Skip to content

git tools crash stdio transport on extra_param and very_long_string input #4754

Description

@SMWundefined

When an MCP client sends edge-case inputs to git tools (git_status, git_log, git_diff),
two input patterns crash the stdio transport entirely instead of returning an error response:

  1. An extra undeclared parameter (e.g. {"repo_path": "...", "unexpected_field": "value"})
  2. A very long string value (10,000+ characters)

Both cause the connection to drop. The client receives no error response — the transport dies.

These inputs are realistic: LLM agents routinely hallucinate extra parameters or generate
overly long argument values. This is normal traffic, not adversarial input.

Reproduction:

pip install ratemyagent
ratemyagent scan --target mcp \
  --uri "stdio://uvx mcp-server-git --repository /path/to/any/repo" \
  --tool git_log --tool-args '{"repo_path": "/path/to/any/repo"}' \
  --probes contract --requests 5

Result: Contract probe reports 6/18 edge cases crashed the transport.
Expected: Invalid input should return a JSON-RPC error response, not crash the connection.

Tested against mcp-server-git 2026.8.18, mcp SDK 1.x, Python 3.12, macOS arm64.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions