[BUG] MCP clients get no tools from v0.3.0: kubescape_get_vulnerability_details outputSchema is not an object

Offen Anfängerfreundlich
  • Stimmt etwas nicht?
#87 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

@nishanthchandr4 arbeitet bereits daran.

Seit 07.10.2026.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
82/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
go
Bereich
api

Rechercherichtung

Beginne mit pkg/kubescape/kubescape.go und dem Ausgabetyp von handleGetVulnerabilityDetails, lies anschließend cmd/tools_output_schema_test.go und den Test TestEveryToolHasValidOutputSchema. Verpacke die Slice-Ausgabe wie beschrieben in einem Objekt und verschärfe den Test, sodass er für jedes Tool den Ausgabeschema-Typ object verlangt. Fertig ist die Arbeit, wenn der Schema-Test besteht und Nicht-Objekt-Schemas erkennt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Bug · Severity: Medium · default install · no workaround short of disabling the Kubescape tools
Affects: kagent-tools v0.3.0 (bundled with kagent v0.10.3) · Component: MCP server, tools/list
Introduced by: #66 "Migrate to GO SDK" (merged 2026-09-23)

What breaks

As a user I point an MCP client (MCP Inspector, VS Code, Cursor, Claude Desktop, anything on the TypeScript SDK) at the kagent-tools server. On v0.2.1 the client lists all 124 tools. On v0.3.0, which serves 126, I get none: one tool advertises an invalid outputSchema, and the client rejects the entire tools/list response.

Failed to list tools: [{"code":"invalid_value","values":["object"],
  "path":["tools",113,"outputSchema","type"],"message":"Invalid input: expected \"object\""}]

Tool 113 is kubescape_get_vulnerability_details. Its outputSchema is {"type": ["null","array"]}. The MCP spec (2025-06-18) requires a tool's outputSchema to have type: "object", because structured content is always a JSON object.

Reproduce

Docker only, no cluster needed:

docker run -d --name kt --platform linux/amd64 -p 18084:8084 ghcr.io/kagent-dev/kagent/tools:0.3.0 --port 8084
npx @modelcontextprotocol/[email protected] --cli http://localhost:18084/mcp --transport http --method tools/list

The same command against ghcr.io/kagent-dev/kagent/tools:0.2.1 lists all 124 tools and exits 0.

Expected vs actual

  • Expected: every tool's outputSchema is an object schema, and tools/list succeeds on spec-compliant clients.
  • Actual: kubescape_get_vulnerability_details advertises an array schema, and strict clients get no tools at all.

Ask

Wrap that tool's output in an object, and make the existing schema test enforce type: "object" so the next slice-returning handler can't regress it. It's a one-type change. Clients stay broken until a release ships it.

Root cause: the handler's typed output is a slice, so go-sdk infers an array schema

pkg/kubescape/kubescape.go (v0.3.0, unchanged on main):

func (k *KubescapeTool) handleGetVulnerabilityDetails(ctx context.Context, request *sdkmcp.CallToolRequest,
    in getVulnerabilityDetailsInput) (*sdkmcp.CallToolResult, []v1beta1.Match, error)

go-sdk (v1.8.0) infers the output schema from the Out type parameter. A nil-able slice becomes {"type":["null","array"]}.

Suggested fix:

type vulnerabilityDetailsOutput struct {
    Matches []v1beta1.Match `json:"matches"`
}

cmd/tools_output_schema_test.go (TestEveryToolHasValidOutputSchema) only checks that each schema is non-nil and JSON-serializable, so this passed CI. Adding require.Equal(t, "object", tool.OutputSchema.(map[string]any)["type"]) (or the equivalent on the typed schema) would catch it.

Scope: exactly one of 126 tools is affected, and the server itself works

Raw JSON-RPC against the v0.3.0 image, with no client-side validation, lists every tool whose schema isn't an object:

H='-H Content-Type:application/json -H Accept:application/json,text/event-stream'
SID=$(curl -s -D - -o /dev/null $H http://localhost:18084/mcp \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' \
  | awk -F': ' 'tolower($1)=="mcp-session-id"{print $2}' | tr -d '\r')
curl -s $H -H "Mcp-Session-Id: $SID" http://localhost:18084/mcp -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'
curl -s $H -H "Mcp-Session-Id: $SID" -H "MCP-Protocol-Version: 2025-06-18" http://localhost:18084/mcp \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | sed -n 's/^data: //p' \
  | jq -c '.result.tools|to_entries[]|select(.value.outputSchema.type!="object")|{i:.key,name:.value.name,type:.value.outputSchema.type}'
# {"i":113,"name":"kubescape_get_vulnerability_details","type":["null","array"]}
  • Reproduced with image digest sha256:cb89eb76216195a90cac73846b447525b6e6e33e45154d1ded9621bf11340315, both locally and in a kind cluster running kagent v0.10.3. The 0.2.1 image, run the same way, passes with 124 tools.
  • Not a client-version artifact: the image is the only thing that changed between a passing and a failing run (kagent v0.10.2 → v0.10.3, kagent-tools 0.2.1 → 0.3.0). The Inspector version was pinned at 0.21.2 in both.
  • Not affected: kagent agents themselves. Their MCP clients don't validate outputSchema.type, so the RemoteMCPServer stays Accepted and agents still call tools. Only strict, spec-validating clients break.
Vorherrschende Sprache
Go
Sterne
39
Forks
31
Ø Merge
2 T. 8 Std.
Gemergte PRs (30 T.)
2

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

  • Enthält ein Dockerfile oder eine Docker-Compose-Datei
  • Keine Pull-Request-Vorlage
  • Kein Beitragsleitfaden

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus kagent-dev/tools

Alle Issues in kagent-dev/tools

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.