ruby-sdk/lib/mcp
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Koichi ITO 8173a38280 Validate the src and sizes of an icon against the specification
## Motivation and Context

`MCP::Icon` validated `theme` but accepted anything for `src` and `sizes`: `src:` defaulted to `nil`,
so `MCP::Icon.new.to_h` was `{}`, an icon with no source, and a `sizes` given as a String reached `to_h` unchanged
and serialized as a JSON string where the specification's `Icon` type requires an array of strings.
Nothing on the server side reported either; the server answered every request with 200 and the failure surfaced
in a client, with no reference to the field responsible. The TypeScript SDK types `sizes` as `string[]`
and `src` as required, and the Python SDK's model refuses such an icon at construction, so this SDK was
the one that let it through.

`src` is now a required keyword and must be a non-empty String, `sizes` must be `nil` or an Array of Strings,
and `mime_type` must be `nil` or a String, each refused with `ArgumentError` at construction the way `theme` already was.
The checks stop at the schema's types, as the reference SDKs do: the scheme of a URL and the `WxH` form of a size stay
the caller's to get right. A message names the class of the rejected value, never the value,
since `src` may carry a `data:` URI of any length. Coercing a String into a one-element Array was considered and rejected:
it would hide the caller's mistake that the class exists to surface. The `theme` check let `false` through its truthiness test
and serialized it; it now refuses everything but `nil`, `"light"`, and `"dark"`.

Fixes #562.

## How Has This Been Tested?

New tests in `test/mcp/icon_test.rb`. Against the previous library, an icon without `src` and an icon whose `sizes` is
a String are both constructed and serialized.

## Breaking Changes

`MCP::Icon.new` now raises `ArgumentError` where earlier releases produced an icon the specification's schema rejects:
`src:` is required and must be a non-empty String, so a call without it, or with `nil`, an empty String, or a non-String,
fails; `sizes:` must be `nil` or an Array of Strings, so a String, or an Array holding `nil` or a non-String, fails;
`mime_type:` must be `nil` or a String; `theme:` must be `nil`, `"light"`, or `"dark"`, so `false` fails where it used
to be serialized. Leaving the optional keywords out, or passing `nil` for them, is unchanged.
2026-09-19 17:32:45 +09:00
..
client Merge pull request #560 from koic/let_a_provider_customize_the_oauth_http_client 2026-09-19 08:00:02 +09:00
elicitation Add MCP::Elicitation::EnumSchema builders for SEP-1330 2026-08-05 12:26:13 +09:00
prompt Add _meta field to resource, content, and result classes 2026-04-11 15:08:55 +09:00
resource Add _meta field to resource, content, and result classes 2026-04-11 15:08:55 +09:00
server Serialize subscriptions/listen writes so the graceful result is the final message 2026-08-26 04:44:02 +09:00
tool fix: preserve explicit tool response content 2026-07-23 03:11:48 +08:00
annotations.rb Add audience role validation for MCP::Annotations per MCP specification 2026-06-22 01:13:17 +09:00
apps.rb Add Server-Side MCP Apps Helpers per SEP-1865 2026-07-07 01:16:02 +09:00
cancellation.rb Support notifications/cancelled per MCP specification 2026-05-03 04:02:22 +09:00
cancelled_error.rb Support notifications/cancelled per MCP specification 2026-05-03 04:02:22 +09:00
client.rb Bound automatic pagination in the MCP client 2026-08-14 04:45:32 +09:00
configuration.rb Stop negotiating modern protocol versions through the initialize handshake 2026-08-14 16:08:07 +09:00
content.rb Add _meta field to resource, content, and result classes 2026-04-11 15:08:55 +09:00
elicitation.rb Add MCP::Elicitation::EnumSchema builders for SEP-1330 2026-08-05 12:26:13 +09:00
error_codes.rb Add Stateless Lifecycle Foundations per SEP-2575 2026-07-26 20:03:57 +09:00
icon.rb Validate the src and sizes of an icon against the specification 2026-09-19 17:32:45 +09:00
instrumentation.rb Expose the user-defined server_context in instrumentation data 2026-08-08 08:33:07 +09:00
logging_message_notification.rb logging_message_notification: Remove unused require 2026-02-05 16:05:08 -05:00
methods.rb Serve the subscriptions/listen notification stream per SEP-2575 2026-08-11 00:05:39 +09:00
progress.rb Support POST response SSE streams for server-to-client messages 2026-04-04 19:20:31 +09:00
prompt.rb Return Invalid Params for unknown prompts and missing prompt arguments 2026-08-15 07:55:27 +12:00
protocol_deprecations.rb Stop negotiating modern protocol versions through the initialize handshake 2026-08-14 16:08:07 +09:00
request_envelope.rb Serve the subscriptions/listen notification stream per SEP-2575 2026-08-11 00:05:39 +09:00
resource.rb Support class-based Resource and ResourceTemplate definitions 2026-07-10 22:39:42 +09:00
resource_template.rb Fix RuboCop offenses detected with rubocop-shopify 3.0.0 2026-07-15 01:46:51 +09:00
result_type.rb Recognize multi round-trip input_required results per SEP-2322 2026-06-30 11:34:17 +09:00
server.rb Move the Documentation From README.md to the Documentation Site 2026-08-21 13:24:04 +09:00
server_context.rb Bound server-to-client requests with a timeout 2026-08-13 23:16:59 +09:00
server_session.rb Reject duplicate in-flight JSON-RPC request IDs 2026-08-17 03:47:35 +09:00
string_utils.rb Fix ReDoS vulnerability in StringUtils#underscore 2026-01-09 01:14:52 +09:00
tool.rb Fix a redundant regexp escape in the tool name validation 2026-09-15 12:36:59 +09:00
trace_context.rb Support W3C Trace Context Propagation via _meta per SEP-414 2026-06-12 14:36:24 +09:00
transport.rb Serve the subscriptions/listen notification stream per SEP-2575 2026-08-11 00:05:39 +09:00
version.rb Release 1.5.1 2026-09-09 10:43:15 +09:00