morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3408] Array and object tool parameters rejected when REA runs as a local MCP server in Claude Desktop (Windows) #1271

New issue

Open

opened 2026-10-16 21:03:36 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:03:36 +00:00

Owner

Originally created by @rarekolesar-cyber on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3408

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

MCP or agent integration

Observed behavior

Tools whose parameters are plain strings work (list_browser_targets, inspect_web_page with defaults). Any call that passes an array or object parameter is rejected before reaching REA:

inspect_web_page with allowed_origins: ["https://example.com"] returns Input validation error: Invalid arguments for tool inspect_web_page: Invalid input.
capture_browser_scenario returns browser: Invalid input: expected object, received string, start_url: Invalid input: expected object, received string, actions: Invalid input: expected array, received string, capture: Invalid input: expected object, received string.

Because of this, origin filters, browser scenarios and other structured inputs are unusable from Claude Desktop, so inspect_web_page only returns first-party data.

Reproduction

Install npm install -g rea-agents and run rea setup, selecting Claude Desktop.
Register REA in the Claude Desktop config (command: node, args: [rea.mjs, "mcp"]) and restart Claude Desktop. REA tools are listed and string-only tools work.
Start Chrome with --remote-debugging-port=9222 and open any page.
From Claude Desktop, call inspect_web_page with cdp_endpoint, target_id and allowed_origins set to a JSON array.
Observe the validation error. Happens every time for every array or object parameter.

Expected behavior

Array and object parameters should reach REA with their JSON types, as they do for string parameters, so allowed_origins, browser, actions, capture and similar inputs can be used from Claude Desktop.

Impact and scope

Every tool that needs a list or structured object is unusable from Claude Desktop on Windows. String-only tools keep working, so the failure is partial and easy to misread as missing data rather than a rejected call (inspect_web_page silently scopes to the first-party origin). Reproduced on every attempt.

REA version

6.4.0

Runtime and platform

Node 24 (Claude Desktop 2.37337.1, Electron 44); Windows 11 x64

Target and artifact context

Chrome 155 page over CDP; not applicable to a binary target

Interface

MCP

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Command or MCP request actually run:
inspect_web_page {"cdp_endpoint": "http://127.0.0.1:9222", "target_id": "", "allowed_origins": ["https://example.com", "https://www.googletagmanager.com"]}

Relevant result, error, or artifact:
Input validation error: Invalid arguments for tool inspect_web_page: Invalid input

capture_browser_scenario {"browser": {...}, "start_url": {...}, "actions": [...], "capture": {...}}
Input validation error: Invalid arguments for tool capture_browser_scenario: browser: Invalid input: expected object, received string, start_url: Invalid input: expected object, received string, actions: Invalid input: expected array, received string, capture: Invalid input: expected object, received string

The same inspect_web_page call without allowed_origins succeeds and reports completeness "policy_filtered" with third-party scripts and resources excluded as "disallowed_origin".

Typed outcome or recovery expected

The client should pass arrays and objects as JSON values. If a client cannot resolve $ref schemas, REA could advertise inlined schemas so the parameters still validate.

Analysis or suspected cause

Every failing parameter is declared through shared $ref / $defs definitions (visible as "$ref": "#/$defs/__schemaN" in the advertised tool schemas), while plain string parameters work. The client appears not to resolve these references and serializes the values as strings. Inlining these schemas would likely fix it. Possibly related to #2832, another client-compatibility issue with the advertised schemas.

Additional context

Separate setup note: rea setup reported success for Claude Desktop, but the server only appeared after adding it manually to the config file opened via Settings, Developer, Edit Config. The Microsoft Store build of Claude Desktop reads its config from a different location than the one setup writes to.

Originally created by @rarekolesar-cyber on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3408 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area MCP or agent integration ### Observed behavior Tools whose parameters are plain strings work (list_browser_targets, inspect_web_page with defaults). Any call that passes an array or object parameter is rejected before reaching REA: - `inspect_web_page` with `allowed_origins: ["https://example.com"]` returns `Input validation error: Invalid arguments for tool inspect_web_page: Invalid input`. - `capture_browser_scenario` returns `browser: Invalid input: expected object, received string, start_url: Invalid input: expected object, received string, actions: Invalid input: expected array, received string, capture: Invalid input: expected object, received string`. Because of this, origin filters, browser scenarios and other structured inputs are unusable from Claude Desktop, so inspect_web_page only returns first-party data. ### Reproduction 1. Install `npm install -g rea-agents` and run `rea setup`, selecting Claude Desktop. 2. Register REA in the Claude Desktop config (`command`: node, `args`: [rea.mjs, "mcp"]) and restart Claude Desktop. REA tools are listed and string-only tools work. 3. Start Chrome with `--remote-debugging-port=9222` and open any page. 4. From Claude Desktop, call `inspect_web_page` with `cdp_endpoint`, `target_id` and `allowed_origins` set to a JSON array. 5. Observe the validation error. Happens every time for every array or object parameter. ### Expected behavior Array and object parameters should reach REA with their JSON types, as they do for string parameters, so allowed_origins, browser, actions, capture and similar inputs can be used from Claude Desktop. ### Impact and scope Every tool that needs a list or structured object is unusable from Claude Desktop on Windows. String-only tools keep working, so the failure is partial and easy to misread as missing data rather than a rejected call (inspect_web_page silently scopes to the first-party origin). Reproduced on every attempt. ### REA version 6.4.0 ### Runtime and platform Node 24 (Claude Desktop 2.37337.1, Electron 44); Windows 11 x64 ### Target and artifact context Chrome 155 page over CDP; not applicable to a binary target ### Interface MCP ### Earliest failure stage Request parsing or validation ### Relevant output or evidence Command or MCP request actually run: inspect_web_page {"cdp_endpoint": "http://127.0.0.1:9222", "target_id": "<page target>", "allowed_origins": ["https://example.com", "https://www.googletagmanager.com"]} Relevant result, error, or artifact: Input validation error: Invalid arguments for tool inspect_web_page: Invalid input capture_browser_scenario {"browser": {...}, "start_url": {...}, "actions": [...], "capture": {...}} Input validation error: Invalid arguments for tool capture_browser_scenario: browser: Invalid input: expected object, received string, start_url: Invalid input: expected object, received string, actions: Invalid input: expected array, received string, capture: Invalid input: expected object, received string The same inspect_web_page call without allowed_origins succeeds and reports completeness "policy_filtered" with third-party scripts and resources excluded as "disallowed_origin". ### Typed outcome or recovery expected The client should pass arrays and objects as JSON values. If a client cannot resolve $ref schemas, REA could advertise inlined schemas so the parameters still validate. ### Analysis or suspected cause Every failing parameter is declared through shared $ref / $defs definitions (visible as "$ref": "#/$defs/__schemaN" in the advertised tool schemas), while plain string parameters work. The client appears not to resolve these references and serializes the values as strings. Inlining these schemas would likely fix it. Possibly related to #2832, another client-compatibility issue with the advertised schemas. ### Additional context Separate setup note: rea setup reported success for Claude Desktop, but the server only appeared after adding it manually to the config file opened via Settings, Developer, Edit Config. The Microsoft Store build of Claude Desktop reads its config from a different location than the one setup writes to.

bsakaguchi added the

triage

bug

labels

2026-10-16 21:03:36 +00:00

bsakaguchi referenced this issue

2026-10-17 21:09:50 +00:00

[PR #1271] [MERGED] fix(process): await cleanup on CLI and MCP cancellation #2754

bsakaguchi commented

2026-10-31 00:30:23 +00:00

Author

Owner

@leemie8848 commented on GitHub (Oct 23, 2026):

Still reproduces on the current npm release (rea-agents@6.7.0, Linux, Node 24), so this isn't Windows-specific. It's the server-side validation that rejects JSON text. I tested it with a raw stdio MCP client, without Claude Desktop:

inspect_web_page with allowed_origins: ["https://example.com"] passes validation (it then fails only with provider_unavailable because there was no CDP endpoint, which is expected)
the same call with allowed_origins: "[\"https://example.com\"]" fails with Input validation error: Invalid arguments for tool inspect_web_page: allowed_origins: Invalid input: expected array, received string

So any client that serializes structured arguments as strings will hit this until #3525 (the JSON-text recovery) lands in a release. #3486 / #4147 change what gets advertised, but they don't help once the client has already sent a string.

@leemie8848 commented on GitHub (Oct 23, 2026): Still reproduces on the current npm release (`rea-agents@6.7.0`, Linux, Node 24), so this isn't Windows-specific. It's the server-side validation that rejects JSON text. I tested it with a raw stdio MCP client, without Claude Desktop: - `inspect_web_page` with `allowed_origins: ["https://example.com"]` passes validation (it then fails only with `provider_unavailable` because there was no CDP endpoint, which is expected) - the same call with `allowed_origins: "[\"https://example.com\"]"` fails with `Input validation error: Invalid arguments for tool inspect_web_page: allowed_origins: Invalid input: expected array, received string` So any client that serializes structured arguments as strings will hit this until #3525 (the JSON-text recovery) lands in a release. #3486 / #4147 change what gets advertised, but they don't help once the client has already sent a string.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1271

No description provided.

Rows
Columns