcher lowercases the complete pathname before checking the exact lowercase path set, then emits that lowercased path as the declaration.
Final capture assembly retains those hints; deduplication removes only identical hints and does not correct resource attribution.

Missing evidence: live browser acquisition and public CLI/MCP runtime reproduction. No post-draft reverification pass was performed.

Typed outcome or recovery expected

No well_known_resource hint from a case-variant path without independent evidence associating it with that protocol resource. Preserve the actual response URL.

Analysis or suspected cause

The producer uses .pathname.toLowerCase() as a resource-identity lookup. Lowercasing a path changes the lookup key even though no redirect, alias, or server equivalence was observed. This is independent of the Link parser's duplicate-parameter, quoted-pair, and anchor handling.

Additional context

Searched the supplied open-issue and open-PR inventories by title and body for wellKnownHint, well_known_resource, well-known path case/lowercase variants, and CdpSafeMetadata. Read related issues #6504, #6505, and #6506; all concern independent Link-header parsing behaviors, whereas this trigger has no Link header. No matching open report or PR was found. A final live search of open and closed issues for the function, mechanism, path-case terms, and metadata module found no matching report. Closed reports #2596, #4679, and #4677 address Content-Length, repeated Link fields, or COOP/COEP policy parsing instead.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A concrete valid in-origin HTTP response reaches a projection that emits a protocol-resource declaration for a different, case-distinct path; the original URL remains available and no target state changes.
Workaround status: available
Workaround basis: The hint retains the exact original URL, so callers can reject case-varied path matches by comparing its pathname with the declared well-known path; no lost source value is needed for this bounded check.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6571 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior Source-only finding; runtime reproduction NOT RUN. During `inspect_web_page`, an observed response from `https://example.test/.well-known/MCP` produces an agent hint whose mechanism is `well_known_resource` and whose declaration is `/.well-known/mcp`. On a case-sensitive HTTP server these are different resources. The uppercase path can serve an ordinary unrelated resource while the lowercase endpoint does not exist. The hint retains the uppercase URL but attributes the lowercase well-known declaration to it. This report concerns evidence correctness, not a trust or authorization bypass. ### Reproduction Actually performed: inspected the public tool contract, capture adapter, response-event handler, metadata projection, and final result assembly at the source baseline below. No provider, browser, or production helper was executed. Proposed runtime steps — UNEXECUTED: 1. Use an ordinary fixture page on `https://example.test` that requests `/.well-known/MCP` during the capture window. Serve an unrelated successful response there, with no Link or agent-specific headers; let `/.well-known/mcp` return 404. 2. Call MCP `inspect_web_page` with `{"cdp_endpoint":"http://127.0.0.1:9222","target_id":"TARGET_ID_FROM_LIST_BROWSER_TARGETS","observation_ms":5000}` for that page. 3. Inspect `normalized_result.metadata.agent_hints`. The source-derived result includes `{"mechanism":"well_known_resource","declaration":"/.well-known/mcp","url":"https://example.test/.well-known/MCP","trust":"page-declared-untrusted"}`. Frequency: deterministic for this source path and spelling; real-provider frequency NOT_ENOUGH_INFO. ### Expected behavior Classify the observed path without case-folding it into another resource. The mixed-case URL alone should not produce the lowercase well-known-resource hint. An actual response from the exact lowercase path may continue to produce that hint. [RFC 3986 section 6.2.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-6.2.2.1) distinguishes scheme/host case normalization from the other URI components. REA's [repository contract](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/AGENTS.md#L15-L17) requires preserving selected URLs and evidence, and the [browser guide](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/docs/browser-observation.md#L329-L335) describes retained declarations and derived untrusted hints. ### Impact and scope Bounded wrong discovery evidence: ordinary responses at `/.well-known/MCP`, `/.WELL-KNOWN/mcp`, or similarly case-varied recognized paths can be reported as agent-protocol resources. Consumers following the metadata can investigate a protocol endpoint that was never observed. The original URL is retained, so a caller can inspect its exact spelling; no target data is modified. Reach on real websites and downstream consumer behavior were not measured. ### REA version Source-only baseline: package 6.7.0, main revision `46111dd091f2ae01baab9eb119b53b9bd309a05b`. The supplied release baseline is npm 6.7.0; the published runtime was not run. ### Runtime and platform Source-only; no provider runtime run. Inspection host: Linux x86_64, observed with `uname -sm`. Node.js and browser runtime: NOT RUN. ### Target and artifact context Ordinary in-origin HTTP response during passive page inspection; synthetic paths only. No private target or captured artifact was used. ### Interface MCP ### Earliest failure stage Capture or observation ### Relevant output or evidence Source-derived proof, not executed output: - [Public `inspect_web_page` contract](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/contracts/browserToolContracts.ts#L170-L184) admits passive inspection of the selected page. [Provider dispatch](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/browser/CdpBrowserProvider.ts#L175-L181) reaches capture. - [Response handling](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/browser/CdpCaptureEventHandlers.ts#L404-L416) supplies the in-scope observed URL to `safeResponseMetadata` and appends its hints without interpreting their declaration. - [Metadata projection](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/browser/CdpSafeMetadata.ts#L27-L36) unconditionally adds `wellKnownHint(url)` to the hints. [The matcher](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/browser/CdpSafeMetadata.ts#L292-L301) lowercases the complete pathname before checking [the exact lowercase path set](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/browser/CdpSafeMetadata.ts#L360-L365), then emits that lowercased path as the declaration. - [Final capture assembly](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/browser/CdpPageCapture.ts#L380-L387) retains those hints; [deduplication](https://github.com/morluto/rea/blob/46111dd091f2ae01baab9eb119b53b9bd309a05b/src/browser/CdpPageCapture.ts#L441-L452) removes only identical hints and does not correct resource attribution. Missing evidence: live browser acquisition and public CLI/MCP runtime reproduction. No post-draft reverification pass was performed. ### Typed outcome or recovery expected No `well_known_resource` hint from a case-variant path without independent evidence associating it with that protocol resource. Preserve the actual response URL. ### Analysis or suspected cause The producer uses `.pathname.toLowerCase()` as a resource-identity lookup. Lowercasing a path changes the lookup key even though no redirect, alias, or server equivalence was observed. This is independent of the Link parser's duplicate-parameter, quoted-pair, and anchor handling. ### Additional context Searched the supplied open-issue and open-PR inventories by title and body for `wellKnownHint`, `well_known_resource`, well-known path case/lowercase variants, and `CdpSafeMetadata`. Read related issues #6504, #6505, and #6506; all concern independent Link-header parsing behaviors, whereas this trigger has no Link header. No matching open report or PR was found. A final live search of open and closed issues for the function, mechanism, path-case terms, and metadata module found no matching report. Closed reports #2596, #4679, and #4677 address Content-Length, repeated Link fields, or COOP/COEP policy parsing instead. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A concrete valid in-origin HTTP response reaches a projection that emits a protocol-resource declaration for a different, case-distinct path; the original URL remains available and no target state changes. - Workaround status: available - Workaround basis: The hint retains the exact original URL, so callers can reject case-varied path matches by comparing its pathname with the declared well-known path; no lost source value is needed for this bounded check.

bsakaguchi closed this issue

2026-10-31 00:45:36 +00:00

bsakaguchi referenced this issue

2026-10-31 01:10:53 +00:00

[PR #3975] [MERGED] fix(browser): reject empty capture containers beyond the 64-level nesting budget #5976