Fix: Disallow $ref in tool input schemas

This commit is contained in:
Tyler Rowsell 2025-06-09 13:32:20 -04:00
commit 8dee60cfc2
No known key found for this signature in database
GPG key ID: 0B7F267BCD08BF19

View file

@ -37,6 +37,7 @@ module MCP
private
def validate_schema!
check_for_refs!
schema = to_h
schema_reader = JSON::Schema::Reader.new(
accept_uri: false,
@ -48,6 +49,19 @@ module MCP
raise ArgumentError, "Invalid JSON Schema: #{errors.join(", ")}"
end
end
def check_for_refs!(obj = properties)
case obj
when Hash
if obj.key?("$ref") || obj.key?(:$ref)
raise ArgumentError, "Invalid JSON Schema: $ref is not allowed in tool input schemas"
end
obj.each_value { |value| check_for_refs!(value) }
when Array
obj.each { |item| check_for_refs!(item) }
end
end
end
end
end