BeamMCP nested tool-schema enforcement GHSA-mrg2-4747-fmpw

Evidence record

Maintainer advisory documenting top-level-only validation before 0.10.1 and recursive validator plus incompatible-schema rejection.

Read the original source ↗

Claim-level citations (3)

• supportsBeamMCP accepted tool arguments that contradicted nested advertised schemas: BeamMCP before 0.10.1 advertised nested object and array constraints which tools/call did not enforce, allowing invalid nested values to reach dispatch.

  Impact: top-level type, required, additionalProperties and enum versus nested constraints

• supportsBeamMCP accepted tool arguments that contradicted nested advertised schemas: Version 0.10.1 recursively checks the supported schema subset and rejects unsupported keywords such as oneOf or $ref when loading the tool catalog.

  Description; Patches; Workarounds

• supportsBeamMCP accepted tool arguments that contradicted nested advertised schemas: The BeamMCP maintainer warns that 0.10.1 may reject tool catalogs at startup when they contain schema keywords outside the supported recursive subset, even when 0.10.0 accepted those catalogs.

  Description opening paragraph: BeamMCP.Server.new/1 raises for unsupported keywords; Patches