Skip to content

Update MCP server behavior and corresponding tests#22177

Open
thomascolden585-svg wants to merge 5 commits intoHomebrew:mainfrom
thomascolden585-svg:fix/mcp-server-guard-missing-params
Open

Update MCP server behavior and corresponding tests#22177
thomascolden585-svg wants to merge 5 commits intoHomebrew:mainfrom
thomascolden585-svg:fix/mcp-server-guard-missing-params

Conversation

@thomascolden585-svg
Copy link
Copy Markdown

What does this PR fix?

Fixes a crash in brew mcp-server caused by malformed JSON-RPC request shapes.
Previously, handlers assumed request["params"] was always a hash, so requests like {"jsonrpc":"2.0","id":1,"method":"logging/setLevel"} raised NoMethodError and exited the server process (DoS).

Why is this fix needed?

Any MCP client or intermediary sending valid JSON with missing/invalid params could terminate the server session and drop subsequent requests.
This change hardens request handling so malformed payloads return JSON-RPC errors instead of killing the process.

What changed?

  • Added params shape validation in logging/setLevel before reading "level".
  • Added robust validation in tools/call for "params", "name", "arguments", and "_meta" before nested access.
  • Return respond_error(id, "Invalid params") for malformed request shapes instead of raising exceptions.
  • Default tools/call arguments to {} when omitted.

Tests added/updated

  • Updated Library/Homebrew/test/mcp_server_spec.rb with regression tests for:
  • logging/setLevel with missing params returns "Invalid params".
  • tools/call with missing params returns "Invalid params".
  • tools/call with non-hash arguments returns "Invalid params".

Verification

  • ./bin/brew tests --only=mcp_server (could not run in this environment: Homebrew refuses to run as root)
  • ./bin/brew lgtm --online completed successfully

  • Have you followed the guidelines in our Contributing document?
  • Have you checked to ensure there aren't other open Pull Requests for the same change?
  • Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
  • Have you written new tests (excluding integration tests) for your changes? Here's an example.
  • Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

  • AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes. Non-maintainers may only have one AI-assisted/generated PR open at a time.

AI usage details (if applicable)

Used AI to help draft and implement request-shape validation and regression tests.
Manually reviewed the changes in Library/Homebrew/mcp_server.rb and Library/Homebrew/test/mcp_server_spec.rb, confirmed the crash path is handled, and verified that malformed requests now return JSON-RPC errors instead of exiting the server.
Full brew lgtm still needs to be run locally as a non-root user.

Copy link
Copy Markdown
Member

@MikeMcQuaid MikeMcQuaid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for PR. Need to improve error messages and then may be mergeable.

Comment thread Library/Homebrew/mcp_server.rb Outdated
Comment thread Library/Homebrew/mcp_server.rb Outdated
Comment thread Library/Homebrew/mcp_server.rb Outdated
Comment thread Library/Homebrew/mcp_server.rb Outdated
@thomascolden585-svg
Copy link
Copy Markdown
Author

Hi, @MikeMcQuaid
I have just addressed requested update.
When you have a moment, could you please review this PR?
Thank you for your time

Comment thread Library/Homebrew/mcp_server.rb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants