Problem
AbilityRegistry::addAbility() accepts any ResourceTemplateInterface without
validation. The resources/templates/list handler converts all registered
templates via ListResourceTemplatesResult::fromResponseData(), and the SDK's
ResourceTemplate::validate() throws an InvalidArgumentException when name
or uriTemplate is empty.
Because the exception is thrown while building the complete result, one
misbehaving plugin template turns every resources/templates/list request into
a JSON-RPC -32603 internal error — all valid templates from other plugins
become undiscoverable as well.
Steps to reproduce
- Register a template whose
getName() or getUriTemplate() returns ''
(e.g. via a plugin subscribing to InitialiseMCPServerEvent).
- Call
resources/templates/list.
- The whole request fails with
-32603 instead of listing the remaining
valid templates.
Proposal
Preferred: validate abilities up front in AbilityRegistry::addAbility() and
reject invalid ones there (fail fast, at registration time, attributable to the
offending plugin — ideally with a log entry naming it).
Alternative/minimal: catch the per-entry InvalidArgumentException in the
handler, skip the broken template and log a warning, so one bad plugin cannot
take down discovery for everyone.
Notes
The same "one bad ability poisons the shared list" pattern applies to
tools/list and resources/list since they now also build typed results —
worth fixing consistently, which speaks for the registration-time validation.
Problem
AbilityRegistry::addAbility()accepts anyResourceTemplateInterfacewithoutvalidation. The
resources/templates/listhandler converts all registeredtemplates via
ListResourceTemplatesResult::fromResponseData(), and the SDK'sResourceTemplate::validate()throws anInvalidArgumentExceptionwhennameor
uriTemplateis empty.Because the exception is thrown while building the complete result, one
misbehaving plugin template turns every
resources/templates/listrequest intoa JSON-RPC
-32603internal error — all valid templates from other pluginsbecome undiscoverable as well.
Steps to reproduce
getName()orgetUriTemplate()returns''(e.g. via a plugin subscribing to
InitialiseMCPServerEvent).resources/templates/list.-32603instead of listing the remainingvalid templates.
Proposal
Preferred: validate abilities up front in
AbilityRegistry::addAbility()andreject invalid ones there (fail fast, at registration time, attributable to the
offending plugin — ideally with a log entry naming it).
Alternative/minimal: catch the per-entry
InvalidArgumentExceptionin thehandler, skip the broken template and log a warning, so one bad plugin cannot
take down discovery for everyone.
Notes
The same "one bad ability poisons the shared list" pattern applies to
tools/listandresources/listsince they now also build typed results —worth fixing consistently, which speaks for the registration-time validation.