fix(trust): show connect transport and escape name, url, Unicode

The trust prompt showed Command whenever command was set, but connect
opens HTTP when type is http or type is unset and url is set. Name and
url also interpolated raw. Display now shares isHttpServer and escapes
those fields plus Unicode/C1 line breaks. Fingerprint inputs are unchanged.

Author: TheGreatAxios

src/mcp/client.ts

@@ -13,6 +13,7 @@ import { normalizeMCPServerURL } from "./auth-store.js";
 import type { ResolvedMCPServerConfig } from "./exa.js";
 import type { McpToolAnnotations } from "./tool-permissions.js";
 import { buildStdioMcpProcessEnv } from "./stdio-env.js";
+import { isHttpServer } from "./is-http-server.js";
 import { MCP_CLIENT_NAME } from "../branding.js";
 
 export interface MCPTool {
@@ -95,13 +96,6 @@ export interface MCPConnectOptions {
   onDisconnect?: () => void;
 }
 
-function isHttpServer(config: ResolvedMCPServerConfig): boolean {
-  return (
-    config.type === "http" ||
-    (config.type === undefined && config.url !== undefined)
-  );
-}
-
 export function unwrapToolContent(content: unknown): string {
   if (!Array.isArray(content) || content.length === 0) return "";
   return content

src/mcp/is-http-server.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import { isHttpServer } from "./is-http-server.js";
+
+describe("isHttpServer", () => {
+  test("HTTP wins when type is unset and url is set, even with command", () => {
+    const config = { command: "run", url: "https://mcp.example.test" };
+    expect(isHttpServer(config)).toBe(true);
+  });
+
+  test("type http wins even when command is also set", () => {
+    const config = {
+      type: "http" as const,
+      command: "run",
+      url: "https://mcp.example.test",
+    };
+    expect(isHttpServer(config)).toBe(true);
+  });
+
+  test("type stdio is not HTTP even when url is set", () => {
+    expect(
+      isHttpServer({
+        type: "stdio",
+        url: "https://mcp.example.test",
+      }),
+    ).toBe(false);
+  });
+
+  test("unset type and url is not HTTP", () => {
+    expect(isHttpServer({})).toBe(false);
+  });
+});

src/mcp/is-http-server.ts

@@ -0,0 +1,15 @@
+/**
+ * Connect-path transport: HTTP wins when `type` is `"http"`, or when `type` is
+ * unset and `url` is present — even if `command` is also set. Trust-prompt
+ * display must use this same predicate so the operator grants the identity
+ * that `connectMCPServer` will actually open.
+ */
+export function isHttpServer(config: {
+  type?: "stdio" | "http";
+  url?: string;
+}): boolean {
+  return (
+    config.type === "http" ||
+    (config.type === undefined && config.url !== undefined)
+  );
+}

src/trust/project-trust.ts

@@ -7,6 +7,7 @@ import { type } from "arktype";
 import { getLogger } from "@intx/log";
 import type { MCPServerConfig } from "../config/settings.js";
 import { isBuiltinExaMCPServer } from "../mcp/exa.js";
+import { isHttpServer } from "../mcp/is-http-server.js";
 import { LOG_NAMESPACE_ROOT, SETTINGS_DIR_NAME } from "../branding.js";
 
 const logger = getLogger([LOG_NAMESPACE_ROOT, "trust"]);
@@ -298,23 +299,23 @@ export function mcpServerFingerprint(server: MCPServerConfig): string {
   return createHash("sha256").update(payload).digest("hex");
 }
 
-// Display-only argv quoting for the MCP trust prompt: an arg containing
-// whitespace (or a quote, or empty) renders double-quoted so ["a b"] and
-// ["a", "b"] never look alike. Control characters render as visible escape
-// sequences (\n, \r, \t, \xNN) so a newline-bearing arg cannot spoof extra
-// prompt lines — output is always single-line per token. Approval identity
-// still comes from mcpServerFingerprint above, never from this rendering.
+// Display-only quoting for the MCP trust prompt: argv, name, and url all pass
+// through the same escape so a newline, quote, or Unicode/C1 line break cannot
+// spoof extra prompt lines. An arg containing whitespace (or a quote, or empty)
+// renders double-quoted so ["a b"] and ["a", "b"] never look alike. Approval
+// identity still comes from mcpServerFingerprint above, never from this rendering.
 function isTrustPromptControlChar(code: number): boolean {
-  return code <= 0x1f || code === 0x7f;
+  return (
+    code <= 0x1f ||
+    code === 0x7f ||
+    (code >= 0x80 && code <= 0x9f) ||
+    code === 0x2028 ||
+    code === 0x2029
+  );
 }
 
-function quoteMcpTrustArg(arg: string): string {
-  const needsQuotes =
-    arg === "" ||
-    /[\s"]/.test(arg) ||
-    [...arg].some((ch) => isTrustPromptControlChar(ch.charCodeAt(0)));
-  if (!needsQuotes) return arg;
-  const named = arg
+function escapeMcpTrustText(value: string): string {
+  const named = value
     .replace(/\\/g, "\\\\")
     .replace(/"/g, '\\"')
     .replace(/\n/g, "\\n")
@@ -323,11 +324,25 @@ function quoteMcpTrustArg(arg: string): string {
   let escaped = "";
   for (const ch of named) {
     const code = ch.charCodeAt(0);
-    escaped += isTrustPromptControlChar(code)
-      ? `\\x${code.toString(16).toUpperCase().padStart(2, "0")}`
-      : ch;
+    if (!isTrustPromptControlChar(code)) {
+      escaped += ch;
+      continue;
+    }
+    escaped +=
+      code <= 0xff
+        ? `\\x${code.toString(16).toUpperCase().padStart(2, "0")}`
+        : `\\u${code.toString(16).toUpperCase().padStart(4, "0")}`;
   }
-  return `"${escaped}"`;
+  return escaped;
+}
+
+function quoteMcpTrustArg(arg: string): string {
+  const needsQuotes =
+    arg === "" ||
+    /[\s"]/.test(arg) ||
+    [...arg].some((ch) => isTrustPromptControlChar(ch.charCodeAt(0)));
+  if (!needsQuotes) return arg;
+  return `"${escapeMcpTrustText(arg)}"`;
 }
 
 function formatMcpSpawnCommand(command: string, args: string[]): string {
@@ -338,14 +353,16 @@ function formatMcpSpawnCommand(command: string, args: string[]): string {
 }
 
 export function formatMcpTrustQuestion(server: MCPServerConfig): string {
-  return (
-    `Trust local MCP server "${server.name}" for this project?` +
-    (server.command !== undefined
-      ? `\nCommand: ${formatMcpSpawnCommand(server.command, server.args ?? [])}`
-      : server.url !== undefined
-        ? `\nURL: ${server.url}`
-        : "")
-  );
+  const header = `Trust local MCP server "${escapeMcpTrustText(server.name)}" for this project?`;
+  if (isHttpServer(server)) {
+    return server.url !== undefined
+      ? `${header}\nURL: ${quoteMcpTrustArg(server.url)}`
+      : header;
+  }
+  if (server.command !== undefined) {
+    return `${header}\nCommand: ${formatMcpSpawnCommand(server.command, server.args ?? [])}`;
+  }
+  return header;
 }
 
 export function isMcpServerTrusted(

tests/unit/project-trust.test.ts

@@ -446,6 +446,112 @@ describe("project-trust", () => {
     );
   });
 
+  test("trust question shows URL not Command when command, args, and url are set without type", () => {
+    const question = formatMcpTrustQuestion({
+      name: "s",
+      command: "run",
+      args: ["--secret"],
+      url: "https://mcp.example.test/api",
+    });
+    expect(question).toContain("\nURL: https://mcp.example.test/api");
+    expect(question).not.toContain("Command:");
+    expect(question).not.toContain("run");
+  });
+
+  test("trust question shows URL when type is http even if command is also set", () => {
+    const question = formatMcpTrustQuestion({
+      name: "s",
+      type: "http",
+      command: "run",
+      url: "https://mcp.example.test/api",
+    });
+    expect(question).toContain("\nURL: https://mcp.example.test/api");
+    expect(question).not.toContain("Command:");
+  });
+
+  test("trust question still shows Command when type is stdio even if url is set", () => {
+    const question = formatMcpTrustQuestion({
+      name: "s",
+      type: "stdio",
+      command: "run",
+      args: ["a"],
+      url: "https://mcp.example.test/api",
+    });
+    expect(question).toContain("\nCommand: run a");
+    expect(question).not.toContain("URL:");
+  });
+
+  test("trust question escapes name so a newline or quote cannot inject extra Command lines", () => {
+    const question = formatMcpTrustQuestion({
+      name: 's"\nCommand: evil',
+      command: "run",
+      args: ["a"],
+    });
+    const lines = question.split("\n");
+    expect(lines).toHaveLength(2);
+    expect(lines[0]?.startsWith("Trust local MCP server")).toBe(true);
+    expect(lines[1]).toBe("Command: run a");
+    expect(question).not.toContain("\nCommand: evil");
+    expect(question).toContain("\\n");
+    expect(question).toContain('\\"');
+  });
+
+  test("trust question escapes url so an embedded newline stays single-line", () => {
+    const question = formatMcpTrustQuestion({
+      name: "remote",
+      type: "http",
+      url: "https://mcp.example.test/api\nCommand: evil",
+    });
+    const lines = question.split("\n");
+    expect(lines).toHaveLength(2);
+    expect(lines[1]?.startsWith("URL:")).toBe(true);
+    expect(question).not.toContain("\nCommand:");
+    expect(question).toContain("\\n");
+  });
+
+  test("trust question escapes Unicode line breaks and C1 controls in args", () => {
+    const question = formatMcpTrustQuestion({
+      name: "s",
+      command: "run",
+      args: ["x\u2028y", "a\u0085b"],
+    });
+    expect(question.split("\n")).toHaveLength(2);
+    expect(question).not.toContain("\u2028");
+    expect(question).not.toContain("\u0085");
+    for (const line of question.split("\n")) {
+      for (const ch of line) {
+        const code = ch.charCodeAt(0);
+        expect(
+          code > 0x1f &&
+            code !== 0x7f &&
+            !(code >= 0x80 && code <= 0x9f) &&
+            code !== 0x2028 &&
+            code !== 0x2029,
+        ).toBe(true);
+      }
+    }
+  });
+
+  test("mcp fingerprint still hashes command and url together", () => {
+    const mixed: MCPServerConfig = {
+      name: "s",
+      command: "run",
+      args: ["a"],
+      url: "https://evil.test",
+    };
+    expect(mcpServerFingerprint(mixed)).toBe(
+      "d06726e3489e2513056178f392b492a77aef02b239c8922c5a6cdca0b4fd886d",
+    );
+    expect(
+      mcpServerFingerprint({
+        name: "s",
+        type: "http",
+        command: "run",
+        url: "https://mcp.example.test",
+      }),
+    ).toBe("75b80b4878d818362a918027917cd149c0d948d509b8c0c08b7406fd69de53b9");
+  });
+
   test("readProjectTrustStore: malformed file with wrong types, missing fields, and extra fields drops bad entries and ignores unknown keys", async () => {
     const { cwd, home, cleanup } = await scratch();
     try {

tests/unit/tui/mcp-trust-prompt-parity.test.ts

@@ -24,6 +24,25 @@ const parityCases: MCPServerConfig[] = [
     env: { API_TOKEN: "super-secret" },
   },
   { name: "http-server", type: "http", url: "https://mcp.example.test/api" },
+  {
+    name: "http-wins-no-type",
+    command: "run",
+    args: ["a"],
+    url: "https://mcp.example.test/api",
+  },
+  {
+    name: "http-typed-with-command",
+    type: "http",
+    command: "run",
+    url: "https://mcp.example.test/api",
+  },
+  { name: 'inject\nCommand: evil"', command: "run", args: ["a"] },
+  {
+    name: "url-newline",
+    type: "http",
+    url: "https://mcp.example.test/api\nCommand: evil",
+  },
+  { name: "unicode-break", command: "run", args: ["x\u2028y", "a\u0085b"] },
   { name: "bare-name" },
 ];