Skip to content

A single invalid resource template breaks the whole resources/templates/list response #33

Description

@ramalama

Problem

AbilityRegistry::addAbility() accepts any ResourceTemplateInterface without
validation. The resources/templates/list handler converts all registered
templates via ListResourceTemplatesResult::fromResponseData(), and the SDK's
ResourceTemplate::validate() throws an InvalidArgumentException when name
or uriTemplate is empty.

Because the exception is thrown while building the complete result, one
misbehaving plugin template turns every resources/templates/list request into
a JSON-RPC -32603 internal error — all valid templates from other plugins
become undiscoverable as well.

Steps to reproduce

  1. Register a template whose getName() or getUriTemplate() returns ''
    (e.g. via a plugin subscribing to InitialiseMCPServerEvent).
  2. Call resources/templates/list.
  3. The whole request fails with -32603 instead of listing the remaining
    valid templates.

Proposal

Preferred: validate abilities up front in AbilityRegistry::addAbility() and
reject invalid ones there (fail fast, at registration time, attributable to the
offending plugin — ideally with a log entry naming it).

Alternative/minimal: catch the per-entry InvalidArgumentException in the
handler, skip the broken template and log a warning, so one bad plugin cannot
take down discovery for everyone.

Notes

The same "one bad ability poisons the shared list" pattern applies to
tools/list and resources/list since they now also build typed results —
worth fixing consistently, which speaks for the registration-time validation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions