inspector/core/mcp
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall 7bcf155e06 fix: scope the value ceiling to the names a template references
Addresses Copilot's round-19 review on #2035 -- a divergence introduced by
my own round-14 guard rather than by the original code.

The SDK validated a value inside `encodeValue`, i.e. only after looking one
up by a DECLARED name. The restored guard checked the caller's whole map, so
an unrelated entry failed a template that never mentions it. Measured on
9caac43d:

  tryExpandUriTemplate("x://{id}", { id: "7", stale: "a".repeat(1_000_001) })
    =>  error: The value for "stale" exceeds the 1000000-character limit

RFC 6570 ignores an extra variable, so this refused a perfectly valid read.
`valueLengthError` now takes the names to consider and both callers pass the
template's declared set.

Copilot's second half is worth taking on its own: strict expansion parsed
the template THREE times -- inside `templateError`, again for the name list,
again to expand -- and the template is server-controlled and may be 1 MB.
It is now parsed once and reused, with validation split into
`sdkTemplateError` (the constructor's unclosed-brace and length/count
limits) and `partsError` (this module's own grammar), so `templateError` and
strict expansion share both halves rather than duplicating either.

npm run ci passes.

Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-17 01:54:37 -04:00
..
__tests__ fix: salvage a list result's valid entries when one is malformed (#1909) 2026-08-15 16:52:11 -04:00
import chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory (#1900) 2026-08-01 20:13:30 -04:00
node chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory (#1900) 2026-08-01 20:13:30 -04:00
remote Merge pull request #2037 from modelcontextprotocol/v2/feat/1906-auth-token-url-overrides 2026-08-16 22:49:19 -04:00
state fix: salvage a list result's valid entries when one is malformed (#1909) 2026-08-15 16:52:11 -04:00
apps.ts SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') (#1624) 2026-07-15 10:44:24 -04:00
config.ts chore: close quality-gate coverage gaps (#1689) (#1766) 2026-07-24 17:20:12 -04:00
elicitationCreateMessage.ts fix(core): register peer-request handlers before connect (#1797) (#1798) 2026-07-27 11:32:23 -04:00
extensions.ts Extensions: Connection Info both eras + io.modelcontextprotocol/ui advertisement (Phase 3 of #1633) (#1744) 2026-07-23 10:11:36 -04:00
fetchTracking.ts Network: modern Mcp-* headers, new error codes, cancellation-as-abort (#1628) (#1722) 2026-07-18 17:32:05 -04:00
index.ts fix: salvage a list result's valid entries when one is malformed (#1909) 2026-08-15 16:52:11 -04:00
inspectorClient.ts Merge branch 'v2/fix/1919-rfc6570-uri-template-expansion' of https://github.com/modelcontextprotocol/inspector into v2/fix/1919-rfc6570-uri-template-expansion 2026-08-16 23:18:23 -04:00
inspectorClientEventTarget.ts fix: salvage a list result's valid entries when one is malformed (#1909) 2026-08-15 16:52:11 -04:00
inspectorClientProtocol.ts fix: salvage a list result's valid entries when one is malformed (#1909) 2026-08-15 16:52:11 -04:00
listSalvage.ts fix: return the era-parsed tool, and hide aggregate reports in paginated mode (#1909) 2026-08-15 20:08:03 -04:00
messageTrackingTransport.ts Tasks: io.modelcontextprotocol/tasks extension on modern servers (era fork) (#1731) 2026-07-21 19:17:04 -04:00
modernTaskSchemas.ts Tasks: io.modelcontextprotocol/tasks extension on modern servers (era fork) (#1731) 2026-07-21 19:17:04 -04:00
oauthManager.ts fix(auth): never apply endpoint overrides on the enterprise-managed leg 2026-08-16 21:13:51 -04:00
samplingCreateMessage.ts fix(core): register peer-request handlers before connect (#1797) (#1798) 2026-07-27 11:32:23 -04:00
serverList.ts perf(auth): gate the override wrapper on the discovery request, and guard disk values 2026-08-16 22:11:16 -04:00
sessionStorage.ts feat(core): port v1.5 hook layer (#1243) (#1300) 2026-05-13 17:43:07 -04:00
taskNotificationSchemas.ts SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') (#1624) 2026-07-15 10:44:24 -04:00
toolCallCancelledError.ts fix(web): send a cancellation notification when cancelling an ordinary tool call (#1458) (#1463) 2026-06-13 22:23:02 -04:00
toolOutputValidation.ts Refactor / justify codebase-wide 'as unknown as' casts (#1690) (#1756) 2026-07-24 09:34:32 -04:00
typedEventTarget.ts Test/1396 harden managed state connect tests (#1508) 2026-06-24 10:46:09 -04:00
types.ts feat(auth): per-server authorization and token URL overrides 2026-08-16 20:36:24 -04:00
uriTemplate.ts fix: scope the value ceiling to the names a template references 2026-08-17 01:54:37 -04:00
urlElicitation.ts Address @claude review: format core/, typed output-validation error, document progress heuristic 2026-07-15 11:08:54 -04:00