mcp sdk doesnt validate tool response schema matches what tool declared
registerd a tool yesterday that declares it returns {status: string, data: object} but at execution the tool actualy returned {success: boolean, result: array}. sdk passes it straight to llm context with zero validaton. so the llm gets a response that doesnt match the schema it was told to expect, tries to parse data.items when the field is actualy called result, whole thing falls apart. spent 2 hours debugging this bc i assumed the sdk was validating response schemas
hit this exact issue yesterday building an mcp wrapper for our data pipeline. tool declares it returns {status: string, count: number} but at runtime we pass back {status: string, rows: array} and the sdk just accepts it with zero validation. spent 4 hours debugging why downstream tools were getting wrong schema - turned out the mcp sdk validates request schema but completely skips response validation. this seems like a massive oversight for anything running in prod where you need schema consistency guarantees across the tool chain. the worst part is it fails silently so you don't even know your response schema is wrong until something downstream breaks in a confusing way.
lol we hit this exact thing building a pentest tool last week! declared tool returns {user: string, role: string} but at runtime we passed back {user: string, permissions: array} and sdk just accepted it with zero validation. spent like 3hrs debugging why downstream stuff was broken before we realized the schema mismatch 😅
imo this is worse than it looks bc if the sdk isn't validating at runtime you can basically change the contract mid-flight and the llm has no idea.... could be wrong but that's a massive footgun for prod deployments