morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5493] [Bug] MCP input schemas omit host-absolute local path constraints #3345

New issue

Closed

opened 2026-10-31 00:39:21 +00:00 by bsakaguchi · 7 comments

bsakaguchi commented

2026-10-31 00:39:21 +00:00

Owner

Originally created by @morluto on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5493

Before submitting

Searched open and closed issues and relevant PRs.
No credentials or sensitive target data are included.

Area

MCP or agent integration

Observed behavior

The advertised JSON Schema accepts a relative path that the canonical tool validator rejects. On source ee12d517a25d34853d40e31fc039c7d1576c60e1, the production SDK projection for inspect_firmware_regions accepts { "path": "relative.bin" } under Ajv 2020; toolContract("inspect_firmware_regions").inputSchema.safeParse(...) rejects it as requiring an absolute local filesystem path.

Reproduction

Ran the production advertisedInputJsonSchema(toolContract("inspect_firmware_regions")) projection, compiled its complete schema with installed Ajv2020, and compared the same input against canonical Zod validation. Observed once: advertised acceptance true, canonical acceptance false. A separate regression using actual in-memory MCP listTools() schemas also failed on open_binary.path accepting a relative path; handler rejection controls passed.

Expected behavior

The advertised schema should express the already required host-absolute path constraint. The property description explicitly says relative paths are rejected. Encode this at the owning schema so SDK conversion and runtime validation agree; preserve intentionally relative CLI/domain inputs.

Impact and scope

Schema-driven callers can generate schema-valid requests that the handler rejects. Source inspection finds the same .refine(isAbsolute) projection gap in session lifecycle/export/status, managed target, firmware input/output directory, analysis-view Evidence-file, browser executable, and Electron active-scenario path fields. Provider execution was not needed or performed. Native Windows behavior and real-provider runs are unverified.

REA version / runtime / target / interface / stage

Source ee12d517a25d34853d40e31fc039c7d1576c60e1; Node 24.18.0; macOS arm64; inert path strings; MCP; request schema advertisement/validation.

Relevant evidence

The advertised path property contains type: string, minLength: 1, the NUL-exclusion pattern, and the absolute-path description, but no absolute-path constraint. The runtime issue is path must be an absolute local filesystem path.

Owner: firmwareAnalysis.ts, projection: toolSchemaMetadata.ts.

Related #5450 fixed bundle-comparison runtime path acceptance and introduced a schema-visible path helper. #3924 / #4576 concern JavaScript application runtime acceptance; they do not cover this finite schema-projection cohort. No duplicate schema-omission report surfaced in the checked searches.

Originally created by @morluto on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5493 ### Before submitting - [x] Searched open and closed issues and relevant PRs. - [x] No credentials or sensitive target data are included. ### Area MCP or agent integration ### Observed behavior The advertised JSON Schema accepts a relative path that the canonical tool validator rejects. On source `ee12d517a25d34853d40e31fc039c7d1576c60e1`, the production SDK projection for `inspect_firmware_regions` accepts `{ "path": "relative.bin" }` under Ajv 2020; `toolContract("inspect_firmware_regions").inputSchema.safeParse(...)` rejects it as requiring an absolute local filesystem path. ### Reproduction Ran the production `advertisedInputJsonSchema(toolContract("inspect_firmware_regions"))` projection, compiled its complete schema with installed `Ajv2020`, and compared the same input against canonical Zod validation. Observed once: advertised acceptance `true`, canonical acceptance `false`. A separate regression using actual in-memory MCP `listTools()` schemas also failed on `open_binary.path` accepting a relative path; handler rejection controls passed. ### Expected behavior The advertised schema should express the already required host-absolute path constraint. The property description explicitly says relative paths are rejected. Encode this at the owning schema so SDK conversion and runtime validation agree; preserve intentionally relative CLI/domain inputs. ### Impact and scope Schema-driven callers can generate schema-valid requests that the handler rejects. Source inspection finds the same `.refine(isAbsolute)` projection gap in session lifecycle/export/status, managed target, firmware input/output directory, analysis-view Evidence-file, browser executable, and Electron active-scenario path fields. Provider execution was not needed or performed. Native Windows behavior and real-provider runs are unverified. ### REA version / runtime / target / interface / stage Source `ee12d517a25d34853d40e31fc039c7d1576c60e1`; Node 24.18.0; macOS arm64; inert path strings; MCP; request schema advertisement/validation. ### Relevant evidence The advertised `path` property contains `type: string`, `minLength: 1`, the NUL-exclusion pattern, and the absolute-path description, but no absolute-path constraint. The runtime issue is `path must be an absolute local filesystem path`. Owner: [firmwareAnalysis.ts](https://github.com/morluto/rea/blob/ee12d517a25d34853d40e31fc039c7d1576c60e1/src/domain/firmware/firmwareAnalysis.ts), projection: [toolSchemaMetadata.ts](https://github.com/morluto/rea/blob/ee12d517a25d34853d40e31fc039c7d1576c60e1/src/contracts/toolSchemaMetadata.ts). Related #5450 fixed bundle-comparison runtime path acceptance and introduced a schema-visible path helper. #3924 / #4576 concern JavaScript application runtime acceptance; they do not cover this finite schema-projection cohort. No duplicate schema-omission report surfaced in the checked searches.

bsakaguchi

2026-10-31 00:39:21 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-31 00:39:23 +00:00

Author

Owner

@Yashasm18 commented on GitHub (Oct 20, 2026):

I’d like to pick this up. Plan is to switch the MCP-facing .refine(isAbsolute) fields listed above to absoluteLocalPathStringSchema, leaving env and provider config schemas alone, and add a regression test that compiles every advertised input schema with Ajv and checks it rejects relative paths wherever runtime validation does. PR soon.

@Yashasm18 commented on GitHub (Oct 20, 2026): I’d like to pick this up. Plan is to switch the MCP-facing .refine(isAbsolute) fields listed above to absoluteLocalPathStringSchema, leaving env and provider config schemas alone, and add a regression test that compiles every advertised input schema with Ajv and checks it rejects relative paths wherever runtime validation does. PR soon.

bsakaguchi commented

2026-10-31 00:39:23 +00:00

Author

Owner

@NewJon27 commented on GitHub (Oct 20, 2026):

@NewJon27 commented on GitHub (Oct 20, 2026): +1

bsakaguchi commented

2026-10-31 00:39:23 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 20, 2026):

TL;DR: This looks fixed on main for the two tools I checked. Closing is the maintainers' call.

Checked on main b3aadaf47 (Linux, Node 24.18.0). Two tools are covered: inspect_firmware_regions and open_binary. Their advertised MCP schema now has an absolute-path pattern. So Ajv 2020 rejects relative.bin. The tool call rejects it too. This matches the fix in 0e83d92c5.

Not run

The other path fields listed in the issue. Only these two tools were checked.

Thanks, morluto, for the clear report.

Commands

A small Node script started node scripts/rea.mjs mcp over stdio, ran tools/list, and compiled each inputSchema with the repo's Ajv 2020.

inspect_firmware_regions schema accepts {path: "relative.bin"}: false
open_binary schema accepts {path: "relative.bin"}: false
path schema now has allOf: [{pattern: "^[^\\x00]*$"}, {pattern: "^\\/"}]
tools/call inspect_firmware_regions {path: "relative.bin"}: invalid_request, "do not match its advertised input schema"

Script exit 0.

Test setup

Box: Nobara 44 (Fedora 44 base), Linux 7.2.11
CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
RAM: 32 GB DDR4-3600
Node: 24.18.0
Head: b3aadaf47
Other: another job shared the box during the run

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 20, 2026): **TL;DR:** This looks fixed on main for the two tools I checked. Closing is the maintainers' call. Checked on main b3aadaf47 (Linux, Node 24.18.0). Two tools are covered: `inspect_firmware_regions` and `open_binary`. Their advertised MCP schema now has an absolute-path pattern. So Ajv 2020 rejects `relative.bin`. The tool call rejects it too. This matches the fix in 0e83d92c5. ### Not run - The other path fields listed in the issue. Only these two tools were checked. Thanks, morluto, for the clear report. <details> <summary>Commands</summary> A small Node script started `node scripts/rea.mjs mcp` over stdio, ran `tools/list`, and compiled each `inputSchema` with the repo's Ajv 2020. - `inspect_firmware_regions` schema accepts `{path: "relative.bin"}`: false - `open_binary` schema accepts `{path: "relative.bin"}`: false - `path` schema now has `allOf: [{pattern: "^[^\\x00]*$"}, {pattern: "^\\/"}]` - `tools/call inspect_firmware_regions {path: "relative.bin"}`: `invalid_request`, "do not match its advertised input schema" Script exit 0. </details> <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.11 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 24.18.0 - Head: b3aadaf47 - Other: another job shared the box during the run </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-31 00:39:23 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 20, 2026):

Cross-referencing with canonical issue #3924 ([Bug] MCP JavaScript application analysis accepts a relative input_path) and sibling report #5450 ([Bug] MCP bundle comparison accepts relative paths and reads from the server working directory).

Consolidated under Cluster CA (MCP Tool Input Schemas & Host-Absolute Path Constraints) in tracker #4330.

@matbrgz commented on GitHub (Oct 20, 2026): Cross-referencing with canonical issue #3924 (`[Bug] MCP JavaScript application analysis accepts a relative input_path`) and sibling report #5450 (`[Bug] MCP bundle comparison accepts relative paths and reads from the server working directory`). Consolidated under **Cluster CA (MCP Tool Input Schemas & Host-Absolute Path Constraints)** in tracker #4330.

bsakaguchi commented

2026-10-31 00:39:23 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 21, 2026):

Thanks, matbrgz, for linking #3924. I only checked two tools: inspect_firmware_regions and open_binary. I haven't checked the JavaScript app path from #3924.

🤖 Written with Claude Code (Haiku 5.5, verified by Opus 5.5), posted with my OK 🦊

@CassieFox23 commented on GitHub (Oct 21, 2026): Thanks, matbrgz, for linking #3924. I only checked two tools: `inspect_firmware_regions` and `open_binary`. I haven't checked the JavaScript app path from #3924. 🤖 Written with Claude Code (Haiku 5.5, verified by Opus 5.5), posted with my OK 🦊

bsakaguchi commented

2026-10-31 00:39:23 +00:00

Author

Owner

@Shreyash021104 commented on GitHub (Oct 21, 2026):

Extended the earlier two-tool check to the whole catalog on main a5f982d (Linux x64, Node 24.18.0). For every entry in TOOL_CONTRACTS, I compiled advertisedInputJsonSchema(contract) with Ajv 2020 and compared it with the contract's canonical inputSchema.safeParse:

Advertised examples: 212 tools, 231 examples. Each example was accepted by both validators. I replaced every absolute-path string in them with relative.bin, ./x and C:\\x (264 checks).
Path fields that no example sets: every property, including nested ones, whose name matches path, *_path, *_dir, directory, *_file, executable, root, output or destination. When an absolute value was accepted, I tested relative.bin and ./x (150 more checks).

Result: 0 disagreements between the advertised schema and runtime validation in either pass. Every relative value Zod rejects is also rejected by the advertised schema, and nothing is rejected only on the advertised side.

Limits: Linux host only, so the win32 drive-letter pattern branch was not exercised. 14 tools publish no examples and were covered only by the second pass.

@Shreyash021104 commented on GitHub (Oct 21, 2026): Extended the earlier two-tool check to the whole catalog on `main` `a5f982d` (Linux x64, Node 24.18.0). For every entry in `TOOL_CONTRACTS`, I compiled `advertisedInputJsonSchema(contract)` with Ajv 2020 and compared it with the contract's canonical `inputSchema.safeParse`: 1. **Advertised examples:** 212 tools, 231 examples. Each example was accepted by both validators. I replaced every absolute-path string in them with `relative.bin`, `./x` and `C:\\x` (264 checks). 2. **Path fields that no example sets:** every property, including nested ones, whose name matches `path`, `*_path`, `*_dir`, `directory`, `*_file`, `executable`, `root`, `output` or `destination`. When an absolute value was accepted, I tested `relative.bin` and `./x` (150 more checks). Result: **0 disagreements** between the advertised schema and runtime validation in either pass. Every relative value Zod rejects is also rejected by the advertised schema, and nothing is rejected only on the advertised side. Limits: Linux host only, so the `win32` drive-letter pattern branch was not exercised. 14 tools publish no examples and were covered only by the second pass.

bsakaguchi commented

2026-10-31 00:39:23 +00:00

Author

Owner

@morluto commented on GitHub (Oct 21, 2026):

Closing as fixed on main by github.com/morluto/rea@0e83d92c58, retained at 67a6477f01.

The shared absoluteLocalPathStringSchema now advertises its host-absolute constraint as a JSON Schema pattern. MCP schema/runtime agreement regressions cover the owning boundary; the later issue comment records a whole-catalog Linux Ajv/Zod comparison. No fresh Windows regex-branch run was performed.

This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

@morluto commented on GitHub (Oct 21, 2026): Closing as fixed on main by https://github.com/morluto/rea/commit/0e83d92c583ae36afe00b2c23dd2a0f1d025cbca, retained at 67a6477f011ae358fc333e5a6e26c86d932654ed. The shared absoluteLocalPathStringSchema now advertises its host-absolute constraint as a JSON Schema pattern. MCP schema/runtime agreement regressions cover the owning boundary; the later issue comment records a whole-catalog Linux Ajv/Zod comparison. No fresh Windows regex-branch run was performed. This closure follows current-main producer and regression source inspection and the existing issue evidence. Tests and runtime reproductions were not rerun in this audit; no additional platform/provider coverage is implied.

bsakaguchi referenced this issue

2026-10-31 00:40:41 +00:00

[GH-ISSUE #5707] [Bug] Protocol properties are silently omitted from dispatch metadata #3458

bsakaguchi referenced this issue

2026-10-31 01:10:30 +00:00

[PR #3825] [MERGED] fix(native): keep property flags unknown for unfinished quoted types #5926