authorgravatar for mfazekas@szemafor.comMiklós Fazekas <mfazekas@szemafor.com> 2026-10-12 03:18:11+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-10-12 01:18:11+00:00
logee2763e9b20f937de0c2adffff8dddfe2d5af3b3
tree648c26bd11f1c89a7589454197adf6d1509850d8
parenta5331e4c2c0f0a7b85d912e487f5c97bbce921aa
signature Signed by PGP key B5690EEEBB952194

Reject unknown params in t3_thread_read (#17823)

2 files changed, 8 insertions(+), 0 deletions(-)

apps/server/src/mcp/OrchestratorMcpToolkit.integration.test.ts+6
......@@ -1426,6 +1426,12 @@ describe("orchestrator MCP toolkit", () => {
14261426 expect(threadListTool?.tool.annotations?.idempotentHint).toBe(true);
14271427 const threadReadTool = server.tools.find(({ tool }) => tool.name === "t3_thread_read");
14281428 expect(threadReadTool?.tool.annotations?.readOnlyHint).toBe(false);
1429 expect(threadReadTool?.tool.inputSchema).toMatchObject({ additionalProperties: false });
1430 const unknownPagingParamError = yield* invoke("t3_thread_read", {
1431 threadId: parentThreadId,
1432 cursor: 90,
1433 }).pipe(Effect.flip);
1434 expect(unknownPagingParamError.message).toContain("Expected no excess property");
14291435 const threadUpdateTool = server.tools.find(
14301436 ({ tool }) => tool.name === "t3_thread_update",
14311437 );
apps/server/src/mcp/toolkits/orchestrator/tools.ts+2
......@@ -214,6 +214,8 @@ const ThreadReadTool = Tool.make("t3_thread_read", {
214214 dependencies,
215215})
216216 .annotate(Tool.Title, "Read a T3 thread")
217 // Strict so a misspelled paging param fails instead of silently reading from position 0.
218 .annotate(Tool.Strict, true)
217219 .annotate(Tool.Readonly, false)
218220 .annotate(Tool.Destructive, false)
219221 .annotate(Tool.Idempotent, true);