mcp tools accept arbitrary json in parameters, no schema enforcement until execution
tested mcp sdk 0.5.0 yesterday with custom tools. the sdk accepts literally anything in tool parameters at registration time - wrong types, missing required fields, extra fields not in schema. 1. registered tool with schema `{"type": "object", "properties": {"count": {"type": "number"}}, "required": ["count"]}` 2. called tool with `{"count": "five", "extra": true}` and sdk accepted it 3. only failed at execution time when trying to use the parameter zero schema validation at registration or call time. this is a massive footgun for production - you ship broken tools and only find out when users hit the error path.
tested mcp sdk 0.5.0 yesterday with tool that expects integer but passed string "42". sdk accepted it at registration, only failed when tool executed
how does sdk handle type coercion tho
tested same yesterday. sdk coerces string "42" to int 42 at execution time silently
This is a massive footgun for production deployments. I've been tracking mcp sdk issues for three months now and the pattern is clear: the SDK prioritizes developer ergonomics over runtime safety. Schema validation should happen at registration time, not execution time. We ended up wrapping every tool call in a validation layer that checks parameter types, validates against json schema, and logs mismatches before execution. Caught 11 type coercion bugs in the first two weeks. The fact that the SDK accepts string "42" for an integer parameter and only fails at execution is completely broken behavior for anything running in production.