The MCP Registry catalog placed publisher-controlled URLs into HTML attributes using a text escaper. The repair uses attribute-aware escaping for those links.

@@ -0,0 +426,18 @@+                        <a href="${escapeHtml(server.repository.url)}" target="_blank" class="text-blue-600 hover:underline break-all" onclick="event.stopPropagation()">${escapeHtml(server.repository.url)}</a>+                    </div>+                ` : ''}+                ${server.websiteUrl ? `+                    <div>+                        <span class="font-medium">Website:</span>+                        <a href="${escapeHtml(server.websiteUrl)}" target="_blank" class="text-blue-600 hover:underline break-all" onclick="event.stopPropagation()">${escapeHtml(server.websiteUrl)}</a>+                    </div>+                ` : ''}+                <div>

+                    <a href="${baseUrl}/v0.1/servers/${encodeURIComponent(server.name)}/versions/${encodeURIComponent(server.version)}" target="_blank" class="text-blue-600 hover:underline break-all" onclick="event.stopPropagation()">View in API</a>+                </div>+                ${packagesHtml}+                ${remotesHtml}+                <details class="mt-4" onclick="event.stopPropagation()">+                    <summary class="cursor-pointer text-blue-600 hover:underline">View full server.json</summary>+                    <pre class="mt-2 p-3 bg-gray-100 rounded text-xs overflow-x-auto break-all">${escapeHtml(JSON.stringify(item, null, 2))}</pre>+                </details>

@@ -495,7 +498,18 @@             const div = document.createElement('div');             div.textContent = text;             return div.innerHTML;         } +        // Safe for HTML attribute values per OWASP attribute-encoding rule.+        function escapeAttr(text) {+            if (text == null) return '';+            return String(text)+                .replace(/&/g, '&')

+                .replace(/</g, '&lt;')+                .replace(/>/g, '&gt;')+                .replace(/"/g, '&quot;')+                .replace(/'/g, '&#39;');+        }+         function formatDate(dateStr) {             if (!dateStr) return '-';