Skip to content

fix(server): validate low-level tool inputs - #2634

Open
uuzzrm wants to merge 1 commit into
modelcontextprotocol:mainfrom
uuzzrm:codex/validate-low-level-tool-inputs
Open

fix(server): validate low-level tool inputs#2634
uuzzrm wants to merge 1 commit into
modelcontextprotocol:mainfrom
uuzzrm:codex/validate-low-level-tool-inputs

Conversation

@uuzzrm

@uuzzrm uuzzrm commented Aug 10, 2026

Copy link
Copy Markdown

Fixes #2628

Summary

  • Remember each tool inputSchema advertised by a low-level tools/list response for the active connection.
  • Validate tools/call arguments before dispatch and return an isError tool result when the arguments do not match the advertised schema.
  • Keep the high-level McpServer Standard Schema parsing path unchanged, including schemas that intentionally coerce or transform values.
  • Add regression coverage for invalid and valid calls, connection-scoped schema state, custom JSON Schema validators, and high-level coercion.
  • Update the low-level server and schema validator documentation and example.

Verification

Passed:

  • pnpm lint:all
  • pnpm typecheck:all
  • pnpm build:all
  • pnpm --filter @modelcontextprotocol/server test (42 files, 473 tests)
  • pnpm --filter @modelcontextprotocol/examples typecheck
  • pnpm --filter @modelcontextprotocol/examples exec tsx guides/advanced/low-level-server.examples.ts

The repository-wide pnpm test:all run was blocked by two existing examples/shared tests because the local environment could not load the better-sqlite3 native binding. The server, client, core, and middleware test suites completed successfully.

@uuzzrm
uuzzrm requested a review from a team as a code owner August 10, 2026 07:11
@pkg-pr-new

pkg-pr-new Bot commented Aug 10, 2026

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2634

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2634

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2634

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2634

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2634

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2634

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2634

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2634

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2634

commit: dc24b03

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Low-level Server API publishes inputSchema in tools/list but does not enforce it on tools/call

1 participant