modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: address Copilot review on the schema portability lint

Browse source 
- Scope `non-object-root` to `inputSchema`. The pinned SDK types
  `inputSchema` with `type: literal("object")` but `outputSchema` as a
  bare `looseObject`, so a `{"type":"string"}` output is conforming; the
  rule was claiming a requirement MCP does not make, at error severity.

- Decide `untyped-schema` from an allowlist of constraining keywords
  rather than a denylist of annotations. JSON Schema ignores keywords it
  does not recognize, so `{"vendorHint": true}` accepts every value and a
  denylist passed it as constrained. `$defs`-only schemas now flag too.

- Walk `dependentSchemas` and draft-07 `dependencies`, with a test
  pinning that the property-name-array form is not a schema position.

- Suggest `anyOf` branches for an array-form `type`, never "drop it from
  `required`" — accepting `null` and permitting absence are independent
  contracts, so the old suggestion silently changed the schema's meaning.

- Reject `--strict` alongside `--app-info`. That path returns NDJSON from
  `runMethod` and never reaches the lint, so the flag was a no-op gate
  that could never fail.

- Colour the web sidebar flag from the `--inspector-*` severity tokens,
  matching the detail panel and avoiding the default yellow that failed
  the a11y check.

- Add a live integration test for `rawToolSchemas`. It caught that an
  `outputSchema` override on a preset returning no structured content
  makes every call to that tool fail client-side validation — the
  showcase config did exactly that, so the flagged tool could not be
  run. Moved the bare `true` onto `get_temp`, documented the caveat, and
  pinned both halves.

- Drop the double cast from the lint test fixture.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL9retfvAXRgvi6EWk4SY4
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-25 01:41:12 -04:00
commit c389565783
2 changed files with 566 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

132
clients/web/src/test/core/schemaLint.test.ts
View file

@ -107,8 +107,11 @@ describe("lintToolSchemas — clean schemas", () => {
});
it("reports nothing when a tool declares neither schema", () => {
const bare = { name: "t" } as unknown as Tool;
expect(lintToolSchemas(bare)).toEqual([]);
expect(
lintToolSchemas(
tool({ inputSchema: undefined, outputSchema: undefined }),
),
).toEqual([]);
});
});
@ -174,6 +177,16 @@ describe("lintToolSchemas — boolean-schema", () => {
{ type: "object", propertyNames: true, properties: {} },
"inputSchema.propertyNames",
],
[
"a dependentSchemas entry",
{ type: "object", dependentSchemas: { a: true }, properties: {} },
"inputSchema.dependentSchemas.a",
],
[
"a draft-07 schema-valued dependencies entry",
{ type: "object", dependencies: { a: true }, properties: {} },
"inputSchema.dependencies.a",
],
["the schema root", true, "inputSchema"],
])("flags a bare boolean under %s", (_label, inputSchema, path) => {
const findings = lintToolSchemas(tool({ inputSchema }));
@ -192,7 +205,7 @@ describe("lintToolSchemas — boolean-schema", () => {
});
describe("lintToolSchemas — type-union", () => {
it("flags the nullable array form and suggests the single type", () => {
it("flags the nullable array form and suggests anyOf branches", () => {
const findings = lintToolSchemas(
tool({
inputSchema: {
@ -203,10 +216,27 @@ describe("lintToolSchemas — type-union", () => {
);
expect(rules(findings)).toEqual(["type-union"]);
expect(findings[0]!.severity).toBe("warning");
expect(findings[0]!.suggestion).toContain('"type": "boolean"');
expect(findings[0]!.suggestion).toContain(
'{"anyOf": [{"type": "null"}, {"type": "boolean"}]}',
);
});
it("suggests anyOf when more than one non-null member survives", () => {
it("never suggests un-requiring the property as the equivalent fix", () => {
// Absent and `null` are different contracts, so "drop it from `required`"
// is not a portable spelling of the same schema — it is a change to it.
const findings = lintToolSchemas(
tool({
inputSchema: {
type: "object",
properties: { a: { type: ["null", "string"] } },
},
}),
);
expect(findings[0]!.suggestion).toContain("absent is not the same as");
expect(findings[0]!.suggestion).not.toMatch(/leave the property out/);
});
it("keeps every member in the suggestion when none is null", () => {
const findings = lintToolSchemas(
tool({
inputSchema: {
@ -215,10 +245,12 @@ describe("lintToolSchemas — type-union", () => {
},
}),
);
expect(findings[0]!.suggestion).toContain("anyOf");
expect(findings[0]!.suggestion).toContain(
'{"anyOf": [{"type": "string"}, {"type": "number"}]}',
);
});
it("ignores non-string members when picking the suggestion", () => {
it("drops non-string members from the suggested branches", () => {
const findings = lintToolSchemas(
tool({
inputSchema: {
@ -227,7 +259,19 @@ describe("lintToolSchemas — type-union", () => {
},
}),
);
expect(findings[0]!.suggestion).toContain('"type": "string"');
expect(findings[0]!.suggestion).toContain(
'{"anyOf": [{"type": "string"}]}',
);
});
it("falls back to a placeholder when no member is a string", () => {
const findings = lintToolSchemas(
tool({
inputSchema: { type: "object", properties: { a: { type: [3] } } },
}),
);
expect(rules(findings)).toEqual(["type-union"]);
expect(findings[0]!.suggestion).toContain("anyOf");
});
it("does not raise non-object-root for an array-typed root", () => {
@ -258,6 +302,51 @@ describe("lintToolSchemas — untyped-schema", () => {
expect(paths(findings)).toEqual(["inputSchema.properties.a"]);
});
it("flags a schema whose only keyword is unrecognized", () => {
// JSON Schema ignores keywords it does not know, so `{"vendorHint": true}`
// accepts every value. A denylist of known annotations would let it pass
// simply because the keyword is unfamiliar — hence the allowlist.
const findings = lintToolSchemas(
tool({
inputSchema: {
type: "object",
properties: { a: { vendorHint: true, "x-internal": 1 } },
},
}),
);
expect(rules(findings)).toEqual(["untyped-schema"]);
});
it("flags a definition-only schema", () => {
// `$defs` holds subschemas for *other* schemas to reference; it constrains
// the current instance not at all.
const findings = lintToolSchemas(
tool({
inputSchema: {
type: "object",
properties: { a: { $defs: { x: { type: "string" } } } },
},
}),
);
expect(rules(findings)).toEqual(["untyped-schema"]);
expect(paths(findings)).toEqual(["inputSchema.properties.a"]);
});
it.each([
["pattern", { pattern: "^a" }],
["format", { format: "email" }],
["required", { required: ["a"] }],
["minimum", { minimum: 0 }],
["contains", { contains: { type: "string" } }],
["propertyNames", { propertyNames: { pattern: "^a" } }],
["dependentRequired", { dependentRequired: { a: ["b"] } }],
])("does not flag a schema constrained only by %s", (_label, sub) => {
const findings = lintToolSchemas(
tool({ inputSchema: { type: "object", properties: { a: sub } } }),
);
expect(findings).toEqual([]);
});
it("flags an entirely empty root schema", () => {
const findings = lintToolSchemas(tool({ inputSchema: {} }));
expect(rules(findings)).toEqual(["untyped-schema"]);
@ -277,12 +366,14 @@ describe("lintToolSchemas — non-object-root", () => {
expect(findings[0]!.issue).toContain("inputSchema");
});
it("names outputSchema when that is the offending root", () => {
const findings = lintToolSchemas(
tool({ outputSchema: { type: "string" } }),
it("does NOT flag a non-object outputSchema root", () => {
// The SDK's `Tool` schema types `inputSchema` with `type: literal("object")`
// but `outputSchema` as a plain loose object with no `type` constraint, so
// a string-typed output is conforming. Flagging it would report an error
// MCP does not require and would fail `--strict` on a valid server.
expect(lintToolSchemas(tool({ outputSchema: { type: "string" } }))).toEqual(
[],
);
expect(rules(findings)).toEqual(["non-object-root"]);
expect(findings[0]!.issue).toContain("outputSchema");
});
it("does not flag a nested non-object schema", () => {
@ -332,6 +423,21 @@ describe("lintToolSchemas — walk robustness", () => {
expect(findings).toEqual([]);
});
it("skips the draft-07 property-name-array form of dependencies", () => {
// `dependencies: {a: ["b"]}` is a required-property list, not a schema
// position, so the walk must not descend into it.
const findings = lintToolSchemas(
tool({
inputSchema: {
type: "object",
properties: { a: { type: "string" }, b: { type: "string" } },
dependencies: { a: ["b"] },
},
}),
);
expect(findings).toEqual([]);
});
it("skips keyword values of the wrong shape", () => {
const findings = lintToolSchemas(
tool({

244
clients/web/src/test/integration/mcp/raw-tool-schemas.test.ts Normal file
View file

@ -0,0 +1,244 @@
import { describe, it, expect, afterEach } from "vitest";
import { InspectorClient } from "@inspector/core/mcp/inspectorClient.js";
import { createTransportNode } from "@inspector/core/mcp/node/transport.js";
import { lintTools } from "@inspector/core/json/schemaLint.js";
import {
createTestServerHttp,
type TestServerHttp,
createTestServerInfo,
createEchoTool,
createGetWeatherTool,
createGetTempTool,
} from "@modelcontextprotocol/inspector-test-server";
import type { ServerConfig } from "@modelcontextprotocol/inspector-test-server";
/**
* Live coverage of `ServerConfig.rawToolSchemas` (#1005) — the only way this
* repo can advertise a tool schema containing a bare `true`, an array-form
* `type`, or a remote `$ref`, since every preset builds its schema from Zod
* and Zod cannot emit any of them.
*
* The lint itself is unit-tested against hand-built `Tool` objects, which
* bypasses this path entirely: handler installation, config resolution, and
* the interaction with pagination and duplication could all regress while
* those stayed green. This file drives the real server over a real transport
* and asserts on what actually reaches the wire.
*/
describe("rawToolSchemas override (#1005)", () => {
let client: InspectorClient | null = null;
let server: TestServerHttp | null = null;
afterEach(async () => {
if (client) {
try {
await client.disconnect();
} catch {
// ignore
}
client = null;
}
if (server) {
try {
await server.stop();
} catch {
// ignore
}
server = null;
}
});
async function start(config: Partial<ServerConfig>): Promise<TestServerHttp> {
const started = createTestServerHttp({
serverInfo: createTestServerInfo("raw-tool-schemas-test", "1.0.0"),
tools: [createEchoTool(), createGetWeatherTool()],
...config,
});
await started.start();
server = started;
return started;
}
async function connect(url: string): Promise<InspectorClient> {
const connected = new InspectorClient(
{ type: "streamable-http", url },
{ environment: { transport: createTransportNode } },
);
await connected.connect();
client = connected;
return connected;
}
it("advertises the raw document, and the lint finds it end to end", async () => {
const started = await start({
rawToolSchemas: {
echo: {
inputSchema: {
type: "object",
properties: {
message: { type: "string" },
show_ids: { type: ["null", "boolean"] },
},
},
outputSchema: {
type: "object",
properties: { data: true },
},
},
},
});
const connected = await connect(started.url);
const { tools } = await connected.listAllTools();
const echo = tools.find((t) => t.name === "echo");
// The bare `true` survives the wire — a Zod-built schema could not
// produce it, so its presence here proves the override is what is served.
expect(echo?.outputSchema).toEqual({
type: "object",
properties: { data: true },
});
expect(
(echo?.inputSchema as { properties?: Record<string, unknown> }).properties
?.show_ids,
).toEqual({ type: ["null", "boolean"] });
const results = lintTools(tools);
expect(results.map((r) => r.toolName)).toEqual(["echo"]);
expect(results[0]?.findings.map((f) => f.rule).sort()).toEqual([
"boolean-schema",
"type-union",
]);
});
it("leaves an unnamed tool's real schema alone", async () => {
const started = await start({
rawToolSchemas: { echo: { outputSchema: { type: "object" } } },
});
const connected = await connect(started.url);
const { tools } = await connected.listAllTools();
const weather = tools.find((t) => t.name === "get_weather");
// get_weather keeps the Zod-derived schema, which is portable.
expect(weather?.inputSchema).toMatchObject({ type: "object" });
expect(lintTools(tools)).toEqual([]);
});
it("replaces only the schema named, leaving the sibling untouched", async () => {
const started = await start({
rawToolSchemas: {
echo: { outputSchema: { type: "object", properties: { data: true } } },
},
});
const connected = await connect(started.url);
const { tools } = await connected.listAllTools();
const echo = tools.find((t) => t.name === "echo");
// Only `outputSchema` was overridden, so the Zod-built input survives.
expect(echo?.inputSchema).toMatchObject({ type: "object" });
expect(
(echo?.inputSchema as { properties?: Record<string, unknown> })
.properties,
).toHaveProperty("message");
});
it("ignores a name that is not registered", async () => {
const started = await start({
rawToolSchemas: { not_a_tool: { inputSchema: true } },
});
const connected = await connect(started.url);
const { tools } = await connected.listAllTools();
expect(tools.map((t) => t.name)).toEqual(["echo", "get_weather"]);
expect(lintTools(tools)).toEqual([]);
});
it("still calls the tool when only the input schema was overridden", async () => {
const started = await start({
rawToolSchemas: {
echo: {
inputSchema: {
type: "object",
properties: { message: { type: "string" }, opts: {} },
},
},
},
});
const connected = await connect(started.url);
// The handler and its real Zod validation are untouched by the override —
// the fixture would be misleading if the tool it flags could not be run.
const { tools } = await connected.listAllTools();
const echo = tools.find((t) => t.name === "echo")!;
const result = await connected.callTool(echo, { message: "hi" });
expect(JSON.stringify(result)).toContain("hi");
});
it("makes the call fail when an outputSchema is put on a tool with no structured content", async () => {
// Pinning the sharp edge documented on `ServerConfig.rawToolSchemas`: a
// conforming client validates results against the advertised output
// schema, so an override on a preset that returns none breaks every call.
// This is why the showcase config puts its bare-`true` outputSchema on
// `get_temp` (which does return structured content) rather than on `echo`.
const started = await start({
rawToolSchemas: {
echo: { outputSchema: { type: "object", properties: { data: true } } },
},
});
const connected = await connect(started.url);
const { tools } = await connected.listAllTools();
const echo = tools.find((t) => t.name === "echo")!;
await expect(connected.callTool(echo, { message: "hi" })).rejects.toThrow(
/returned no structured content/,
);
});
it("keeps a structured-content tool callable under an outputSchema override", async () => {
// The shape the showcase config actually ships: the bare `true` rides a
// tool that returns structured content, and the override stays permissive
// enough (no `required`) that the real payload still validates — so the
// flagged tool is still runnable from the Tools tab.
const started = await start({
tools: [createGetTempTool(), createEchoTool()],
rawToolSchemas: {
get_temp: {
outputSchema: {
type: "object",
properties: { data: true, city: { type: "string" } },
},
},
},
});
const connected = await connect(started.url);
const { tools } = await connected.listAllTools();
const getTemp = tools.find((t) => t.name === "get_temp")!;
expect(lintTools(tools).map((r) => r.toolName)).toEqual(["get_temp"]);
const result = await connected.callTool(getTemp, {
city: "Oslo",
units: "C",
});
expect(JSON.stringify(result)).toContain("Oslo");
});
it("applies before duplication, so both copies carry the raw schema", async () => {
const started = await start({
duplicateToolNames: ["echo"],
rawToolSchemas: {
echo: { outputSchema: { type: "object", properties: { data: true } } },
},
});
const connected = await connect(started.url);
const { tools } = await connected.listAllTools();
const echoes = tools.filter((t) => t.name === "echo");
expect(echoes).toHaveLength(2);
for (const e of echoes) {
expect(e.outputSchema).toEqual({
type: "object",
properties: { data: true },
});
}
});
});