timothy/ersatztv
1
0
Fork 0
Code Issues 54 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

MCP query-parameter guard ignores a $ref'd OpenAPI parameter instead of failing loudly #759

New Issue
Open
opened 2026-08-06 21:49:48 +02:00 by timothy · 0 comments
timothy commented 2026-08-06 21:49:48 +02:00
Owner
Copy Link
Copy Source

Follow-up from ersatztv#757. QueryParameterNames in ToolCatalogTests selects parameters via
p.TryGetProperty("in", ...). An OpenAPI parameter written as {"$ref": "#/components/parameters/X"}
carries no inline in, so it is silently dropped from the accepted set — and if the tool does not
declare it either, both sides are empty and the test is green while the parameter is unreachable.

Dormant, not live (verified when filed): v1.json currently has 0 $refd parameters, 0
path-item-level shared parameters blocks, and components holds only schemas/securitySchemes.
So it cannot fire today.

It is worth closing anyway because it is asymmetric with the sibling body guard, which deliberately
fails loudly on a shape it was not taught ("request body schema is not a $ref; teach this test the new shape"). The query guard should get the same treatment rather than degrading to a silent pass —
see the mcp.tool-schema-openapi-parity record.

Done-when

  • Each parameter entry is asserted to carry an inline in, failing loudly otherwise
  • Verified by mutation: a $refd parameter in a fixture/spec turns the suite red rather than green
  • mcp.tool-schema-openapi-parity scope section updated
  • Adversarial review passed
Follow-up from ersatztv#757. `QueryParameterNames` in `ToolCatalogTests` selects parameters via `p.TryGetProperty("in", ...)`. An OpenAPI parameter written as `{"$ref": "#/components/parameters/X"}` carries no inline `in`, so it is silently dropped from the accepted set — and if the tool does not declare it either, **both sides are empty and the test is green while the parameter is unreachable**. **Dormant, not live** (verified when filed): `v1.json` currently has 0 `$ref`d parameters, 0 path-item-level shared `parameters` blocks, and `components` holds only `schemas`/`securitySchemes`. So it cannot fire today. It is worth closing anyway because it is asymmetric with the sibling body guard, which deliberately fails loudly on a shape it was not taught (`"request body schema is not a $ref; teach this test the new shape"`). The query guard should get the same treatment rather than degrading to a silent pass — see the `mcp.tool-schema-openapi-parity` record. ## Done-when - [ ] Each parameter entry is asserted to carry an inline `in`, failing loudly otherwise - [ ] Verified by mutation: a `$ref`d parameter in a fixture/spec turns the suite red rather than green - [ ] `mcp.tool-schema-openapi-parity` scope section updated - [ ] Adversarial review passed
timothy added the priority: low label 2026-08-06 21:49:57 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels priority: low
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#759