Skip to content

Validate Required Params for resources/read - #9

Draft
yuki3738 wants to merge 1 commit into
mainfrom
validate_required_resources_read_params
Draft

yuki3738 wants to merge 1 commit into
mainfrom
validate_required_resources_read_params

Conversation

@yuki3738

@yuki3738 yuki3738 commented Sep 6, 2026

Copy link
Copy Markdown
Owner

Motivation and Context

The MCP schema requires a string uri in resources/read params. The server dispatched the request without checking it, and the outcome depended on how the read was served. A custom resources_read_handler received the params unchanged, so a handler that echoes params[:uri] answered with a success result carrying null. The class-based router raised a TypeError on a non-string uri once a resource template was registered, which surfaced as -32603 Internal error. Both now return -32602 Invalid params, matching the check modelcontextprotocol#451 added for initialize and resources/subscribe. The check runs before dispatch, so it covers custom handlers and the class-based router alike.

This change validates that uri is present and is a string. It does not validate URI syntax: that needs a separate change, weighing what to reject against the risk to existing clients.

Before, with a resources_read_handler that echoes params[:uri]:

params: {}          -> {"result":{"contents":[{"uri":null,...}]}}
params: {"uri":123} -> {"result":{"contents":[{"uri":123,...}]}}
no params           -> {"error":{"code":-32603,"message":"Internal error",...}}

Before, with a class-based resource template registered:

params: {"uri":123} -> {"error":{"code":-32603,"message":"Internal error",...}}

After, for every case above:

-> {"error":{"code":-32602,"message":"Invalid params","data":"Missing or invalid uri"}}

How Has This Been Tested?

Added tests for params absent, params that are not an object, uri absent, and a non-string uri. The non-string case is covered with a class-based resource and with a class-based template registered, since only the template path reached the TypeError. A further test asserts that a custom resources_read_handler never runs when uri is missing. Also verified by hand over Server#handle_json that each of these requests now answers -32602. rake test passes (1784 runs, 0 failures).

Breaking Changes

A resources/read request without uri, or with a non-string uri, now receives -32602 Invalid params. Earlier releases passed such a request to the handler, which could answer it successfully, or raised -32603 Internal error from the class-based router. Such requests violate the MCP schema, and a valid string uri is unaffected.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

@yuki3738
yuki3738 force-pushed the validate_required_resources_read_params branch from 894448f to 8ab6a6f Compare September 12, 2026 08:23
## Motivation and Context

The MCP schema requires a string `uri` in `resources/read` params. The server dispatched the request
without checking it, and the outcome depended on how the read was served. A custom
`resources_read_handler` received the params unchanged, so a handler that echoes `params[:uri]` answered
with a success result carrying `null`. The class-based router raised a `TypeError` on a non-string `uri`
once a resource template was registered, which surfaced as `-32603` Internal error. Both now return
`-32602` Invalid params, matching the check modelcontextprotocol#451 added for `initialize` and `resources/subscribe`.
The check runs before dispatch, so it covers custom handlers and the class-based router alike.

This change validates that `uri` is present and is a string. It does not validate URI syntax: that needs
a separate change, weighing what to reject against the risk to existing clients.

## How Has This Been Tested?

Added tests for `params` absent, `params` that are not an object, `uri` absent, and a non-string `uri`.
The non-string case is covered with a class-based resource and with a class-based template registered,
since only the template path reached the `TypeError`. A further test asserts that a custom
`resources_read_handler` never runs when `uri` is missing. Also verified by hand over
`Server#handle_json` that each of these requests now answers `-32602`.

## Breaking Changes

A `resources/read` request without `uri`, or with a non-string `uri`, now receives `-32602` Invalid
params. Earlier releases passed such a request to the handler, which could answer it successfully, or
raised `-32603` Internal error from the class-based router. Such requests violate the MCP schema, and a
valid string `uri` is unaffected.
@yuki3738
yuki3738 force-pushed the validate_required_resources_read_params branch from 8ab6a6f to 8d64b59 Compare September 12, 2026 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant