stacklok / toolhive / 30272583615

70%

Build Type

push

github

Committed by web-flow

Commit Message

Reject backend tools with invalid x-mcp-header (#6013)

* Reject backend tools with invalid x-mcp-header

SEP-2243 lets an MCP server designate individual tool parameters for
mirroring into HTTP request headers, via an x-mcp-header annotation in
the tool's inputSchema. The extension constrains the annotation's value,
and requires a Streamable HTTP client to reject any tool definition that
violates those constraints. vMCP is its backends' client and had no such
validation: nothing in the repo matched x-mcp-header at all.

Left unchecked, an invalid annotation is not contained to the tool that
carries it. vMCP republishes aggregated backend schemas to its own
downstream clients, so a conformant downstream client would reject the
entire aggregated tools/list, taking every other backend's tools down
with it. A CRLF in an annotation is worse than cosmetic once mirroring
lands, since the value becomes an outgoing header name.

Validate at newCapabilityListFromMCP -- the single ingestion seam the
Legacy and Modern paths share -- and drop only the offending tool, which
is the narrower failure. The annotation's vocabulary and constraint
checks live in one place, pkg/mcp, so the ingestion check and the
call-time header derivation that follows cannot drift in their reading of
the spec.

The traversal is depth-capped: annotations are legal at any nesting depth
and a backend can advertise any tool list it likes, so an unbounded
recursive walk would be a stack-exhaustion vector.

Refs #6002

* Mirror x-mcp-header params on the Modern egress (#6014)

SEP-2243 lets a server designate tool parameters, via x-mcp-header in its
inputSchema, whose values it also requires as Mcp-Param-{name} HTTP
headers -- and a server that designated a parameter and does not receive
its header rejects the call with -32020. vMCP never sent them, so any
Modern backend annotating a tool parameter was uncallable through vMCP,
surfacing only as a generic backend failure.

Deriving the headers... (continued)

Coverage Stats

279 of 301 new or added lines in 8 files covered. (92.69%)

8 existing lines in 2 files now uncovered.

80564 of 115653 relevant lines covered (69.66%)

84.17 hits per line