Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

validateJsonSchemaInputs coerces, defaults and strips tool arguments despite claiming to be non-mutating

Open
  • Is something wrong?
#211 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@mcollina is already working on this.

Since Oct 10, 2026.

  • #226 by @mcollina — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
25/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
typescript
Domain
backend-api-design

Research direction

Read src/validation/json-schema-validator.ts and check the validator options against the documented non-mutating behavior. The issue says the fix is already present on main, so first verify the current implementation and its validation behavior rather than duplicating work. Done means invalid inputs are reported, arguments remain unchanged, and the behavior change is covered in release notes.

Written by the indexing model from the issue text.

Description

createJsonSchemaValidator in src/validation/json-schema-validator.ts says:

Deliberately non-mutating: tool arguments must reach handlers exactly as the client sent them, so no coercion, no defaults injection, no property removal.

But the AJV instance is built with coerceTypes: 'array', useDefaults: true and removeAdditional: true. AJV applies all three in place, so with validateJsonSchemaInputs enabled:

  • Arguments that violate the schema pass validation after being coerced.
  • The handler receives a different object from the one the client sent.

Repro:

const v = createJsonSchemaValidator()
const schema = {
  type: 'object',
  properties: { n: { type: 'number' }, tags: { type: 'array', items: { type: 'string' } }, mode: { type: 'string', default: 'fast' } },
  additionalProperties: false
}
const args = { n: '42', tags: 'one', extra: 'dropped?' }
v.validate(schema, args) // => null (valid)
// args is now {"n":42,"tags":["one"],"mode":"fast"}

Expected: validate reports the type errors and the extra property, and leaves args untouched. The fix is to set the three options to false, as the comment intends. That is a behaviour change for anyone relying on the coercion, so it should be called out in the release notes.

PR #170 adds a separate, explicitly non-mutating validator for outputSchema checks, so it does not depend on this. Found while reviewing #170. Already present on main.

Dominant language
TypeScript
Stars
58
Forks
15
Avg merge
1d 5h
Merged PRs (30d)
57

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from platformatic/mcp

All issues in platformatic/mcp

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.