Safari gave my blank tab no URL. My security check read that as "not yours."

Description and use

safari-mcp failed to navigate, rotate, or close blank tabs due to an origin guard misinterpreting missing URLs. One‑line fixes in v2.22.12 and v2.22.13 resolved the issue.

Problem

An AI agent using safari-mcp could not navigate, rotate, or close a blank tab because the extension’s origin guard misinterpreted Safari’s missing URL as a mismatch.

Outcome

After applying the two fixes, the agent can successfully navigate, rotate, and close blank tabs, restoring intended functionality.

Workflow

• 1. Agent calls safari_new_tab() without a URL. 2. Extension mints a receipt for the new tab. 3. Agent calls safari_navigate() with the receipt. 4. Extension checks receipt origin against tab origin. 5. Failure occurs because tab origin is reported as empty. 6. Agent’s commands are refused. 7. Developer releases v2.22.12: allowReceiptOriginChange for get_tab_receipt and close_tab. 8. Developer releases v2.22.13: modify _receiptOrigin to treat missing URL as "about:blank". 9. Rebuild Safari extension. 10. Agent can now navigate, rotate, and close blank tabs.

Evidence

The agent had done everything right. It called safari_new_tab() without a URL, kept the receipt the tool returned, and passed it to safari_navigate. The tab could not be navigated, the receipt could not be rotated, and the tab could not be closed.

Source

v2.22.12, the moved tab: const allowReceiptOriginChange = type === "get_tab_receipt" || type === "close_tab";

Source

v2.22.13, the blank tab: if (!raw || raw === "about:blank") return "about:blank";

Source