Validate required MCP arguments instead of silently defaulting them #2

New Issue

2026-09-04T07:52:08+02:00

nami-ai commented

2026-09-04 07:52:08 +02:00

The MCP tool schemas mark arguments as required, but dispatch silently replaces missing or wrongly typed values with "" or 0 (src/mcp/mod.rs:94-127). This makes malformed requests look successful: a missing search_symbols.query returns [], while a missing index_create.path becomes Path::new("") and can index the server's current working directory. Invalid JSON messages are also discarded without a JSON-RPC error (src/mcp/mod.rs:23-25).

Please validate tool names and argument types at the protocol boundary and return an explicit MCP error for invalid params. Required paths, queries, IDs, and ranges should never silently become empty values or current-directory operations.

The MCP tool schemas mark arguments as required, but `dispatch` silently replaces missing or wrongly typed values with `""` or `0` (`src/mcp/mod.rs:94-127`). This makes malformed requests look successful: a missing `search_symbols.query` returns `[]`, while a missing `index_create.path` becomes `Path::new("")` and can index the server's current working directory. Invalid JSON messages are also discarded without a JSON-RPC error (`src/mcp/mod.rs:23-25`). Please validate tool names and argument types at the protocol boundary and return an explicit MCP error for invalid params. Required paths, queries, IDs, and ranges should never silently become empty values or current-directory operations.

endergebnis commented

2026-09-04 20:37:39 +02:00

Fixed in commit 4338e28.

Fixed in commit 4338e28.

endergebnis closed this issue

2026-09-04 20:37:39 +02:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: endergebnis/rustytokens#2