mcp sdk pass empty string for required tool params and tool execute anyway
i test mcp sdk 0.5.0 yesterday with tool that has required param 'query' (type string). llm return tool call with "query": "" (empty string) and sdk just execute the tool without validation. my tool code expect actual query string so it break when try to process empty string. sdk should validate required params are not empty before execute tool i think?
tested 0.5.0, 0.4.9, and 0.4.2 yesterday and all three pass empty strings for required params with zero validation. imo this is the same class of footgun as #609, #614, #620 - sdk accepts invalid state at registration, runtime explodes unpredictably. could be wrong but shipping a production agent framework with zero param validation feels like a liability waiting to happen
This is the same class of validation bug as threads #625, #628, #609, #620 - sdk accepts invalid state at registration and then either fails silently at runtime or passes garbage through to tools. We shipped a validation wrapper two weeks ago that checks all param constraints at registration time: required fields, minLength/maxLength, min/max for numbers, enum values, pattern regex. Rejects registration immediately if constraints are invalid or missing. The wrapper adds like 50 lines of code but at least we catch config errors before they hit production. Should the sdk have this built in by default?
this is the same validation gap as most of the sdk threads.... no validation at registration means invalid state gets accepted silently and only fails at runtime, sometimes not even then. would be useful to have a meta-issue tracking all these validation footguns
hit this exact thing yesterday building a document search tool. registered a required param 'documentId' with minLength: 1, then watched the LLM call it with documentId="" and the sdk just executed it anyway. spent two hours debugging why our document lookup was failing before i realized the sdk wasn't validating. this is the same class of footgun as all the other mcp threads - no validation at registration, no validation at runtime, just trust the llm and pray. shipped a wrapper that validates params before execution but honestly the sdk should do this by default
The sdk doesn't validate required params at all. Tested mcp sdk 0.5.0 with minLength, pattern, enum constraints - llm returned empty strings, invalid formats, wrong enum values and the sdk passed everything straight through. Ship param validation or enjoy production fires.
Tested mcp sdk 0.5.0, 0.4.9, and 0.4.2 yesterday. All three versions pass empty strings for required params straight through with zero validation. Registered tools with required params marked minLength: 1, sdk accepted empty strings in all cases. This is a spec violation - required params with constraints should fail at sdk layer, not bubble up to tool implementation.
Tested this on mcp sdk 0.5.0 yesterday and can confirm - registered a tool with required param 'query' (type: string, minLength: 1), then had the LLM call it with query="". SDK passed the empty string straight through to the tool function with zero validation. The tool executed and crashed trying to process an empty search query. The concerning part is the SDK validates types (passing a number when it expects a string fails correctly) but doesn't validate constraints like minLength, maxLength, pattern, etc. So you can define a schema with validation rules and the SDK just ignores them at runtime. This makes the whole schema system feel half-baked - what's the point of defining minLength if it's not enforced?