@ttoss/http-server-mcp 0.39.1 → 0.40.0

package/README.md

@@ -781,6 +781,8 @@ Registers `Tool`s on an MCP server. See [Tools](#tools).
 
 By default, a JSON Schema `inputSchema` is **advertised but not enforced**: it round-trips verbatim over `tools/list` so clients know what to send, while arguments reach your handler unchecked. Set `validateArguments: true` to reject mismatched calls before the handler runs.
 
+A schema with `additionalProperties: false` refuses every argument it does not declare, and names each one (`prefix: is not an argument of this tool`), so a misspelled argument is an error the caller can fix rather than one dropped unseen.
+
 Enable it once you're confident `inputSchema` describes every value the tool genuinely accepts. Schemas derived from an OpenAPI document are a common source of _incomplete_ ones — a field a client may send as `null` to clear it, or one that accepts several shapes, is easily emitted as a bare `{ type: 'string' }`. Validating against a schema like that rejects calls the underlying API would have accepted. To describe those cases accurately, use `{ type: ['string', 'null'] }` for a nullable field and forward `oneOf`/`anyOf` verbatim rather than collapsing to one type.
 
 ### `defineTool(params)`

package/dist/index.cjs

@@ -520,6 +520,50 @@ var isStandardSchema = schema => {
   return "~standard" in schema;
 };
 /**
+* Enforces a closed schema while naming each undeclared argument. The SDK's
+* own `additionalProperties: false` issue carries no path, so the argument to
+* drop goes unnamed; the rest of the schema is checked with it left open.
+*/
+var namingUndeclared = ({
+  schema,
+  standard
+}) => {
+  const {
+    additionalProperties: _closed,
+    ...openSchema
+  } = schema;
+  const open = (0, _modelcontextprotocol_server.fromJsonSchema)(openSchema);
+  const declared = new Set(Object.keys(schema.properties ?? {}));
+  const withUndeclared = ({
+    value,
+    result
+  }) => {
+    const undeclared = Object.keys(Object(value)).filter(key => {
+      return !declared.has(key);
+    });
+    if (undeclared.length === 0) return result;
+    return {
+      issues: [...undeclared.map(key => {
+        return {
+          message: "is not an argument of this tool",
+          path: [key]
+        };
+      }), ...(result.issues ?? [])]
+    };
+  };
+  return {
+    "~standard": {
+      ...standard["~standard"],
+      validate: async value => {
+        return withUndeclared({
+          value,
+          result: await open["~standard"].validate(value)
+        });
+      }
+    }
+  };
+};
+/**
 * Converts a JSON Schema into the Standard Schema `registerTool` accepts.
 *
 * A Standard Schema keeps advertisement and enforcement in separate fields:
@@ -532,6 +576,10 @@ var fromJsonObjectSchema = ({
   validate
 }) => {
   const standard = (0, _modelcontextprotocol_server.fromJsonSchema)(schema);
+  if (validate && schema.additionalProperties === false) return namingUndeclared({
+    schema,
+    standard
+  });
   if (validate) return standard;
   return {
     "~standard": {

package/dist/index.mjs

@@ -517,6 +517,50 @@ var isStandardSchema = schema => {
   return "~standard" in schema;
 };
 /**
+* Enforces a closed schema while naming each undeclared argument. The SDK's
+* own `additionalProperties: false` issue carries no path, so the argument to
+* drop goes unnamed; the rest of the schema is checked with it left open.
+*/
+var namingUndeclared = ({
+  schema,
+  standard
+}) => {
+  const {
+    additionalProperties: _closed,
+    ...openSchema
+  } = schema;
+  const open = fromJsonSchema(openSchema);
+  const declared = new Set(Object.keys(schema.properties ?? {}));
+  const withUndeclared = ({
+    value,
+    result
+  }) => {
+    const undeclared = Object.keys(Object(value)).filter(key => {
+      return !declared.has(key);
+    });
+    if (undeclared.length === 0) return result;
+    return {
+      issues: [...undeclared.map(key => {
+        return {
+          message: "is not an argument of this tool",
+          path: [key]
+        };
+      }), ...(result.issues ?? [])]
+    };
+  };
+  return {
+    "~standard": {
+      ...standard["~standard"],
+      validate: async value => {
+        return withUndeclared({
+          value,
+          result: await open["~standard"].validate(value)
+        });
+      }
+    }
+  };
+};
+/**
 * Converts a JSON Schema into the Standard Schema `registerTool` accepts.
 *
 * A Standard Schema keeps advertisement and enforcement in separate fields:
@@ -529,6 +573,10 @@ var fromJsonObjectSchema = ({
   validate
 }) => {
   const standard = fromJsonSchema(schema);
+  if (validate && schema.additionalProperties === false) return namingUndeclared({
+    schema,
+    standard
+  });
   if (validate) return standard;
   return {
     "~standard": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-mcp",
-  "version": "0.39.1",
+  "version": "0.40.0",
   "description": "Model Context Protocol (MCP) server integration for @ttoss/http-server",
   "keywords": [
     "ai",
@@ -37,9 +37,9 @@
     "@modelcontextprotocol/node": "^2.1.1",
     "@modelcontextprotocol/server": "^2.3.1",
     "zod": "^4.6.7",
-    "@ttoss/http-server-auth": "^0.10.2",
     "@ttoss/auth-core": "^0.20.1",
     "@ttoss/http-server": "^0.14.2",
+    "@ttoss/http-server-auth": "^0.10.2",
     "@ttoss/i18n-core": "^0.9.2"
   },
   "devDependencies": {