Skip to content

MCP/schema: validation hardening + anchor-form $ref retention (PR #48638 series) #49978

Closed as not planned

Description

@AceRothstein71

Context

Part of the fork hardening series proposed in #48638 (branch session-diff-events). Tracker: #49565.

Problem

MCP tool-schema handling: prototype-pollution-prone maps, missing dialect/URN/anchor validation, duplicate anchors, hostile-shape compilation, dangling $ref pruning that also dropped resolvable anchor-form refs, and a hotfix for invalid recursive-schema placeholders (required:{} / empty combinators) that could brick tool schemas.

Change set (commit list, incl. catalog halves of mixed commits)

Validation

  • Null-prototype maps, dialect/URN/anchor validation, duplicate-anchor removal; anchor-form $ref retained iff resolvable in same resource, dangling pruned; all corpora compile under ajv; catalog suite 32/0; mock capture: 0 required:{}, 0 empty combinators.

Linked: PR #48638 · tracker #49565 · sibling tracking issues listed in a follow-up comment.

Activity

  1. AceRothstein71 commented on Sep 19, 2026

    @AceRothstein71
    Author

    Cross-links: sibling tracking issues #49974 (perf/runtime), #49975 (shell classifier H-L), #49976 (shell classifier M-P), #49977 (instance lifecycle), #49978 (MCP/schema), #49979 (server/SSE + event/db), #49980 (updater tooling). Integration PR: #48638. Original tracker: #49565.

  2. opencodejr commented on Oct 28, 2026

    @opencodejr
    Contributor

    Thanks for writing this up. As it stands, this reads as a plan for a fork's stacked PRs rather than a bug report we can reproduce. In your own words, could you briefly tell us:

    • Which OpenCode version you see this on (opencode --version). Does it happen on current v2, not only on your fork?
    • Which MCP server or tool schema triggers it. A minimal schema that shows the problem would help most (e.g. a resolvable anchor-form $ref that gets dropped, or a recursive schema that ends up with required: {}).
    • What you expected to happen and what happened instead, with the exact error from the provider or OpenCode, and the provider/model if it matters.

    You can reply here with the details or edit the issue. If you edit it, please also leave a comment saying you've updated it, so we know you're done editing.

    These existing issues look related, ordered from most to least likely. Please check whether one of them already covers your problem:

  3. opencodejr commented on Oct 31, 2026

    @opencodejr
    Contributor

    We haven't heard back with the details we asked for: the OpenCode version, a specific MCP server or tool schema that triggers the problem, and the expected versus actual behaviour. Without them we can't reproduce this on v2, so I'm closing it for now.

    If you can share a minimal failing schema and the exact error you see on a current v2 release, please open a new issue using the Bug Report template. You can also check whether #48151, #45823, #47543 or #57832 already covers it. Thanks for looking into MCP schema handling.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions