Conversation
…CERTS The credential exchange reported every network-level failure as a bare 'fetch failed', hiding the real reason (TLS, DNS, refused connection) in the error's cause. The exchange error now names the underlying cause code, and certificate-trust failures (self-signed / untrusted local CAs from tools like Laravel Herd/Valet, Local, OrbStack, mkcert) carry an actionable NODE_EXTRA_CA_CERTS hint — Node uses its own CA bundle and ignores the operating system's trust store, so a cert the browser trusts can still fail in the connector. When NODE_EXTRA_CA_CERTS is set during connect, it is now copied into every generated MCP client config (buildMcpEntry for Cursor / Claude Desktop / printed configs, claudeCodeAddArgs for 'claude mcp add'): the server talks to the same site over the same Node TLS stack, so it needs the same trust anchor the connector did.
WalkthroughThis patch release (v2.0.1) enhances credential-exchange failure reporting by detecting TLS certificate trust errors and propagating NODE_EXTRA_CA_CERTS into MCP server configurations. The same changes are implemented across both the Node.js connector and WordPress plugin, with comprehensive test coverage and user-facing documentation updates. ChangesTLS Error Handling and CA Certificate Configuration
🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
tests/connect.test.ts (1)
694-699: ⚡ Quick winAssert every trust code used by production logic.
This list is missing
UNABLE_TO_GET_ISSUER_CERTandCERT_UNTRUSTED, so regressions on those codes would slip through.Suggested patch
const trustCodes = [ 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'SELF_SIGNED_CERT_IN_CHAIN', + 'UNABLE_TO_GET_ISSUER_CERT', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', + 'CERT_UNTRUSTED', ];🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/connect.test.ts` around lines 694 - 699, The test's trustCodes array (variable trustCodes) is missing two production-used error codes; update the trustCodes declaration to include 'UNABLE_TO_GET_ISSUER_CERT' and 'CERT_UNTRUSTED' alongside the existing entries so the test asserts all trust-related SSL error codes used by production logic.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/connect.ts`:
- Around line 485-487: The check uses extraCaCerts.trim() but writes the
untrimmed extraCaCerts into env/args; change the code to compute a trimmed value
(e.g., const trimmedExtraCa = extraCaCerts.trim()), use that for the hasCaCerts
check and assign trimmedExtraCa to env.NODE_EXTRA_CA_CERTS and to any args (the
other occurrence around the args assignment) so leading/trailing whitespace
can't produce an invalid path.
---
Nitpick comments:
In `@tests/connect.test.ts`:
- Around line 694-699: The test's trustCodes array (variable trustCodes) is
missing two production-used error codes; update the trustCodes declaration to
include 'UNABLE_TO_GET_ISSUER_CERT' and 'CERT_UNTRUSTED' alongside the existing
entries so the test asserts all trust-related SSL error codes used by production
logic.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 1d0eac44-b4ef-4106-9459-f747d5322586
📒 Files selected for processing (6)
package.jsonsrc/connect.tstests/connect.test.tswordpress-plugin/gk-block-mcp/assets/mcp-server/index.cjswordpress-plugin/gk-block-mcp/gk-block-mcp.phpwordpress-plugin/gk-block-mcp/readme.txt
Comment on lines
+485
to
+487
| const hasCaCerts = typeof extraCaCerts === 'string' && extraCaCerts.trim() !== ''; | ||
| if (hasCaCerts) { | ||
| env.NODE_EXTRA_CA_CERTS = extraCaCerts; |
There was a problem hiding this comment.
Trim extraCaCerts before writing it into env/args.
The presence check uses trim(), but the untrimmed value is persisted/forwarded. Leading/trailing whitespace can produce an invalid path and break TLS trust loading.
Suggested patch
export function buildMcpEntry(
creds: Credentials,
extraCaCerts: string | undefined = process.env.NODE_EXTRA_CA_CERTS
): McpServerEntry {
+ const normalizedExtraCaCerts =
+ typeof extraCaCerts === 'string' ? extraCaCerts.trim() : '';
+
const env: Record<string, string> = {
WORDPRESS_URL: creds.site,
WORDPRESS_USER: creds.user,
WORDPRESS_APP_PASSWORD: creds.password,
};
- const hasCaCerts = typeof extraCaCerts === 'string' && extraCaCerts.trim() !== '';
- if (hasCaCerts) {
- env.NODE_EXTRA_CA_CERTS = extraCaCerts;
+ if (normalizedExtraCaCerts !== '') {
+ env.NODE_EXTRA_CA_CERTS = normalizedExtraCaCerts;
}
return {
command: 'npx',
args: ['-y', '`@gravitykit/block-mcp`'],
env,
@@
export function claudeCodeAddArgs(
creds: Credentials,
name: string = 'block-mcp',
extraCaCerts: string | undefined = process.env.NODE_EXTRA_CA_CERTS
): string[] {
+ const normalizedExtraCaCerts =
+ typeof extraCaCerts === 'string' ? extraCaCerts.trim() : '';
+
const envArgs = [
'--env',
`WORDPRESS_URL=${creds.site}`,
'--env',
`WORDPRESS_USER=${creds.user}`,
'--env',
`WORDPRESS_APP_PASSWORD=${creds.password}`,
];
- const hasCaCerts = typeof extraCaCerts === 'string' && extraCaCerts.trim() !== '';
- if (hasCaCerts) {
- envArgs.push('--env', `NODE_EXTRA_CA_CERTS=${extraCaCerts}`);
+ if (normalizedExtraCaCerts !== '') {
+ envArgs.push('--env', `NODE_EXTRA_CA_CERTS=${normalizedExtraCaCerts}`);
}
return ['mcp', 'add', name, '--scope', 'user', ...envArgs, '--', 'npx', '-y', '`@gravitykit/block-mcp`'];
}Also applies to: 582-584
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/connect.ts` around lines 485 - 487, The check uses extraCaCerts.trim()
but writes the untrimmed extraCaCerts into env/args; change the code to compute
a trimmed value (e.g., const trimmedExtraCa = extraCaCerts.trim()), use that for
the hasCaCerts check and assign trimmedExtraCa to env.NODE_EXTRA_CA_CERTS and to
any args (the other occurrence around the args assignment) so leading/trailing
whitespace can't produce an invalid path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 2.0.1
Connector fix for local development sites served over HTTPS with locally-trusted certificates.
Changes
NODE_EXTRA_CA_CERTSfetch failed, with an actionableNODE_EXTRA_CA_CERTShint on certificate-trust failures (Node ignores the OS trust store, so certs from Laravel Herd/Valet, Local, OrbStack, mkcert fail even when the browser trusts them).NODE_EXTRA_CA_CERTSset during connect is copied into every generated MCP client config (Cursor, Claude Desktop,claude mcp add, printed configs) so the server can keep reaching the site after setup.package.json2.0.1, changelog + Upgrade Notice.Verification
tsc --noEmit: cleancomposer lint: 0 errors / 0 warnings ·composer analyze: [OK]claude mcp add→ authenticated REST call verified against a Herd-served local siteSummary by CodeRabbit
New Features
Bug Fixes
💾 Build file (58c9c99).