github · obsidian-mcp-serverHEAD

Evidence

## Security

- Upstream error bodies pass through a `safeUpstream()` helper before being attached to JSON-RPC `error.data` — it keeps only the human `message` field (or trims raw text to 200 chars) and drops plugin-internal fields like `errorCode` that would otherwise leak into client-visible payloads.

- The TLS verify-disable fallback (`NODE_TLS_REJECT_UNAUTHORIZED=0`) is **scoped to Bun**. Outbound HTTPS only goes to the configured Obsidian Local REST API, so the blast radius is the upstream y

Remediation

Drop the verify-disable flag. If the peer presents a private CA: - Python: pass `verify="/path/to/ca.pem"` or trust the system store - Node: `new https.Agent({ ca: fs.readFileSync("ca.pem") })` - Go: load the CA via `x509.NewCertPool().AppendCertsFromPEM(...)` and set `tls.Config.RootCAs` Self-signed certificates: import the cert into the OS trust chain rather than disabling verification per-call.

Evidence

recovery: 'NCBI is degraded; retry in a few minutes.' },

  ],

  async handler(input, ctx) {

    return { articles: await ncbi.fetch(input.pmids, ctx) };  // throws bubble unchanged

  },

});

```

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

**Skip the contract** for one-off internal tools or quick prototypes — `ctx` is plain `Context` (no `fail`) and you throw via [factories](#error-factories-fallback) directly. Behavior is identical at the wire; the contract just adds compile-time safety.

> **Limits of the conformance lint.** The conformance and prefer-fail rules scan the handler's source text for `throw` statements. Errors thrown from called services (e.g. `await myService.fetch()` raising `RateLimited` internally) are invisible

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

async handler(input, ctx) {

  if (queue.full()) throw rateLimited('Queue at capacity');

  const items = await fetch(input.ids);

  if (items.length === 0) throw notFound(`No items match ${input.ids.length} IDs`);

  return { items };

}

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

import { serviceUnavailable } from '@cyanheads/mcp-ts-core/errors';

export class NcbiService {

  async fetch(pmids: string[], ctx: Context) {

    const response = await fetchWithRetry(...);

    if (!response.ok) {

      throw serviceUnavailable(`NCBI returned HTTP ${response.status}`, {

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

- **Logic throws, framework catches.** Tool/resource handlers are pure — throw on failure, no `try/catch`. Plain `Error` is fine; the framework catches, classifies, and formats. Use error factories (`notFound()`, `validationError()`, etc.) when the error code matters.

- **Use `ctx.log`** for request-scoped logging. No `console` calls.

- **Check `ctx.elicit`** for presence before calling — used by `obsidian_delete_note` to confirm destructive ops.

- **All Obsidian access goes through `getObsidian

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

#### Service-layer throws

API-wrapping tools usually delegate to a service: `await ncbi.fetch(input, ctx)`. The throw lives in the service, not the handler. Services accept `ctx` (the unified Context) so they can call `ctx.log`, `ctx.recoveryFor`, etc. The handler doesn't catch — it just bubbles, and the framework's auto-classifier preserves `data` on the wire.

The contract entry on the tool and the `data: { reason }` on the service throw need to use the **same reason string** so the two sides

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// Works with both async and sync functions

const result = await ErrorHandler.tryCatch(

  () => externalApi.fetch(url),

  {

    operation: 'ExternalApi.fetch',

    context: { url },

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// wire so format()-only clients see the hint mirrored into content[] text.

    if (queue.full()) throw ctx.fail('queue_full', undefined, { ...ctx.recoveryFor('queue_full') });

    const articles = await fetch(input.pmids);

    if (articles.length === 0) {

      // Dynamic recovery — interpolate runtime context, override the contract default.

      throw ctx.fail('no_pmid_match', `No data for ${input.pmids.length} PMIDs`, {

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

],

  async handler(input, ctx) {

    const articles = await ncbi.fetch(input.pmids);

    if (articles.length === 0) {

      throw ctx.fail('no_match', `None of ${input.pmids.length} PMIDs returned data`);

    }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

output: z.object({ items: z.array(ItemSchema).describe('Resolved items') }),

  async handler(input, ctx) {

    if (queue.full()) throw ctx.fail('queue_full');

    const items = await fetch(input.ids);

    if (items.length === 0) throw ctx.fail('no_match', `No items match ${input.ids.length} IDs`, { ids: input.ids });

    // ctx.fail('typo')   ← TypeScript error: 'typo' isn't in the contract

    return { items };

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

- Tool / resource / prompt **descriptions** templated from runtime data? Static strings are safer; templated descriptions enable "tool poisoning" (adversarial metadata steering the LLM toward a dangerous tool).

- Descriptions mutated mid-session? Rug-pull surface: client approved the v1 description, server now advertises v2 behavior.

**Smell:** `return { body: await fetch(url).then(r => r.text()) }` rendered directly in `format()`. Or: `description: \`Look up ${tenant.customLabel}\`` where `cus

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

),

  }),

  output: z.object({

    path: z.string().describe('Resolved vault-relative path of the note.'),

    section: SectionSchema.describe('Echoed section locator.'),

    operation: z

      .enum(['append', 'prepend', 'replace'])

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

'Open a file in the Obsidian app UI. By default fails when the path does not exist; the `failIfMissing` flag controls the open-or-create behavior.',

  annotations: { openWorldHint: true },

  input: z.object({

    path: z.string().min(1).describe('Vault-relative path of the file to open.'),

    failIfMissing: z

      .boolean()

      .default(true)

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

.describe('Replacements to apply in array order over the evolving content.'),

  }),

  output: z.object({

    path: z.string().describe('Resolved vault-relative path of the note.'),

    totalReplacements: z

      .number()

      .describe('Total number of substitutions applied across all replacement entries.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

target: TargetSchema.describe('Which note to delete.'),

  }),

  output: z.object({

    path: z.string().describe('Resolved vault-relative path of the deleted note.'),

    deleted: z.boolean().describe('True when the file was removed.'),

  }),

  auth: ['tool:obsidian_delete_note:write'],

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            operation: z.literal('list').describe('Echoed operation.'),

            path: z.string().describe('Resolved vault-relative path.'),

            tags: z

              .object({

                frontmatter: z.array(z.string()).describe('Tags from frontmatter `tags:` array.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

),

  }),

  output: z.object({

    path: z.string().describe('Resolved vault-relative path of the note.'),

    sectionTargeted: z

      .boolean()

      .describe('True when the append went to a section; false for whole-file appends.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            operation: z.literal('set').describe('Echoed operation.'),

            path: z.string().describe('Resolved vault-relative path.'),

            key: z.string().describe('Echoed frontmatter key.'),

            frontmatter: z

              .record(z.string(), z.unknown())

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

.describe('Command ID, e.g. "editor:save-file". Use obsidian_list_commands to discover.'),

  }),

  output: z.object({

    commandId: z.string().describe('Echoed command ID.'),

    executed: z.boolean().describe('True when the upstream POST returned successfully.'),

  }),

  auth: ['tool:obsidian_execute_command:admin'],

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            operation: z.literal('remove').describe('Echoed operation.'),

            path: z.string().describe('Resolved vault-relative path.'),

            applied: z.array(z.string()).describe('Tags actually changed by this call.'),

            skipped: z.array(z.string()).describe('Tags absent from the targeted location(s).'),

            tags: z.array(z.string()).describe('All tags on the note after the change.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

path: z.string().min(1).describe('Vault-relative path of the note, including extension.'),

  }),

  output: z.object({

    path: z.string().describe('Vault-relative path of the note.'),

    content: z.string().describe('Raw markdown body.'),

    frontmatter: z

      .record(z.string(), z.unknown())

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

.describe('Open in a new leaf (split pane) instead of the active one.'),

  }),

  output: z.object({

    path: z.string().describe('Resolved vault-relative path that was opened.'),

    opened: z.boolean().describe('True when the open call succeeded.'),

    createdIfMissing: z

      .boolean()

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            operation: z.literal('add').describe('Echoed operation.'),

            path: z.string().describe('Resolved vault-relative path.'),

            applied: z.array(z.string()).describe('Tags actually changed by this call.'),

            skipped: z

              .array(z.string())

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

description: `List notes and subdirectories at a vault path. Defaults to vault root when \`path\` is omitted. Walks the directory tree up to \`depth\` levels (default ${DEFAULT_DEPTH} — top-level entries plus their immediate children, a structural overview; max ${MAX_DEPTH}). Pass \`depth: 1\` for a flat single-directory listing, or bump higher to walk deeper. Optional \`extension\` and \`nameRegex\` filters apply across the whole walk. Returns flat \`entries[]\` (each with \`path\`, \`type\`, o

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            format: z.literal('section').describe('Echoed format discriminator.'),

            path: z.string().describe('Resolved vault-relative path of the note.'),

            section: SectionSchema.describe('Echoed section locator.'),

            valueText: z

              .string()

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

'A note in the Obsidian vault. Returns the parsed NoteJson — content, frontmatter, tags, and stat — so clients can attach a specific note to a conversation.',

  mimeType: 'application/json',

  params: z.object({

    path: z.string().min(1).describe('Vault-relative path of the note, including extension.'),

  }),

  output: z.object({

    path: z.string().describe('Vault-relative path of the note.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

const EntrySchema = z

  .object({

    path: z.string().describe('Vault-relative path of this entry.'),

    type: z

      .enum(['file', 'directory'])

      .describe('Whether this entry is a regular file or a subdirectory.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            operation: z.literal('delete').describe('Echoed operation.'),

            path: z.string().describe('Resolved vault-relative path.'),

            key: z.string().describe('Echoed frontmatter key.'),

            frontmatter: z

              .record(z.string(), z.unknown())

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            format: z.literal('full').describe('Echoed format discriminator.'),

            path: z.string().describe('Resolved vault-relative path of the note.'),

            content: z.string().describe('Raw markdown body.'),

            frontmatter: z

              .record(z.string(), z.unknown())

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

),

  }),

  output: z.object({

    path: z.string().describe('The directory listed (empty string for vault root).'),

    entries: z

      .array(EntrySchema)

      .describe('Entries in DFS order — top-level first, then descendants.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

```typescript

// Schema: keep permissive — accepts empty strings from form clients

input: z.object({

  query: z.string().describe('Search terms'),

  dateRange: z.object({

    minDate: z.string().describe('Start date (YYYY-MM-DD)'),

    maxDate: z.string().describe('End date (YYYY-MM-DD)'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            operation: z.literal('get').describe('Echoed operation.'),

            path: z.string().describe('Resolved vault-relative path.'),

            key: z.string().describe('Echoed frontmatter key.'),

            exists: z.boolean().describe('True when the key was present in the frontmatter.'),

            value: z.unknown().describe('Current value, or `null` when the key is absent.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

import { tool } from '@cyanheads/mcp-ts-core';

const myTool = tool('my_tool', {

  input: z.object({ query: z.string().describe('Search query') }),

  output: z.object({ result: z.string().describe('Search result') }),

  auth: ['tool:my_tool:read'],

  async handler(input, ctx) {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

),

  }),

  output: z.object({

    path: z.string().describe('Resolved vault-relative path of the note that was written.'),

    sectionTargeted: z

      .boolean()

      .describe('True when only a section was replaced; false for full-file writes.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            format: z.literal('content').describe('Echoed format discriminator.'),

            path: z.string().describe('Resolved vault-relative path of the note.'),

            content: z.string().describe('Raw markdown body.'),

          })

          .describe('Content-only projection.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

z

          .object({

            format: z.literal('document-map').describe('Echoed format discriminator.'),

            path: z.string().describe('Resolved vault-relative path of the note.'),

            headings: z.array(z.string()).describe('All headings in document order.'),

            blocks: z.array(z.string()).describe('All block reference IDs.'),

            frontmatterFields: z.array(z.string()).describe('All frontmatter field keys.'),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract