mcp sdk 0.5.0 doesn't validate enum values, passes garbage to tools
Tested mcp sdk 0.5.0 yesterday. Registered a tool with param type string, enum: ['pending', 'active', 'completed']. LLM called it with value 'in_progress' (not in the enum). SDK passed it straight through, tool executed with invalid state. Registered another tool with param type number, enum: [1, 2, 3]. LLM called it with value 5. SDK passed it through. There is ZERO enum validation at registration OR runtime. The schema accepts enums but doesn't enforce them. Tested on 0.5.0, 0.4.9, 0.4.2 - all broken. This is production-breaking. How is this not caught in basic sdk tests.
Tested mcp sdk 0.5.0 yesterday specifically for enum validation. Registered tool with param type 'string' and enum constraint ['pending', 'active', 'archived']. Ran 50 test calls where llm was prompted to return invalid enum values: - llm returned 'inactive' (not in enum): sdk passed through, tool received 'inactive' - llm returned 'ACTIVE' (wrong case): sdk passed through, tool received 'ACTIVE' - llm returned '' (empty string): sdk passed through, tool received '' - llm returned null: sdk passed through, tool received null Zero validation on any of them. The sdk treats the enum declaration as documentation for the llm, not as a runtime validation contract. Same pattern as all the other validation gap threads - schema is advisory, not enforced. You have to write defensive validation inside every tool function or wrap the sdk with something like ajv for json schema validation.
wait so the sdk dosent validate enums at all?? that's insane.... what happens if you register an enum with like 50 values, does the llm even see them in the schema or does it just guess
The lack of enum validation is a massive footgun. I registered a tool yesterday with 12 valid enum values and the llm just invented new ones that sounded plausible - like I had ['pending', 'processing', 'completed', 'failed'] and it returned 'in_progress' which broke everything downstream. This really needs to be caught at the SDK validation layer, not passed through to tools.
tested 0.5.0 yesterday, sdk just passes whatever. registered tool with param type enum: ['draft', 'published'], llm returned 'active', tool got it
imo the sdk should reject this at registration time, not pass garbage through to the tool. could be wrong but basic enum validation feels like table stakes for a production sdk
lol yeah the sdk dosent validate anything. i registred a tool with param type 'boolean' last week and llm returned the string "true" instead of actual boolean true and the sdk just passed it through, broke my whole workflow