BeamMCP accepted tool arguments that contradicted nested advertised schemas

BeamMCP advertised JSON-schema-like constraints in its tool catalog, but its call validator covered selected keywords only on the top-level argument object. An agent or hostile caller could send a nested enum violation, extra property or invalid array member that appeared forbidden to the model but would reach tool dispatch. The presence of a documented schema thus did not guarantee enforcement at the actual call boundary.

The September 26 maintainer advisory identifies 0.10.1 as patched. That version recursively checks supported keywords and refuses schemas containing unsupported constructs at catalog startup. This makes the security change potentially breaking for integrations that depended on previously advertised but ignored oneOf, anyOf or $ref constraints. The advisory does not identify any live exploitation campaign.

The patch changes both validation and startup semantics. A previously accepted tool definition using oneOf, anyOf or $ref may now stop the BeamMCP server from constructing its catalog, rather than merely reject an unsafe call. Operators therefore need two independent tests: invalid nested arguments must fail before dispatch, and all catalogued tools must still initialize under the supported schema subset. An argument that a model was shown a restrictive schema is not proof the server enforced it.