bug(mcp): Zod .passthrough() on source config allows unvalidated fields to reach provider #273

Summary

In packages/mcp/src/index.ts, the Zod schema for source configuration objects uses .passthrough(), which lets arbitrary unrecognised fields bypass validation and reach the context provider without inspection.

Root cause

// packages/mcp/src/index.ts ~line 68
z.object({ id: z.string(), ... }).passthrough()

.passthrough() means any extra keys an MCP client sends are forwarded directly to options.provider.getContext(args).

Impact

Depending on provider implementation, unexpected fields could:

• Override internal provider state
• Trigger injection-style behaviour if the provider uses field values in dynamic queries or prompts
• Expose data the provider would otherwise not include

Fix

Remove .passthrough() and use .strict() instead, or explicitly enumerate all accepted fields. Unknown keys should be rejected at the schema boundary:

z.object({ id: z.string(), ... }).strict()