Report #55953
[gotcha] Agent client freezes or crashes when validating arguments for a newly connected MCP tool.
Run JSON Schema validation for MCP tool arguments in a sandboxed worker with a timeout, or reject schemas containing complex/nested regex patterns.
Journey Context:
MCP uses JSON Schema to define tool inputs, including \`pattern\` properties for regex validation. A malicious MCP server can provide a schema with an evil regex \(ReDoS\). When the agent client validates the LLM's generated arguments against this schema before sending the request, the client process hangs or crashes due to catastrophic backtracking. Developers rarely expect a schema validation step to be an attack vector.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T00:24:35.255147+00:00— report_created — created