fix: drop the unreachable root rule, correct the always-false suggestion

Copilot review round 2.

- Remove `non-object-root` entirely. It could never fire: the SDK types
  `inputSchema` with `type: literal("object")`, so a tool with any other
  root fails `ListToolsResultSchema` and `salvageListItems` drops it
  before any client sees it. Verified against a live server advertising
  `inputSchema: {type: "array"}` — `listAllTools()` returns []. A rule
  that cannot fire is worse than none, because the docs then claim a
  check the tool does not perform; the condition is already reported
  through the malformed-items surface. Pinned by an integration test so
  a change in that behavior is a signal rather than a silent gap.

- Fix the bare-`false` suggestion. `properties: {a: false}` forbids the
  property; deleting the entry *permits* it with any value under the
  default `additionalProperties`, so the advice inverted the schema it
  replaced. Now recommends `{"not": {}}` and says why deletion differs.

- Exempt `not`-parented schemas from `untyped-schema`, so the `{"not":
  {}}` above does not trip this module's own rule — under negation an
  always-accepting subschema means always-reject, making "accepts any
  value" the exact opposite of what it does. Scoped to that position,
  not inherited by its subtree.

- Say plainly, in the `true` and untyped suggestions, that they narrow
  the schema deliberately rather than implying an equivalent rewrite.
  `true` has no portable object-form equivalent — `{}` is the very shape
  this lint flags.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL9retfvAXRgvi6EWk4SY4
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-25 02:02:26 -04:00
commit cac97c142c

View file

@ -162,15 +162,22 @@ v2/main/
│ │ # constructs that are legal JSON Schema and are
│ │ # refused or mishandled by real MCP clients (a bare
│ │ # `true` in `properties`, an array-form `type`, a
│ │ # remote `$ref`, a schema carrying no validation
│ │ # keyword, a non-object root). Deliberately NOT a
│ │ # validator: a census of 617 public servers found 0
│ │ # that fail the SDK's own parse, so a conformance
│ │ # check reports nothing on real servers. ONE verdict
│ │ # for all three clients — the CLI's `--strict` report
│ │ # (exit 6), the TUI's tool detail pane, the web Tools
│ │ # tab — so they cannot disagree about what is
│ │ # portable; the report TEXT is shared too — #1005)
│ │ # remote `$ref`, a schema carrying no constraining
│ │ # keyword). Deliberately NOT a validator: a census of
│ │ # 617 public servers found 0 that fail the SDK's own
│ │ # parse, so a conformance check reports nothing on
│ │ # real servers. Equally deliberately it has NO
│ │ # "inputSchema must be an object" rule, even though
│ │ # MCP requires that: the SDK types inputSchema with
│ │ # `type: literal("object")`, so such a tool fails
│ │ # ListToolsResultSchema and salvageListItems drops it
│ │ # before any client sees it — a rule that cannot fire
│ │ # is worse than none, because the docs then claim a
│ │ # check the tool does not perform. ONE verdict for all
│ │ # three clients — the CLI's `--strict` report (exit 6),
│ │ # the TUI's tool detail pane, the web Tools tab — so
│ │ # they cannot disagree about what is portable; the
│ │ # report TEXT is shared too — #1005)
│ ├── logging/ # Silent pino logger singleton
│ ├── mcp/ # InspectorClient runtime + state stores
│ │ # (uriTemplate.ts: RFC 6570 parse/classify/expand.