From 851dcc58d7ec3722fba693ddfb004cdf451ea0d2 Mon Sep 17 00:00:00 2001
From: koseokmin <koseokmin714@gmail.com>
Date: Sat, 22 Aug 2026 20:52:38 +0900
Subject: [PATCH] =?UTF-8?q?baseEndpoint=20=EC=A3=BC=EC=84=9D=EC=9D=84=20?=
 =?UTF-8?q?=EB=A7=A4=EB=8B=88=ED=8E=98=EC=8A=A4=ED=8A=B8=20endpoint=20?=
 =?UTF-8?q?=EC=A0=95=EC=B1=85=EC=97=90=20=EB=A7=9E=EA=B2=8C=20=EA=B3=A0?=
 =?UTF-8?q?=EC=B9=9C=EB=8B=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

6078852에서 Tool 실행 주소의 원천이 배포 설정에서 Tool Service 매니페스트로
바뀌었으나 application.yml 주석은 이전 불변식을 그대로 단언하고 있었다.
"nothing a Tool Service returns can change where MCP sends the call"은
지금 거짓이다.

baseEndpoint의 현재 역할(상대 endpoint 해석 기준)을 적고, 검증이 scheme과
host 확인뿐이어서 매니페스트가 임의의 HTTP(S) host를 지정할 수 있다는 점을
함께 남긴다. 이 신뢰 경계 변화는 코드 어디에도 기록돼 있지 않았다.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/main/resources/application.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 12cf8a0..4851949 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -89,8 +89,10 @@ mcp:
     # HTTP(S) Portal API or local Spring resource location such as file:./config/local-toolserver-info-sample-v1.json.
     registry-url: ${MCP_PORTAL_REGISTRY_URL:}
     refresh-interval-seconds: ${MCP_PORTAL_REFRESH_INTERVAL_SECONDS:300}
-  # Declared per deployment. baseEndpoint is the execution address and is owned by this file only:
-  # nothing a Tool Service returns can change where MCP sends the call.
+  # Declared per deployment. baseEndpoint is only the base a relative manifest endpoint resolves against.
+  # The execution address itself comes from the Tool Service manifest (endpoint or _meta.endpoint), and an
+  # absolute HTTP(S) value there decides where MCP sends the call. Only scheme and host are validated, so
+  # a manifest can point MCP at any HTTP(S) host: keep manifest sources trusted.
   bundles: []
   trace:
     enabled: true    # Rejects oversized MCP request bodies before controller processing.