sdcvalidator 4.5.1__tar.gz → 4.5.3__tar.gz

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sdcvalidator
-Version: 4.5.1
+Version: 4.5.3
 Summary: SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema
 Author: Axius SDC, Inc.
 License-Expression: Apache-2.0
@@ -151,9 +151,13 @@ sdcvalidator-json2xml data.json schema.xsd -o output.xml
 `sdcvalidator` ships a stdio MCP (Model Context Protocol) server so any MCP-capable agent can validate SDC4 data without importing the Python library. It implements JSON-RPC 2.0 directly over stdio — no external MCP SDK dependency.
 
 ```bash
-sdcvalidator-mcp serve --mcp
+sdcvalidator            # what an MCP registry client runs (uvx sdcvalidator)
+sdcvalidator mcp        # the same, spelled like the other Semantic Data Charter servers
+sdcvalidator-mcp serve --mcp   # still works for existing client configurations
 ```
 
+A client configuration needs only `"command": "uvx", "args": ["sdcvalidator"]`.
+
 ### Tools
 
 | Tool | Purpose |

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/README.md

@@ -129,9 +129,13 @@ sdcvalidator-json2xml data.json schema.xsd -o output.xml
 `sdcvalidator` ships a stdio MCP (Model Context Protocol) server so any MCP-capable agent can validate SDC4 data without importing the Python library. It implements JSON-RPC 2.0 directly over stdio — no external MCP SDK dependency.
 
 ```bash
-sdcvalidator-mcp serve --mcp
+sdcvalidator            # what an MCP registry client runs (uvx sdcvalidator)
+sdcvalidator mcp        # the same, spelled like the other Semantic Data Charter servers
+sdcvalidator-mcp serve --mcp   # still works for existing client configurations
 ```
 
+A client configuration needs only `"command": "uvx", "args": ["sdcvalidator"]`.
+
 ### Tools
 
 | Tool | Purpose |

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sdcvalidator"
-version = "4.5.1"
+version = "4.5.3"
 description = "SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema"
 license = "Apache-2.0"
 requires-python = ">=3.10"

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/src/sdcvalidator/__init__.py

@@ -14,7 +14,7 @@ Thin wrapper over xmlschema with two-tier error classification and the SDC4
 "quarantine-and-tag" recovery pattern (ISO 21090 ExceptionalValues).
 """
 
-__version__ = "4.5.1"
+__version__ = "4.5.3"
 
 # etree_tostring is re-exported from xmlschema so callers can serialize the
 # ElementTree returned by validate_with_recovery() without importing xmlschema

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/src/sdcvalidator/mcp_server.py

@@ -36,7 +36,7 @@ from sdcvalidator.schema_checker import validate_sdc4_schema_compliance
 JSONRPC_VERSION = "2.0"
 MCP_PROTOCOL_VERSION = "2024-11-05"
 SERVER_NAME = "sdcvalidator"
-SERVER_VERSION = "4.5.1"
+SERVER_VERSION = "4.5.3"
 
 # Validator cache: schema_path -> SDC4Validator
 _validators: dict[str, SDC4Validator] = {}
@@ -201,10 +201,24 @@ def _jsonrpc_error(id: Any, code: int, message: str, data: Any = None) -> dict:
     return {"jsonrpc": JSONRPC_VERSION, "id": id, "error": error}
 
 
-def _handle_request(request: dict) -> dict | None:
+def _handle_request(request) -> dict | None:
+    # ★ Attacker-reachable input over stdio with no authentication. A JSON
+    # value that is not an object, or an object whose params is not one,
+    # used to raise AttributeError and kill the server (VSL rollout R9).
+    # Every shape the protocol does not allow is answered with -32600.
+    if not isinstance(request, dict):
+        return _jsonrpc_error(None, -32600, "Invalid Request: a JSON-RPC request is an object")
+    req_id = request.get("id")
+    if not isinstance(req_id, (str, int, type(None))):
+        return _jsonrpc_error(None, -32600, "Invalid Request: id must be a string, a number or null")
     method = request.get("method", "")
+    if not isinstance(method, str):
+        return _jsonrpc_error(req_id, -32600, "Invalid Request: method must be a string")
     params = request.get("params", {})
-    req_id = request.get("id")
+    if params is None:
+        params = {}
+    if not isinstance(params, dict):
+        return _jsonrpc_error(req_id, -32600, "Invalid Request: params must be an object")
 
     if method == "initialize":
         result = {
@@ -228,6 +242,12 @@ def _handle_request(request: dict) -> dict | None:
     elif method == "tools/call":
         tool_name = params.get("name", "")
         tool_args = params.get("arguments", {})
+        if tool_args is None:
+            tool_args = {}
+        if not isinstance(tool_name, str) or not isinstance(tool_args, dict):
+            return _jsonrpc_error(
+                req_id, -32602, "Invalid params: name must be a string and arguments an object"
+            )
 
         handler = TOOL_HANDLERS.get(tool_name)
         if handler is None:
@@ -270,22 +290,37 @@ def run_stdio() -> None:
             sys.stdout.flush()
 
 
-def main() -> None:
-    """Entry point for the sdcvalidator MCP server."""
+def main(argv: list[str] | None = None) -> None:
+    """Entry point of the ``sdcvalidator`` and ``sdcvalidator-mcp`` console scripts.
+
+    Three spellings start the stdio server: no arguments at all (what an MCP
+    registry client runs: ``uvx sdcvalidator``), ``mcp`` (the spelling the other
+    Semantic Data Charter servers use) and ``serve --mcp`` (kept for existing
+    client configurations). Until 4.5.3 the bare command printed this help and
+    exited, so the registry entry never started a server (issue #15).
+    """
     import argparse
 
     parser = argparse.ArgumentParser(
-        prog="sdcvalidator-mcp",
-        description="SDC4 structural validator - MCP server",
+        prog="sdcvalidator",
+        description="SDC4 structural validator - MCP stdio server",
+        epilog="With no command the MCP server starts, reading JSON-RPC on stdin.",
     )
     subparsers = parser.add_subparsers(dest="command")
 
+    subparsers.add_parser("mcp", help="Run the MCP stdio server")
     serve_parser = subparsers.add_parser("serve", help="Start the validation server")
     serve_parser.add_argument("--mcp", action="store_true", help="Run as MCP stdio server")
 
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
 
-    if args.command == "serve" and args.mcp:
+    if args.command is None or args.command == "mcp" or (args.command == "serve" and args.mcp):
+        if args.command is None and sys.stdin.isatty():
+            sys.stderr.write(
+                "sdcvalidator: MCP server reading JSON-RPC 2.0 on stdin "
+                "(sdcvalidator --help for options, Ctrl-D to stop)\n"
+            )
+            sys.stderr.flush()
         run_stdio()
     else:
         parser.print_help()

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/src/sdcvalidator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sdcvalidator
-Version: 4.5.1
+Version: 4.5.3
 Summary: SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema
 Author: Axius SDC, Inc.
 License-Expression: Apache-2.0
@@ -151,9 +151,13 @@ sdcvalidator-json2xml data.json schema.xsd -o output.xml
 `sdcvalidator` ships a stdio MCP (Model Context Protocol) server so any MCP-capable agent can validate SDC4 data without importing the Python library. It implements JSON-RPC 2.0 directly over stdio — no external MCP SDK dependency.
 
 ```bash
-sdcvalidator-mcp serve --mcp
+sdcvalidator            # what an MCP registry client runs (uvx sdcvalidator)
+sdcvalidator mcp        # the same, spelled like the other Semantic Data Charter servers
+sdcvalidator-mcp serve --mcp   # still works for existing client configurations
 ```
 
+A client configuration needs only `"command": "uvx", "args": ["sdcvalidator"]`.
+
 ### Tools
 
 | Tool | Purpose |

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/src/sdcvalidator.egg-info/SOURCES.txt

@@ -25,6 +25,7 @@ tests/test_error_mapper.py
 tests/test_instance_modifier.py
 tests/test_mcp_server.py
 tests/test_recovery.py
+tests/test_registry_launch.py
 tests/test_schema_checker.py
 tests/test_validator.py
 tests/test_xsd11_restriction.py

{sdcvalidator-4.5.1 → sdcvalidator-4.5.3}/tests/test_mcp_server.py

@@ -137,3 +137,55 @@ class TestConsistentSerialization:
             assert content[0]["type"] == "text"
             parsed = json.loads(content[0]["text"])
             assert parsed is not None
+
+class TestMalformedRequestsDoNotKillTheServer:
+    """
+    VSL rollout inventory R9. Six inputs that are valid JSON but not a
+    JSON-RPC request raised AttributeError in _handle_request and ended the
+    process. Each is now answered with -32600 (or -32602 for bad tool params)
+    and the loop keeps reading.
+    """
+
+    @pytest.mark.parametrize("payload", [[], ["tools/list"], "tools/list", 7, None, True])
+    def test_a_non_object_request_is_invalid_request(self, payload):
+        response = _handle_request(payload)
+        assert response["error"]["code"] == -32600
+        assert response["id"] is None
+
+    @pytest.mark.parametrize("params", [[], "x", 3, True])
+    def test_non_object_params_are_invalid_request(self, params):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": params})
+        assert response["error"]["code"] == -32600
+        assert response["id"] == 1
+
+    def test_null_params_are_treated_as_empty(self):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": None})
+        assert "result" in response
+
+    def test_a_non_string_method_is_invalid_request(self):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": ["tools/list"]})
+        assert response["error"]["code"] == -32600
+
+    @pytest.mark.parametrize("arguments", [[], "x", 3])
+    def test_non_object_tool_arguments_are_invalid_params(self, arguments):
+        response = _handle_request({
+            "jsonrpc": "2.0", "id": 1, "method": "tools/call",
+            "params": {"name": list(TOOL_HANDLERS)[0], "arguments": arguments},
+        })
+        assert response["error"]["code"] == -32602
+
+    def test_the_stdio_loop_survives_every_one_of_them(self, monkeypatch, capsys):
+        import io
+        import sys
+
+        from sdcvalidator.mcp_server import run_stdio
+
+        lines = ["[]", "\"tools/list\"", "7", "null",
+                 json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": []}),
+                 json.dumps({"jsonrpc": "2.0", "id": 2, "method": "ping"})]
+        monkeypatch.setattr(sys, "stdin", io.StringIO("\n".join(lines) + "\n"))
+        run_stdio()
+        out = [json.loads(l) for l in capsys.readouterr().out.strip().splitlines()]
+        assert len(out) == 6
+        assert [o.get("error", {}).get("code") for o in out[:5]] == [-32600] * 5
+        assert out[5] == {"jsonrpc": "2.0", "id": 2, "result": {}}

sdcvalidator-4.5.3/tests/test_registry_launch.py

@@ -0,0 +1,79 @@
+"""
+The MCP registry entry starts the server (issue #15).
+
+``server.json`` declared no ``packageArguments``, so ``uvx sdcvalidator`` ran
+``main()`` with no arguments, which printed the CLI help and exited. These
+tests start the console script's entry point the way a registry client, a
+hand-written configuration and the pre-4.5.3 configuration do, and check that
+``server.json`` names the released version.
+"""
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+import sdcvalidator
+from sdcvalidator.mcp_server import SERVER_VERSION
+
+ROOT = Path(__file__).resolve().parents[1]
+SERVER_JSON = json.loads((ROOT / "server.json").read_text(encoding="utf-8"))
+
+INITIALIZE = {"jsonrpc": "2.0", "id": 1, "method": "initialize",
+              "params": {"protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "t", "version": "0"}}}
+
+
+def _launch(args):
+    proc = subprocess.run(
+        [sys.executable, "-m", "sdcvalidator.mcp_server", *args],
+        input=json.dumps(INITIALIZE) + "\n",
+        capture_output=True, text=True, timeout=60,
+    )
+    return proc
+
+
+def _registry_args():
+    package = SERVER_JSON["packages"][0]
+    return [a["value"] for a in package.get("packageArguments", []) if a["type"] == "positional"]
+
+
+@pytest.mark.parametrize("args", [
+    pytest.param([], id="bare, what a registry client without packageArguments runs"),
+    pytest.param(_registry_args(), id="server.json packageArguments"),
+    pytest.param(["mcp"], id="mcp"),
+    pytest.param(["serve", "--mcp"], id="serve --mcp (pre-4.5.3 configurations)"),
+])
+def test_each_launch_spelling_answers_initialize(args):
+    proc = _launch(args)
+    assert proc.returncode == 0, proc.stderr
+    lines = [line for line in proc.stdout.splitlines() if line.strip()]
+    assert lines, f"no JSON-RPC response; stdout was help text?\n{proc.stdout}"
+    response = json.loads(lines[0])
+    assert response["id"] == 1
+    assert response["result"]["serverInfo"]["name"] == "sdcvalidator"
+    assert response["result"]["serverInfo"]["version"] == SERVER_VERSION
+    assert "usage:" not in proc.stdout
+
+
+def test_serve_without_mcp_still_prints_help():
+    proc = _launch(["serve"])
+    assert proc.returncode == 0
+    assert "usage:" in proc.stdout
+
+
+def test_server_json_declares_the_mcp_launch():
+    package = SERVER_JSON["packages"][0]
+    assert package["identifier"] == "sdcvalidator"
+    assert package["runtimeHint"] == "uvx"
+    assert _registry_args() == ["mcp"]
+
+
+def test_server_json_names_the_released_version():
+    # A regex, not tomllib: the test matrix includes Python 3.10.
+    pyproject = re.search(r'^version = "([^"]+)"', (ROOT / "pyproject.toml").read_text(encoding="utf-8"), re.M).group(1)
+    assert SERVER_JSON["version"] == pyproject
+    assert SERVER_JSON["packages"][0]["version"] == pyproject
+    assert sdcvalidator.__version__ == pyproject
+    assert SERVER_VERSION == pyproject