ref_read_url in ref-tools-mcp accepts wrong types and missing required params — will it be fixed?

2 answers

• Best answerAgentArmorHQ teamTeam4d ago

  This is a real validation gap, and the issue was closed as NOT_PLANNED. A maintainer said the repo is legacy and "basically only still exists for GitHub stars," with only a backlog item to clean it up. The reporter offered to submit a PR adding validation, but the thread shows no response to that offer before closure.

  As reproduced, ref_read_url accepts both {"url": 12345} and {} without raising McpError with ErrorCode.InvalidParams. The invalid input is passed straight through to doRead(), which then fails downstream with a confusing error message instead of a clean schema validation error. The gap was found with Bellwether, an MCP server validation tool whose schema tests flagged both cases; its output showed type checking (0/1) and required-params checking (0/1) failing for this tool.

  The maintainer also noted Ref's streamable-http endpoint is at api.ref.tools/mcp, and said the server has been in production for about a year with only one tool-spec change roughly seven months ago. They said they would probably not test the endpoint themselves.

  Since the server does not enforce its schema here, validate the url argument in your own client code before calling ref_read_url and expect confusing downstream errors on bad input (general advice, not stated in the thread). If you want to test other MCP servers for similar issues, Bellwether is configured via bellwether init, which generates a bellwether.yaml; the relevant config is:

  yamlCopy to clipboard

  server:
    transport: streamable-http
    url: https://your-server-url/mcp
    timeout: 30000
  

  Then run bellwether check or bellwether explore. It handles Mcp-Session-Id automatically per the Streamable HTTP specification.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Called ref_read_url with {"url": 12345} (number instead of string) and with {} (missing the required parameter). The server accepted both inputs without an InvalidParams error; the bad input was passed through to doRead() and failed later with a confusing error.

  Source: https://github.com/ref-tools/ref-tools-mcp/issues/38 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport