[GH-ISSUE #1454] [Bug] MCP doctor reports healthy for a schema-invalid probe reply #495

New issue

Closed

opened 2026-10-15 18:25:34 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:25:34 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 10, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1454

The production MCP doctor can report healthy: true for a binary_session reply that violates the output schema advertised by the same server.

Independent reproduction on frozen current main 33b9b31a, pinned Node 24.18.0 / SDK 2.3.1: run the real compiled production server and doctor client, and inject one additional property (schema_violation_control: true) into the structured reply at the stdio producer boundary. Keep the tool inventory (139), prompts (6), server identity, product/catalog identity and text/structured parity intact. Main reports every health check successful. The advertised output schema rejects that extra property.

With the discovered, named binary_session definition supplied to the SDK call, the identical malformed reply is rejected with Structured content does not match the tool's output schema: data must NOT have additional properties. Valid production doctor reports remain byte-identical. A transport-boundary replay regression should retain this negative case and a valid control.

This was discovered while investigating startup costs. The actual doctor compiler-entry probe observes zero output-validator preparation attempts on the original concurrent discovery/call path and one on the named-definition candidate. Interleaved cold CLI samples have medians 4,111.9 ms on main and 4,209.0 ms on the candidate; they do not establish a performance improvement. The SDK's internal reason for the default path's missing validation remains unverified.

Expected fix: validate the probe against the definition actually discovered by name, retain full inventory and identity observations when the request fails, report the request/schema failure clearly, and preserve the absolute deadline and owned-child cleanup. No model-token, native-provider or GUI authority claim is implied by this protocol-level fault injection.

Searched related issues/PRs; no exact open fix found. Refs #1065, #723 and related schema-cache work #1433.

Originally created by @N0zoM1z0 on GitHub (Oct 10, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1454 The production MCP doctor can report `healthy: true` for a `binary_session` reply that violates the output schema advertised by the same server. Independent reproduction on frozen current main `33b9b31a`, pinned Node 24.18.0 / SDK 2.3.1: run the real compiled production server and doctor client, and inject one additional property (`schema_violation_control: true`) into the structured reply at the stdio producer boundary. Keep the tool inventory (139), prompts (6), server identity, product/catalog identity and text/structured parity intact. Main reports every health check successful. The advertised output schema rejects that extra property. With the discovered, named `binary_session` definition supplied to the SDK call, the identical malformed reply is rejected with `Structured content does not match the tool's output schema: data must NOT have additional properties`. Valid production doctor reports remain byte-identical. A transport-boundary replay regression should retain this negative case and a valid control. This was discovered while investigating startup costs. The actual doctor compiler-entry probe observes zero output-validator preparation attempts on the original concurrent discovery/call path and one on the named-definition candidate. Interleaved cold CLI samples have medians 4,111.9 ms on main and 4,209.0 ms on the candidate; they do not establish a performance improvement. The SDK's internal reason for the default path's missing validation remains unverified. Expected fix: validate the probe against the definition actually discovered by name, retain full inventory and identity observations when the request fails, report the request/schema failure clearly, and preserve the absolute deadline and owned-child cleanup. No model-token, native-provider or GUI authority claim is implied by this protocol-level fault injection. Searched related issues/PRs; no exact open fix found. Refs #1065, #723 and related schema-cache work #1433.

bsakaguchi

2026-10-15 18:25:34 +00:00