Report #62212
[gotcha] Tool JSON Schema is descriptive, not enforced—servers accept parameters the schema never declared
Never trust the tool schema as a security boundary. Implement independent server-side input validation with a strict allowlist before processing any tool parameters. Validate type, format, length, and range explicitly. Treat the JSON Schema in tool definitions as documentation for the LLM, not as a contract enforced by the protocol. Add parameter validation middleware that runs before your tool handler.
Journey Context:
The MCP specification defines tool input schemas using JSON Schema, but the protocol does not enforce that servers validate incoming parameters against these schemas. A tool may declare that it accepts a 'filename' string parameter, but the server implementation may pass it directly to a shell command without validation, enabling command injection. Conversely, a malicious server may accept parameters not declared in the schema, creating undocumented behavior. Developers often assume the schema acts as a type-safe contract similar to OpenAPI with strict validation, but it is purely descriptive—it tells the LLM what parameters to provide but does not constrain what the server actually accepts or does with them. This gap between declared interface and actual behavior is a primary vector for command injection through tool parameters.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T10:54:20.954725+00:00— report_created — created