Overbroad String Schema on Risky Field

What it is

An unconstrained string field in a tool's input schema imposes no validation on the values callers can supply. When that field carries a semantically dangerous name — command, sql, code, script, url, path, expr, eval — the absence of an enum, regex, or length bound means the field functions as an open injection surface. This is a specific instance of CWE-20 (Improper Input Validation) at the schema-definition layer, before any handler logic runs.

Why it matters for MCP

MCP tools are invoked by LLM agents that construct arguments programmatically from natural-language context, meaning adversarial content in the conversation can flow directly into tool parameters without a human review step. A loose schema signals to the framework — and to the model — that any value is acceptable, so prompt injection payloads or jailbreak-crafted arguments pass validation silently. Unlike a traditional REST endpoint where a human developer typically controls the request, MCP's tool-composition model means one tool's unconstrained output can become another tool's unconstrained input, cascading the risk across an entire agent pipeline.

Vulnerable example

import { z } from "zod";

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

const server = new McpServer({ name: "shell", version: "1.0.0" });

server.tool(

  "run_command",

  { command: z.string() },

  async ({ command }) => {

    const { stdout } = await import("node:child_process").then(m => m.execAsync(command));

    return { content: [{ type: "text", text: stdout }] };

  }

);

Secure example

import { z } from "zod";

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

const server = new McpServer({ name: "shell", version: "1.0.0" });

server.tool(

  "run_command",

  { command: z.enum(["git status", "ls", "df -h"]) },

  async ({ command }) => {

    const { stdout } = await import("node:child_process").then(m => m.execAsync(command));

    return { content: [{ type: "text", text: stdout }] };

  }

);

How MCPSafe detects this

MCPSafe performs taint-aware schema analysis, flagging any `z.string()` or `z.any()` node bound to an object key whose name matches the risky-field lexicon (command, query, sql, code, script, url, path, expr, eval) with no chained refinement calls (`.enum()`, `.regex()`, `.max()`, `.url()`, `.uuid()`). Fields whose key names do not appear in the risky-field list, and any string field that chains at least one constraining method, are explicitly excluded from the finding.

See the full threat catalog for every documented detection.

Further reading

• CWE-20: Improper Input Validation
• Zod Schema Validation — refinements and constraints
• OWASP Input Validation Cheat Sheet
• Model Context Protocol: Tool Definition Specification