@runpod/mcp-server 4.10.1 → 4.11.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @runpod/mcp-server
 
+## 4.11.0
+
+### Minor Changes
+
+- 00dc801: Check every tool call against the tool's full input schema: types, enums, ranges and nested fields, not just top-level required and unknown arguments. By default this runs in shadow mode and only logs a `schema_violation` line (schema keywords and locations, never argument values), so no call that works today is blocked. Set `MCP_SCHEMA_VALIDATION=enforce` to reject an invalid call before any request is sent, with an `invalid_arguments` error naming each field's path, the problem, and the allowed values. With enforcement on, a shape error is no longer hidden behind an authentication failure. A `null` sent for an optional argument at any depth counts as omitted.
+- 7c58f5b: Add `exec-pod`: run one command in a running Pod's container and get stdout, stderr and the exit code back, with no SSH setup (REST v2 `POST /v2/pods/{id}/exec`). The tool description covers background jobs for long downloads, the 25-second limit, and the 404/409 answers while a new Pod starts. Resync the v2 spec from production; the new signup routes are excluded from the tool surface.
+
+### Patch Changes
+
+- e9f7fe2: The hosted 404 loop breaker now counts and blocks only `get-pod`, which caused 519 of the 559 blocks in the last month. 404s from other tools, such as `exec-pod` retried while a new Pod is still being created, no longer count toward a block.
+
 ## 4.10.1
 
 ### Patch Changes

package/dist/{chunk-FQJFKWUV.mjs → chunk-24UOECYY.mjs}

@@ -33,6 +33,8 @@ var DIRECTORY_TOOLS = {
   "deploy-hub-repo": IN,
   "detach-cost-center-resource": IN,
   "endpoint-health": IN,
+  // env can carry tokens (HF_TOKEN for a model download), so the directory omits it.
+  "exec-pod": { include: true, omitInputs: ["body.env"] },
   "get-capacity": IN,
   "get-cluster": IN,
   "get-cost-center": IN,
@@ -152,6 +154,21 @@ function directoryOmittedInputs(name) {
   const decision = DIRECTORY_TOOLS[name];
   return decision?.include ? decision.omitInputs ?? [] : [];
 }
+function omittedInputsIn(omit, args) {
+  return omit.filter((key) => {
+    const [parent, child] = key.split(".");
+    if (child === void 0) return parent in args;
+    let value = args[parent];
+    if (typeof value === "string") {
+      try {
+        value = JSON.parse(value);
+      } catch {
+        return false;
+      }
+    }
+    return !!value && typeof value === "object" && child in value;
+  });
+}
 function profileForPath(pathname) {
   return pathname.replace(/\/+$/, "") === DIRECTORY_PATH ? "directory" : "default";
 }
@@ -161,6 +178,7 @@ export {
   DIRECTORY_TOOLS,
   directoryIncludes,
   directoryOmittedInputs,
+  omittedInputsIn,
   profileForPath
 };
-//# sourceMappingURL=chunk-FQJFKWUV.mjs.map
+//# sourceMappingURL=chunk-24UOECYY.mjs.map

package/dist/chunk-24UOECYY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/specgen/profile.ts"],"sourcesContent":["// Which tool surface a connection gets. `default` is the full surface every\n// client has always had. `directory` is what app directories (Anthropic's\n// connector directory, OpenAI's plugin directory) list: their policies forbid\n// tool descriptions that instruct the model, steer it toward other tools or\n// external instructions, or collect conversation data beyond the tool's job.\n// The directory profile is served only at DIRECTORY_PATH; nothing about the\n// default surface changes.\nexport type ServerProfile = 'default' | 'directory';\n\nexport const DIRECTORY_PATH = '/directory';\n\n/** Whether a tool is listed on the directory profile. Every tool the server\n *  can serve must have an entry, so a new tool (a spec regeneration, a new\n *  curated tool) fails tests/specgen-directory.test.ts until someone decides.\n *  The rules for deciding are in specgen/DIRECTORY_POLICY.md.\n *  `omitInputs` hides arguments the directory must not ask for (a credential,\n *  for example); a call that passes one is refused. A key is a top-level\n *  argument (`s3Config`) or one level inside an object argument (`body.env`). */\nexport type DirectoryDecision =\n  | { include: true; omitInputs?: readonly string[] }\n  | { include: false; reason: string };\n\nconst IN = { include: true } as const;\nconst CREDENTIAL_MANAGEMENT =\n  'Manages stored credentials; OpenAI restricts plugins that handle access credentials, so the directory leaves the whole credential family out.';\nconst CREDENTIAL_INPUT =\n  'Takes a secret or password as input; directories forbid collecting credentials.';\nconst ALP =\n  'Collects conversation-derived data beyond the task; the directory profile never serves it.';\n\nexport const DIRECTORY_TOOLS: Readonly<Record<string, DirectoryDecision>> = {\n  'add-organization-group-member': IN,\n  'attach-cost-center-resource': IN,\n  'cancel-job': IN,\n  'create-cluster': IN,\n  'create-cost-center': IN,\n  'create-delegation': IN,\n  'create-endpoint': IN,\n  'create-global-volume': IN,\n  'create-network-volume': IN,\n  'create-organization-group': IN,\n  'create-organization-invite': IN,\n  'create-organization-role': IN,\n  'create-pod': IN,\n  'create-template': IN,\n  'delete-cluster': IN,\n  'delete-cost-center': IN,\n  'delete-endpoint': IN,\n  'delete-global-volume': IN,\n  'delete-network-volume': IN,\n  'delete-organization-group': IN,\n  'delete-organization-invite': IN,\n  'delete-organization-role': IN,\n  'delete-organization-user': IN,\n  'delete-pod': IN,\n  'delete-template': IN,\n  'deploy-hub-repo': IN,\n  'detach-cost-center-resource': IN,\n  'endpoint-health': IN,\n  // env can carry tokens (HF_TOKEN for a model download), so the directory omits it.\n  'exec-pod': { include: true, omitInputs: ['body.env'] },\n  'get-capacity': IN,\n  'get-cluster': IN,\n  'get-cost-center': IN,\n  'get-cpu-type': IN,\n  'get-data-center': IN,\n  'get-endpoint': IN,\n  'get-endpoint-build': IN,\n  'get-endpoint-cold-start-metrics': IN,\n  'get-endpoint-request-metrics': IN,\n  'get-endpoint-worker-metrics': IN,\n  'get-global-volume': IN,\n  'get-gpu-type': IN,\n  'get-job-status': IN,\n  'get-network-volume': IN,\n  'get-organization': IN,\n  'get-organization-group': IN,\n  'get-organization-invite': IN,\n  'get-organization-role': IN,\n  'get-organization-role-capabilities': IN,\n  'get-organization-user': IN,\n  'get-pod': IN,\n  'get-ssh-keys': IN,\n  'get-template': IN,\n  'list-audit-logs': IN,\n  'list-billing': IN,\n  'list-cluster-billing': IN,\n  'list-cluster-pods': IN,\n  'list-clusters': IN,\n  'list-cost-center-resources': IN,\n  'list-cost-centers': IN,\n  'list-cpu-types': IN,\n  'list-data-centers': IN,\n  'list-delegations': IN,\n  'list-endpoint-billing': IN,\n  'list-endpoint-builds': IN,\n  'list-endpoint-releases': IN,\n  'list-endpoint-workers': IN,\n  'list-endpoints': IN,\n  'list-global-volumes': IN,\n  'list-gpu-types': IN,\n  'list-hub-repos': IN,\n  'list-network-volume-billing': IN,\n  'list-network-volumes': IN,\n  'list-organization-group-members': IN,\n  'list-organization-groups': IN,\n  'list-organization-invites': IN,\n  'list-organization-roles': IN,\n  'list-organization-users': IN,\n  'list-pod-billing': IN,\n  'list-pods': IN,\n  'list-public-endpoints': IN,\n  'list-public-templates': IN,\n  'list-serverless-billing': IN,\n  'list-templates': IN,\n  'lookup-concept': IN,\n  'purge-endpoint-queue': IN,\n  'remove-organization-group-member': IN,\n  'retry-job': IN,\n  'revoke-delegation': IN,\n  'search-concepts': IN,\n  'search-docs': IN,\n  'set-endpoint-gpus': IN,\n  'stream-job': IN,\n  'stream-pod-logs': IN,\n  'stream-worker-logs': IN,\n  'update-cluster': IN,\n  'update-cost-center': IN,\n  'update-endpoint': IN,\n  'update-global-volume': IN,\n  'update-network-volume': IN,\n  'update-organization-group': IN,\n  'update-organization-role': IN,\n  'update-organization-user': IN,\n  'update-pod': IN,\n  'update-ssh-keys': IN,\n  'update-template': IN,\n  'run-endpoint': { include: true, omitInputs: ['s3Config'] },\n  'runsync-endpoint': { include: true, omitInputs: ['s3Config'] },\n  'pod-action': {\n    include: false,\n    reason:\n      'Takes the transition as an argument; OpenAI asks for one tool per operation, so the directory serves start-pod, stop-pod and restart-pod (terminate is delete-pod).',\n  },\n  'start-pod': IN,\n  'stop-pod': IN,\n  'restart-pod': IN,\n  'list-guides': {\n    include: false,\n    reason: 'Serves playbooks that instruct the model how to behave.',\n  },\n  'read-guide': {\n    include: false,\n    reason: 'Serves playbooks that instruct the model how to behave.',\n  },\n  'describe-tool': {\n    include: false,\n    reason:\n      'Fetches schemas the directory already lists in full; directories reject schema fetching.',\n  },\n  'create-secret': { include: false, reason: CREDENTIAL_INPUT },\n  'get-secret': { include: false, reason: CREDENTIAL_MANAGEMENT },\n  'list-secrets': { include: false, reason: CREDENTIAL_MANAGEMENT },\n  'delete-secret': { include: false, reason: CREDENTIAL_MANAGEMENT },\n  'get-registry': { include: false, reason: CREDENTIAL_MANAGEMENT },\n  'list-registries': { include: false, reason: CREDENTIAL_MANAGEMENT },\n  'delete-registry': { include: false, reason: CREDENTIAL_MANAGEMENT },\n  'update-secret': { include: false, reason: CREDENTIAL_INPUT },\n  'create-registry': { include: false, reason: CREDENTIAL_INPUT },\n  report_feedback: { include: false, reason: ALP },\n  report_how_user_found_runpod: { include: false, reason: ALP },\n  save_to_journal: { include: false, reason: ALP },\n  read_journal: { include: false, reason: ALP },\n  ask_question: { include: false, reason: ALP },\n};\n\n/** Served on the directory profile only with an explicit include. */\nexport function directoryIncludes(name: string): boolean {\n  return DIRECTORY_TOOLS[name]?.include === true;\n}\n\nexport function directoryOmittedInputs(name: string): readonly string[] {\n  const decision = DIRECTORY_TOOLS[name];\n  return decision?.include ? (decision.omitInputs ?? []) : [];\n}\n\n/** The omitted inputs (see DirectoryDecision) that a call's arguments set. */\nexport function omittedInputsIn(\n  omit: readonly string[],\n  args: Record<string, unknown>\n): string[] {\n  return omit.filter((key) => {\n    const [parent, child] = key.split('.');\n    if (child === undefined) return parent in args;\n    let value = args[parent];\n    // Dispatch parses a body sent as a JSON string, so check its parsed form;\n    // a string that is not JSON fails in dispatch instead.\n    if (typeof value === 'string') {\n      try {\n        value = JSON.parse(value);\n      } catch {\n        return false;\n      }\n    }\n    return !!value && typeof value === 'object' && child in value;\n  });\n}\n\nexport function profileForPath(pathname: string): ServerProfile {\n  return pathname.replace(/\\/+$/, '') === DIRECTORY_PATH\n    ? 'directory'\n    : 'default';\n}\n"],"mappings":";AASO,IAAM,iBAAiB;AAa9B,IAAM,KAAK,EAAE,SAAS,KAAK;AAC3B,IAAM,wBACJ;AACF,IAAM,mBACJ;AACF,IAAM,MACJ;AAEK,IAAM,kBAA+D;AAAA,EAC1E,iCAAiC;AAAA,EACjC,+BAA+B;AAAA,EAC/B,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,wBAAwB;AAAA,EACxB,yBAAyB;AAAA,EACzB,6BAA6B;AAAA,EAC7B,8BAA8B;AAAA,EAC9B,4BAA4B;AAAA,EAC5B,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,wBAAwB;AAAA,EACxB,yBAAyB;AAAA,EACzB,6BAA6B;AAAA,EAC7B,8BAA8B;AAAA,EAC9B,4BAA4B;AAAA,EAC5B,4BAA4B;AAAA,EAC5B,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,+BAA+B;AAAA,EAC/B,mBAAmB;AAAA;AAAA,EAEnB,YAAY,EAAE,SAAS,MAAM,YAAY,CAAC,UAAU,EAAE;AAAA,EACtD,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,mCAAmC;AAAA,EACnC,gCAAgC;AAAA,EAChC,+BAA+B;AAAA,EAC/B,qBAAqB;AAAA,EACrB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,yBAAyB;AAAA,EACzB,sCAAsC;AAAA,EACtC,yBAAyB;AAAA,EACzB,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,8BAA8B;AAAA,EAC9B,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,oBAAoB;AAAA,EACpB,yBAAyB;AAAA,EACzB,wBAAwB;AAAA,EACxB,0BAA0B;AAAA,EAC1B,yBAAyB;AAAA,EACzB,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,+BAA+B;AAAA,EAC/B,wBAAwB;AAAA,EACxB,mCAAmC;AAAA,EACnC,4BAA4B;AAAA,EAC5B,6BAA6B;AAAA,EAC7B,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA,EAC3B,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAC3B,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,oCAAoC;AAAA,EACpC,aAAa;AAAA,EACb,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,sBAAsB;AAAA,EACtB,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,wBAAwB;AAAA,EACxB,yBAAyB;AAAA,EACzB,6BAA6B;AAAA,EAC7B,4BAA4B;AAAA,EAC5B,4BAA4B;AAAA,EAC5B,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,gBAAgB,EAAE,SAAS,MAAM,YAAY,CAAC,UAAU,EAAE;AAAA,EAC1D,oBAAoB,EAAE,SAAS,MAAM,YAAY,CAAC,UAAU,EAAE;AAAA,EAC9D,cAAc;AAAA,IACZ,SAAS;AAAA,IACT,QACE;AAAA,EACJ;AAAA,EACA,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,eAAe;AAAA,IACb,SAAS;AAAA,IACT,QAAQ;AAAA,EACV;AAAA,EACA,cAAc;AAAA,IACZ,SAAS;AAAA,IACT,QAAQ;AAAA,EACV;AAAA,EACA,iBAAiB;AAAA,IACf,SAAS;AAAA,IACT,QACE;AAAA,EACJ;AAAA,EACA,iBAAiB,EAAE,SAAS,OAAO,QAAQ,iBAAiB;AAAA,EAC5D,cAAc,EAAE,SAAS,OAAO,QAAQ,sBAAsB;AAAA,EAC9D,gBAAgB,EAAE,SAAS,OAAO,QAAQ,sBAAsB;AAAA,EAChE,iBAAiB,EAAE,SAAS,OAAO,QAAQ,sBAAsB;AAAA,EACjE,gBAAgB,EAAE,SAAS,OAAO,QAAQ,sBAAsB;AAAA,EAChE,mBAAmB,EAAE,SAAS,OAAO,QAAQ,sBAAsB;AAAA,EACnE,mBAAmB,EAAE,SAAS,OAAO,QAAQ,sBAAsB;AAAA,EACnE,iBAAiB,EAAE,SAAS,OAAO,QAAQ,iBAAiB;AAAA,EAC5D,mBAAmB,EAAE,SAAS,OAAO,QAAQ,iBAAiB;AAAA,EAC9D,iBAAiB,EAAE,SAAS,OAAO,QAAQ,IAAI;AAAA,EAC/C,8BAA8B,EAAE,SAAS,OAAO,QAAQ,IAAI;AAAA,EAC5D,iBAAiB,EAAE,SAAS,OAAO,QAAQ,IAAI;AAAA,EAC/C,cAAc,EAAE,SAAS,OAAO,QAAQ,IAAI;AAAA,EAC5C,cAAc,EAAE,SAAS,OAAO,QAAQ,IAAI;AAC9C;AAGO,SAAS,kBAAkB,MAAuB;AACvD,SAAO,gBAAgB,IAAI,GAAG,YAAY;AAC5C;AAEO,SAAS,uBAAuB,MAAiC;AACtE,QAAM,WAAW,gBAAgB,IAAI;AACrC,SAAO,UAAU,UAAW,SAAS,cAAc,CAAC,IAAK,CAAC;AAC5D;AAGO,SAAS,gBACd,MACA,MACU;AACV,SAAO,KAAK,OAAO,CAAC,QAAQ;AAC1B,UAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,GAAG;AACrC,QAAI,UAAU,OAAW,QAAO,UAAU;AAC1C,QAAI,QAAQ,KAAK,MAAM;AAGvB,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI;AACF,gBAAQ,KAAK,MAAM,KAAK;AAAA,MAC1B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,CAAC,CAAC,SAAS,OAAO,UAAU,YAAY,SAAS;AAAA,EAC1D,CAAC;AACH;AAEO,SAAS,eAAe,UAAiC;AAC9D,SAAO,SAAS,QAAQ,QAAQ,EAAE,MAAM,iBACpC,cACA;AACN;","names":[]}

package/dist/{chunk-AKX5ZMCL.mjs → chunk-4M7QDHK4.mjs}

@@ -8,8 +8,9 @@ import {
   DIRECTORY_PATH,
   directoryIncludes,
   directoryOmittedInputs,
+  omittedInputsIn,
   profileForPath
-} from "./chunk-FQJFKWUV.mjs";
+} from "./chunk-24UOECYY.mjs";
 
 // src/http.ts
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -291,25 +292,16 @@ async function dispatchGeneratedTool(client, tool, args) {
     const value = args[param.name];
     query[param.name] = param.explode === false && Array.isArray(value) ? value.join(",") : value;
   }
-  let requestBody = args.body;
-  if (tool.hasBody && typeof requestBody === "string") {
-    try {
-      requestBody = JSON.parse(requestBody);
-    } catch {
-      return {
-        ok: false,
-        status: 400,
-        payload: {
-          error: "The body argument arrived as a string that is not valid JSON. Send body as an object."
-        }
-      };
-    }
-  }
-  if (tool.hasBody && requestBody !== void 0) {
-    const properties = tool.inputSchema.properties ?? {};
-    const defs = tool.inputSchema.$defs ?? {};
-    requestBody = coerceScalars(requestBody, properties.body, defs);
-  }
+  const sent = tool.hasBody ? bodyAsSent(tool, args.body) : { body: args.body };
+  if (!sent)
+    return {
+      ok: false,
+      status: 400,
+      payload: {
+        error: "The body argument arrived as a string that is not valid JSON. Send body as an object."
+      }
+    };
+  const requestBody = sent.body;
   const verbs = client;
   const { data, error, response } = await verbs[tool.method](tool.path, {
     params: { path: pathParams, query },
@@ -322,6 +314,32 @@ async function dispatchGeneratedTool(client, tool, args) {
     payload: data ?? { status: response.status }
   };
 }
+function bodyAsSent(tool, body) {
+  let parsed = body;
+  if (typeof parsed === "string") {
+    try {
+      parsed = JSON.parse(parsed);
+    } catch {
+      return null;
+    }
+  }
+  if (parsed === void 0) return { body: parsed };
+  const properties = tool.inputSchema.properties ?? {};
+  const defs = tool.inputSchema.$defs ?? {};
+  return { body: coerceScalars(parsed, properties.body, defs) };
+}
+function argsAsSent(tool, args) {
+  if (!tool.hasBody || args.body === void 0) return args;
+  const sent = bodyAsSent(tool, args.body);
+  return sent ? { ...args, body: sent.body } : null;
+}
+function omittedEmptyQueryArg(tool) {
+  const required = new Set(tool.inputSchema.required ?? []);
+  const query = new Set(
+    tool.params.filter((p) => p.location === "query").map((p) => p.name)
+  );
+  return (name, value) => query.has(name) && !required.has(name) && isEmptyValue(value);
+}
 function isEmptyValue(value) {
   return value === null || value === "" || Array.isArray(value) && !value.length;
 }
@@ -2758,6 +2776,109 @@ var generatedTools = [
       }
     }
   },
+  {
+    name: "exec-pod",
+    title: "Run a command in a Pod",
+    operationId: "execPod",
+    description: `Run one command inside a running Pod's container and get stdout, stderr and the exit code back. No SSH key, public IP or exposed port is needed. command is an argv array run without a shell: pass ["sh", "-c", "..."] for pipes, redirects, globs or &&. One call waits at most timeoutSeconds (1-25, default 20). timedOut true means the call stopped waiting, NOT that the command stopped: it keeps running in the container. For anything longer (model downloads, pip installs, builds), start it in the background and log to a file, e.g. ["sh", "-c", "nohup wget -c -O /workspace/m.safetensors URL > /tmp/dl.log 2>&1 &"], then check progress with later calls (ls -la, du -h, tail /tmp/dl.log). stdout and stderr are each capped at 1 MiB (truncated true). Right after a create, the Pod can answer 404 "Pod not found" for about 10 seconds even with the right id, then 409 while its container starts: retry in about 10 seconds, a few times at most. A Pod that is not running answers 409. A host not yet updated for exec answers 503. Reaches only Pods owned by the API key's own account. Commands can change or delete data in the Pod: run write commands only for what the user asked.`,
+    directoryDescription: "Run one command inside a running Pod's container and return stdout, stderr and the exit code. The command is an argv array run without a shell. One call waits at most timeoutSeconds (1-25, default 20); a command still running then keeps running in the container, and the result says timedOut. stdout and stderr are each capped at 1 MiB. A Pod that is not running answers 409, and a host not yet updated for exec answers 503. Reaches only Pods owned by the caller's own account. The command can change or delete data in the Pod.",
+    method: "POST",
+    path: "/v2/pods/{id}/exec",
+    params: [
+      {
+        name: "id",
+        location: "path"
+      }
+    ],
+    hasBody: true,
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: {
+          type: "string",
+          description: "Pod identifier"
+        },
+        body: {
+          $ref: "#/$defs/PodExecRequest",
+          type: "object"
+        }
+      },
+      required: ["id", "body"],
+      $defs: {
+        PodExecRequest: {
+          type: "object",
+          additionalProperties: false,
+          required: ["command"],
+          properties: {
+            command: {
+              type: "array",
+              minItems: 1,
+              maxItems: 256,
+              prefixItems: [
+                {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 4096,
+                  pattern: "^[^\\x00]*[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\\x00][^\\x00]*$"
+                }
+              ],
+              items: {
+                type: "string",
+                maxLength: 4096,
+                pattern: "^[^\\x00]*$"
+              },
+              description: 'Command to run, as an argv array of 1-256 arguments of at most 4096 characters each. It is run directly, never through a shell; for pipes, redirects or globbing pass `["sh", "-c", "..."]`.',
+              examples: [
+                ["nvidia-smi", "--query-gpu=name,memory.used", "--format=csv"]
+              ]
+            },
+            timeoutSeconds: {
+              type: "integer",
+              minimum: 1,
+              maximum: 25,
+              default: 20,
+              description: "How long the call waits for the command to finish, in seconds. A command still running at this point returns with `timedOut: true`.",
+              examples: [10]
+            },
+            cwd: {
+              type: "string",
+              pattern: "^/[^\\x00-\\x1f\\x7f]*$",
+              maxLength: 1024,
+              description: "Absolute working directory for the command, at most 1024 characters and without control characters. Defaults to the image's `WORKDIR`.",
+              examples: ["/workspace"]
+            },
+            env: {
+              type: "object",
+              maxProperties: 64,
+              propertyNames: {
+                type: "string",
+                minLength: 1,
+                maxLength: 256,
+                pattern: "^[^=\\x00]+$"
+              },
+              additionalProperties: {
+                type: "string",
+                maxLength: 16384,
+                pattern: "^[^\\x00]*$"
+              },
+              description: "Up to 64 environment variables added to the container's environment for this command only. A name is 1-256 characters and must not contain `=` or a NUL character; a value is at most 16384 characters and must not contain a NUL character.",
+              examples: [
+                {
+                  HF_HOME: "/workspace/hf"
+                }
+              ]
+            }
+          }
+        }
+      }
+    }
+  },
   {
     name: "get-cluster",
     title: "Get cluster",
@@ -6820,6 +6941,122 @@ var generatedTools = [
   }
 ];
 
+// src/specgen/validate.ts
+import { Ajv2020 } from "ajv/dist/2020.js";
+function schemaValidationMode(value = process.env.MCP_SCHEMA_VALIDATION) {
+  const mode = value?.trim().toLowerCase();
+  return mode === "off" || mode === "enforce" ? mode : "shadow";
+}
+var ajv = new Ajv2020({
+  strict: false,
+  allErrors: true,
+  validateFormats: false
+});
+var compiled = /* @__PURE__ */ new WeakMap();
+function validatorFor(schema) {
+  let validate = compiled.get(schema);
+  if (!validate) {
+    validate = ajv.compile(structuredClone(schema));
+    compiled.set(schema, validate);
+  }
+  return validate;
+}
+var MAX_NULL_PASSES = 8;
+function isNullTypeError(error, data) {
+  return error.keyword === "type" && error.instancePath !== "" && valueAt(data, error.instancePath) === null;
+}
+function pointerSegments(pointer) {
+  return pointer.split("/").slice(1).map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"));
+}
+function valueAt(data, pointer) {
+  let node = data;
+  for (const key of pointerSegments(pointer)) {
+    if (node === null || typeof node !== "object") return void 0;
+    node = node[key];
+  }
+  return node;
+}
+function removeAt(data, pointer) {
+  const segments = pointerSegments(pointer);
+  const last = segments.pop();
+  const parent = valueAt(data, segments.length ? `/${segments.join("/")}` : "");
+  if (last === void 0 || parent === null || typeof parent !== "object")
+    return false;
+  if (Array.isArray(parent)) return false;
+  delete parent[last];
+  return true;
+}
+var WRAPPER_KEYWORDS = /* @__PURE__ */ new Set(["if"]);
+function toViolation(error) {
+  const base = pointerSegments(error.instancePath);
+  let path = base.join(".");
+  let message = error.message ?? "is invalid";
+  const params = error.params;
+  if (error.keyword === "required" && typeof params.missingProperty === "string") {
+    path = [...base, params.missingProperty].join(".");
+    message = "is required";
+  } else if (error.keyword === "additionalProperties" && typeof params.additionalProperty === "string") {
+    path = [...base, params.additionalProperty].join(".");
+    message = "is not an accepted argument here";
+  } else if (error.keyword === "pattern") {
+    message = "is not in an accepted format";
+  }
+  const allowed = error.keyword === "enum" ? params.allowedValues : error.keyword === "const" ? [params.allowedValue] : void 0;
+  return {
+    path,
+    keyword: error.keyword,
+    message,
+    ...allowed ? { allowed } : {},
+    schemaPath: error.schemaPath
+  };
+}
+function schemaViolations(schema, args, omitted = () => false) {
+  const validate = validatorFor(schema);
+  const data = structuredClone(
+    Object.fromEntries(
+      Object.entries(args).filter(([name, value]) => !omitted(name, value))
+    )
+  );
+  for (let pass = 0; ; pass++) {
+    if (validate(data)) return [];
+    const errors = validate.errors ?? [];
+    let removed = false;
+    if (pass < MAX_NULL_PASSES) {
+      for (const error of errors.filter((e) => isNullTypeError(e, data)))
+        removed = removeAt(data, error.instancePath) || removed;
+    }
+    if (!removed) {
+      return errors.filter((e) => !WRAPPER_KEYWORDS.has(e.keyword)).map(toViolation);
+    }
+  }
+}
+var INVALID_ARGUMENTS_HINT = "Fix the listed fields and call again.";
+function invalidArgumentsPayload(violations) {
+  return {
+    error: "Invalid arguments",
+    code: "invalid_arguments",
+    fields: violations.map(({ path, message, allowed }) => ({
+      path,
+      problem: message,
+      ...allowed ? { allowed } : {}
+    })),
+    hint: INVALID_ARGUMENTS_HINT
+  };
+}
+function logSchemaViolations(tool, mode, violations) {
+  console.error(
+    "schema_violation",
+    JSON.stringify({
+      tool,
+      mode,
+      violations: violations.map(({ keyword, schemaPath }) => ({
+        keyword,
+        schemaPath
+      }))
+    })
+  );
+}
+
 // src/specgen/tools/annotations.ts
 var readOnly = {
   readOnlyHint: true,
@@ -10586,13 +10823,40 @@ function withoutCredentialExamples(schema) {
   };
   return strip(schema);
 }
-function withoutInputs(schema, omit) {
-  if (!omit.length) return schema;
+function withoutKeys(schema, omit) {
   const properties = { ...schema.properties ?? {} };
   for (const key of omit) delete properties[key];
   const required = Array.isArray(schema.required) ? schema.required.filter((key) => !omit.includes(key)) : schema.required;
   return { ...schema, properties, ...required ? { required } : {} };
 }
+function withoutInputs(schema, omit) {
+  if (!omit.length) return schema;
+  let out = withoutKeys(
+    schema,
+    omit.filter((key) => !key.includes("."))
+  );
+  for (const key of omit.filter((k) => k.includes("."))) {
+    const [parent, child] = key.split(".");
+    const properties = out.properties ?? {};
+    const node = properties[parent];
+    if (!node) continue;
+    const ref = typeof node.$ref === "string" ? node.$ref : void 0;
+    const defName = ref?.startsWith("#/$defs/") ? ref.slice(8) : void 0;
+    const defs = out.$defs ?? {};
+    if (defName && defs[defName]) {
+      out = {
+        ...out,
+        $defs: { ...defs, [defName]: withoutKeys(defs[defName], [child]) }
+      };
+    } else {
+      out = {
+        ...out,
+        properties: { ...properties, [parent]: withoutKeys(node, [child]) }
+      };
+    }
+  }
+  return out;
+}
 function callShape(schema) {
   const defs = schema.$defs ?? {};
   const resolve = (node) => {
@@ -10694,7 +10958,7 @@ function words2(name) {
 
 // src/server.ts
 var SERVER_NAME = "Runpod API Server";
-var SERVER_VERSION = true ? "4.10.1" : "dev";
+var SERVER_VERSION = true ? "4.11.0" : "dev";
 
 // src/specgen/analytics.ts
 import { createHmac } from "crypto";
@@ -11405,6 +11669,7 @@ function createSpecgenServer(ctx, version = "0.1.0", opts = {}) {
   const caller = callerId(ctx.apiKey);
   const profile = opts.profile ?? "default";
   const directory = profile === "directory";
+  const schemaMode = schemaValidationMode();
   const alp = directory ? void 0 : opts.alp;
   const servedGeneratedTools = directory ? generatedTools.filter((tool) => directoryIncludes(tool.name)) : generatedTools;
   const servedCuratedTools = [
@@ -11511,7 +11776,7 @@ function createSpecgenServer(ctx, version = "0.1.0", opts = {}) {
       (tool) => tool.name === request.params.name
     );
     const curatedArgs = curated ? withoutNullOptionals(curated.inputSchema, args) : args;
-    const omitted = directory ? directoryOmittedInputs(request.params.name).filter((key) => key in args) : [];
+    const omitted = directory ? omittedInputsIn(directoryOmittedInputs(request.params.name), args) : [];
     const rejected = omitted.length ? {
       ok: false,
       status: 400,
@@ -11521,8 +11786,26 @@ function createSpecgenServer(ctx, version = "0.1.0", opts = {}) {
     } : curated && !curated.lenientArguments ? validateArguments(
       curated.inputSchema,
       curatedArgs
-    ) : null;
-    const result = rejected ?? await runTool(
+    ) : generated ? validateArguments(generated.inputSchema, args) : null;
+    let schemaRejected = null;
+    if (!rejected && schemaMode !== "off") {
+      const sent = generated ? argsAsSent(generated, args) : null;
+      const violations = curated ? curated.lenientArguments ? [] : schemaViolations(curated.inputSchema, curatedArgs) : generated && sent ? schemaViolations(
+        generated.inputSchema,
+        sent,
+        omittedEmptyQueryArg(generated)
+      ) : [];
+      if (violations.length) {
+        logSchemaViolations(request.params.name, schemaMode, violations);
+        if (schemaMode === "enforce")
+          schemaRejected = {
+            ok: false,
+            status: 400,
+            payload: invalidArgumentsPayload(violations)
+          };
+      }
+    }
+    const result = rejected ?? schemaRejected ?? await runTool(
       () => curated ? curated.handler(ctx, curatedArgs) : dispatchTool(generated, request.params.name, args)
     );
     logToolCall({
@@ -11861,6 +12144,7 @@ function createToolContext(options = {}) {
 
 // src/specgen/not-found-limiter.ts
 var SINK_TIMEOUT_MS2 = 3e3;
+var LOOP_LIMITED_TOOLS = /* @__PURE__ */ new Set(["get-pod"]);
 var NOT_FOUND_LOOP = "not_found_loop";
 var blocked = /* @__PURE__ */ new Map();
 function notFoundSinkUrl(submitUrl) {
@@ -11885,7 +12169,7 @@ function createNotFoundLimiter(opts) {
       };
     },
     onToolResult: (tool, status) => {
-      if (status !== 404) return;
+      if (status !== 404 || !LOOP_LIMITED_TOOLS.has(tool)) return;
       const pair = `${opts.key}|${tool}`;
       void fetchImpl(opts.sinkUrl, {
         method: "POST",
@@ -12378,4 +12662,4 @@ export {
   summarizeRpc,
   handleMcpRequest
 };
-//# sourceMappingURL=chunk-AKX5ZMCL.mjs.map
+//# sourceMappingURL=chunk-4M7QDHK4.mjs.map