modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
go-sdk/mcp
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
n0liu 7743b71b1c
 mcp: fix ListTools panic and null normalization on malformed tools (#1120) 
Fixes #1119.

`ClientSession.ListTools` post-processes the server response through
`filterValidTools`, which has two problems on malformed input:

1. **Nil-pointer panic on `"tools":[null]`.** A `nil` `*Tool` element
reaches `validateParamHeaderAnnotations(tool)`, which dereferences
`tool.InputSchema`, crashing the client on untrusted server input.
2. **`"tools":null` is normalized into a non-nil empty slice.**
`make([]*Tool, 0, len(tools))` is always non-nil, so a nil `Tools` slice
from a malformed response is silently laundered into valid-looking data.

Reproduction:

```go
filterValidTools(nil, []*Tool{nil}) // panics: nil pointer dereference
filterValidTools(nil, nil)          // returns non-nil slice (len 0), want nil
```

Fix (`mcp/streamable_headers.go`):

- Skip (log and exclude) nil tool elements instead of dereferencing
them, so a malformed `"tools":[null]` can no longer crash the client.
This is consistent with the function’s existing contract of excluding
invalid tools.
- Return early with `nil` for a nil input slice so a `"tools":null`
response is preserved as nil rather than normalized into an empty slice.

Added `TestFilterValidToolsNilHandling` covering both defects plus the
mixed valid/nil case. `go test ./mcp/` passes; `gofmt` and `go vet` are
clean.

Note on scope: this keeps the change minimal and within
`filterValidTools`’s existing signature. If maintainers would rather
surface a hard protocol error for a malformed `"tools":null` /
`"tools":[null]` response at the `ListTools` level (rather than
tolerating and filtering it), I’m happy to follow up with that larger
change.
2026-07-30 10:06:14 +02:00
..
testdata mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
cache.go mcp: do not enforce TTL on cached tool (#1053) 2026-07-07 13:43:10 +02:00
capabilities_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
client.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
client_example_test.go mcp: block server initiated requests (SEP-2322) (#1057) 2026-07-08 15:17:41 +02:00
client_list_test.go mcp: allow any value for schemas (#517) 2025-09-26 11:55:54 -04:00
client_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
cmd.go mcp: speed up TestCommandTransportDuration 2025-09-12 12:00:29 -04:00
cmd_export_test.go mcp: speed up TestCommandTransportDuration 2025-09-12 12:00:29 -04:00
cmd_test.go all: modernize code (#868) 2026-03-31 10:58:02 +02:00
conformance_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
content.go mcp: Deprecate roots, sampling and logging (SEP-2577) (#1017) 2026-06-23 11:11:08 +02:00
content_nil_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
content_test.go mcp: switch icon theme to named string type (#733) 2025-12-19 16:44:10 -05:00
elicitation_test.go mcp: block server initiated requests (SEP-2322) (#1057) 2026-07-08 15:17:41 +02:00
error_test.go mcp: align resource not found error code with sep-2164 (#931) 2026-05-05 16:20:02 +02:00
event.go mcp: avoid double-copy of payload in writeEvent (#1106) 2026-07-24 10:07:06 +02:00
event_test.go mcp: handle empty chunks in MemoryEventStore (#862) 2026-03-27 16:58:03 +01:00
features.go mcp: minor cleanup of some TODOs (#332) 2025-08-20 12:55:19 -04:00
features_test.go mcp: change tool handler design (#325) 2025-08-20 19:36:34 -04:00
logging.go mcp: Deprecate roots, sampling and logging (SEP-2577) (#1017) 2026-06-23 11:11:08 +02:00
mcp.go mcp: fix inaccurate package doc (#534) 2025-09-26 14:16:10 -04:00
mcp_example_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
mcp_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
mrtr.go mcp: bump protocol version from 2026-06-30 to 2026-07-28 (#1015) 2026-06-22 09:53:04 +02:00
mrtr_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
prompt.go mcp: align PromptHandler args with other handlers (#348) 2025-08-22 10:44:05 -04:00
protocol.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
protocol_test.go mcp: include resultType on new-protocol responses (#1060) 2026-07-13 11:51:19 +00:00
requests.go mcp: Implement subscriptions/listen rpc (SEP-2575) (#1007) 2026-06-22 18:57:36 +02:00
resource.go mcp: align resource not found error code with sep-2164 (#931) 2026-05-05 16:20:02 +02:00
resource_test.go mcp/Resource: Refactor URI Template Matching with uritemplate Library (#100) 2025-07-08 15:52:54 -04:00
sampling_test.go mcp: block server initiated requests (SEP-2322) (#1057) 2026-07-08 15:17:41 +02:00
schema_cache.go perf: add schema caching to avoid repeated reflection (#685) 2026-01-20 20:16:46 -05:00
schema_cache_test.go all: modernize code (#868) 2026-03-31 10:58:02 +02:00
server.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
server_example_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
server_test.go mcp: include resultType on new-protocol responses (#1060) 2026-07-13 11:51:19 +00:00
session.go mcp: support stateless streamable sessions (#277) 2025-08-11 16:43:46 -04:00
shared.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
shared_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
sse.go mcp: add MCPGPDEBUG for opt-in Content-Type check (#1012) 2026-06-17 11:41:35 +02:00
sse_example_test.go SSE: Add support for SSE handler options (#508) 2025-09-19 13:01:57 -04:00
sse_test.go mcp: remove default cross origin protection (#906) 2026-04-24 11:35:22 +02:00
streamable.go mcp: fix potential nil-pointer dereference on message send (#1115) 2026-07-27 17:20:53 +02:00
streamable_bench_test.go all: modernize code (#868) 2026-03-31 10:58:02 +02:00
streamable_client.go mcp: do not call DELETE for sessionless & doc adjustments (#960) 2026-05-15 21:47:34 +02:00
streamable_client_test.go mcp: fix potential nil-pointer dereference on message send (#1115) 2026-07-27 17:20:53 +02:00
streamable_example_test.go mcp: add 2026-07-28 to the supported protocol versions (#1020) 2026-06-24 12:02:56 +02:00
streamable_headers.go mcp: fix ListTools panic and null normalization on malformed tools (#1120) 2026-07-30 10:06:14 +02:00
streamable_headers_test.go mcp: fix ListTools panic and null normalization on malformed tools (#1120) 2026-07-30 10:06:14 +02:00
streamable_server.go mcp: simplify stream state management in streamable transport 2025-12-10 13:28:25 -05:00
streamable_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
tool.go mcp: tool.InputSchema and tool.OutputSchema validation (SEP-2106) (#1009) 2026-06-16 13:55:47 +02:00
tool_example_test.go mcp: allow any value for schemas (#517) 2025-09-26 11:55:54 -04:00
tool_test.go mcp: tool.InputSchema and tool.OutputSchema validation (SEP-2106) (#1009) 2026-06-16 13:55:47 +02:00
transport.go mcp: Implement subscriptions/listen rpc (SEP-2575) (#1007) 2026-06-22 18:57:36 +02:00
transport_example_test.go mcp: update return meta in DiscoverResult (SEP-2575) (#1097) 2026-07-16 16:10:12 +02:00
transport_test.go fix(jsonrpc2): decode requests when method key is present (#1000) 2026-06-16 09:57:18 +02:00
util.go all: use case-sensitive JSON unmarshaling (#807) 2026-02-18 16:38:36 +01:00