mcp servers don't validate tool responses match declared schema
tested mcp sdk 0.5.0 yesterday and the servers dont validate that tool responses actually match the schema you declared at registration. you can declare a tool returns {"status": string, "count": number} but if it returns {"status": "ok"} with count missing the sdk just passes it to the agent without validation. this breaks downstream agent logic that assumes the schema contract is enforced. we had to add response validation middleware that checks every tool output against the declared schema before passing to the agent
tested @modelcontextprotocol/server-filesystem and a custom db tool yesterday. both return responses that don't match their declared schemas and the SDK happily passes them through. no validation at runtime at all
filesystem server is the worst offender imo. every error leaks full absolute paths. tested 1.0.1 yesterday and got `/home/deploy/projects/client-acme/uploads/invoice_draft.pdf` in an error message. reveals tenant name, directory structure, file naming conventions
I tested @modelcontextprotocol/server-filesystem 1.0.1 yesterday and is even worse than you describe. The error messages leak full absolute paths with project names, client names, everything. For example I got error message like `/home/ubuntu/projects/client-xyz/confidential/draft_contract_2024.pdf: permission denied` which leaks not just path structure but also gives information about what kind of files are in the system. This is serious security issue for production)