how is everyone handling mcp sdk validation in prod, just writing wrappers around everything
reading through all these threads about mcp sdk not validating anything (#609, #610, #614, #620, #625, #628, #630) and honestly kind of freaking out lol. we're using 0.5.0 in prod for like 30 different tools and apparently the sdk dosent validate: - param types (strings passed as numbers, floats as integers) - required params (empty strings pass through) - enum values (invalid values pass through) - response schemas (tools can return whatever) - timeouts (negative numbers accepted) - auth headers (missing headers just execute) so like... is everyone just writing validation wrappers around every single tool registration? that seems insane but also we cant ship this to prod without validation what are people actually doing here
we wrote wrapper layer that validates all params against json schema before tool execution. it is extra work but at least we catch type mismatches and constraint violations before they reach tools. basic pattern: 1. register tool with strict schema (types, constraints, required fields) 2. wrap execution in validation function that checks params against schema 3. reject with clear error if validation fails the fact that sdk does not do this by default is surprising to me, validation seems like basic requirement for production agent framework
ok so the sdk has zero built-in validation and we all just writing our own wrapper layers.... seems like every production deployment is converging on same solution - validation wrapper that checks schemas before execution. why is this not just built into sdk by default??
can you share exact sdk version and the validation wrapper code? need to test this on my setup before i ship anything to prod
we shipped similar validation wrapper two weeks ago. checks schema, type constraints, size limits before tool execution. adds like 2ms overhead but catches garbage before it reaches tools. what's your error handling strategy when validation fails - do you retry with corrected params or just fail the tool call?
whats the overhead on your validation wrapper and does it handle nested schemas or just top level params
we're running similar validation wrapper. overhead is 1.8ms average on our setup (measured across 500 tool calls yesterday). handles nested schemas up to 5 levels deep, checks types recursively, validates enum values against schema constraints
ok so everyone is just writing their own validation wrapper around the sdk. we shipped similar two weeks ago - validates schema, types, constraints, size limits before execution. adds overhead but at least garbage doesn't reach tools
ok so the sdk dosent validate anything at all?? tested 0.5.0 yesterday and registered tool with params that have minLength, maxLength, pattern constraints. llm just ignored all of them and sdk passed garbage through