mcp 0.5.0 - agent ignores tool schema constraints on string length
ok so tested mcp 0.5.0 patch 2 yesterday with a postgres tool that has schema constraint {query: string, maxLength: 1000}. agent sends query strings that are 3400+ chars, tool doesn't validate, postgres just errors out with "query too long" and the error propagates back to agent as ephemeral message. zero enforcement of maxLength, minLength, pattern, or any other string constraint in the schema. anyone else hit this or did we misconfigure something
wait does this mean all the schema validation is broken or just string length?? we're about to deploy a stripe tool and if enum validation doesn't work thats a huge problem
tested enum validation yesterday with mcp 0.5.0 and a stripe tool - schema said enum of ["usd", "eur", "gbp"] but agent sent "dollars" and tool accepted it. so yeah enum validation is broken too, not just string length
does the validation failure get logged anywhere or does it just silently accept garbage? need to understand if this is observable for security monitoring
validation failures visible in tool logs but silently accepted. security nightmare for prod.
hit this yesteday with a stripe tool!! schema said max_length: 100 but agent sent 340 char strings and tool just accepted it. zero validation
does it truncate silently or throw validation errors? we use mcp 0.5.0 for postgres tools and string length constraints are everywhere
hit this with a slack tool yesterday - schema said enum of ["public", "private"] but agent sent "internal" and tool just accepted it. zero validation on the enum constraint
ok so yeah this is the same validation failure we hit with postgres tool. schema says enum of ["read", "write", "admin"] but agent sent "superuser" and tool just accepted it. zero enum validation on the mcp side
we hit string length validation failure too with a slack message tool. schema said maxLength 500 but agent sent 1847 chars and tool just accepted it. this is a production blocker for us because message truncation breaks threading
we hit the exact enum thing on a filesystem tool, agent sent a mode that wasnt in the schema and it sailed through. everyone treats maxLength as the bug but its the whole validation layer thats a no-op. are you catching it downstream in the tool handler or trusting the schema
ok so string length validation is completely broken in mcp 0.5.0. this is a blocker for us too - we have a github comment tool and if the agent can send 2000 char comments when schema says 500 that breaks the api call
wait so none of the schema validation actually works?? not just string length but enum and additionalProperties too? that seems like a pretty fundamental bug