webview-ui/src/components/mcp/RICH_MCP_TESTING.md
Use the echo MCP server to read back one of the test cases below into an MCP response.
https://github.com/Garoth/echo-mcp
Manually check the embeds, images, and whatever other enhancements for proper rendering. Remember that toggling Rich MCP off should cancel pending fetches. If the toggle was set to Plain, then the image/link previews should never be fetched until it's enabled. Remember that rich display mode will only load the first n URLs, currently set to 50
Working Image URLs
jpg: https://yavuzceliker.github.io/sample-images/image-205.jpg webp: https://seenandheard.app/assets/img/face-2.webp svg: https://seenandheard.app/assets/img/logo-white.svg
Looks like Image URL but is website
site: https://github.com/google/pprof/blob/main/doc/images/webui/flame-multi.png raw png: https://raw.githubusercontent.com/google/pprof/refs/heads/main/doc/images/webui/flame-multi.png
Gif:
Normal Working URLs for OG Embeds
https://www.google.com https://www.blogger.com https://youtube.com https://linkedin.com https://support.google.com https://cloudflare.com https://microsoft.com https://apple.com https://en.wikipedia.org https://play.google.com https://wordpress.org
Attack URLs & Unsupported Formats
data:text/html,<h1>Hello World</h1> data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg== javascript:alert('XSS') mailto:[email protected] tel:+1-234-567-8901 sms:+1-234-567-8901?body=Hello https://www.example.com/path/to/file.html?param=<script>alert('XSS')</script> https://www.example.com/path/to/file.html?param= https://www.example.com/path/to/file.html?param=javascript:alert('XSS') https://www.example.com/path/to/file.html?param=data:text/html,<script>alert('XSS')</script> https://www.example.com/path/to/file.html?param=data:image/svg+xml,<svg onload="alert('XSS')"> https://www.example.com/path/to/file.html?param=<iframe src="javascript:alert('XSS')"> https://www.example.com/path/to/file.html?param=<a href="javascript:alert('XSS')">Click me</a>
Broken & Weird Edge Cases
https://tectum.io/blog/dex-tools/ http://0.0.0.0:8025/img.png https://localhost:8080/img.jpg http://localhost:8080/ https://localhost/ http://httpbin.org/#/ https://snthonstcrgrfonhenth.com/nthshtf http://domain/.well-known/acme-challenge/token https://<strong>dextools</strong>.apiable.io/(Only