[BUG] McpOpenApiGenerator throws ArrayIndexOutOfBoundsException when `@OpenAPIDefinition.servers()` is empty (the default)

[Aias00]

• Severity: High
• Location:
  shenyu-client/shenyu-client-mcp/shenyu-client-mcp-common/src/main/java/org/apache/shenyu/client/mcp/generator/McpOpenApiGenerator.java:51

Description:
Line 51 does server.addProperty(OPEN_API_SERVER_URL_KEY, definition.servers()[0].url()); with no length check. @ShenyuMcpTool.definition() defaults to @OpenAPIDefinition, whose servers() defaults to {} (empty). The sibling method McpServiceEventListener.buildApiSuperPath (:306-309) explicitly handles servers.length == 0 by returning "", so the empty-servers case is both reachable and anticipated — yet generateOpenApiJson was not given the same guard. A bare @ShenyuMcpTool on a controller class uses the empty default; generateOpenApiJson is reached via buildMcpToolsRegisterDTO → McpServiceEventListener.handleMethod whenever superPath does not contain "*" (the common case), and crashes immediately.

Impact:
Any MCP controller using @ShenyuMcpTool without explicitly declaring @OpenAPIDefinition(servers = {@Server(url=...)}) crashes at context refresh with ArrayIndexOutOfBoundsException, making the MCP client unusable in its default-annotation form.

Suggested fix:
Guard definition.servers() for emptiness in generateOpenApiJson (skip the server block or throw a descriptive IllegalArgumentException), mirroring buildApiSuperPath.

Confidence: High

• Related existing: none — [Task] MCP server plugin support auto config by importing openapi #6113/6117/6134 cover other MCP tool issues.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @yuluo-yx

A new issue has been opened by @Aias00:

• Title: [BUG] McpOpenApiGenerator throws ArrayIndexOutOfBoundsException when @OpenAPIDefinition.servers() is empty (the default)
• Link: [BUG] McpOpenApiGenerator throws ArrayIndexOutOfBoundsException when @OpenAPIDefinition.servers() is empty (the default) #6666

Please review when you have time. Thank you! 🙏