anomalyco / anomalyco/opencode

MCP/schema: validation hardening + anchor-form $ref retention (PR #48638 series)

Open
#49,978 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
209k
Forks
27.5k
PR merge metrics
PR metrics pending

Description

Context

Part of the fork hardening series proposed in #48638 (branch session-diff-events). Tracker: #49565.

Problem

MCP tool-schema handling: prototype-pollution-prone maps, missing dialect/URN/anchor validation, duplicate anchors, hostile-shape compilation, dangling $ref pruning that also dropped resolvable anchor-form refs, and a hotfix for invalid recursive-schema placeholders (required:{} / empty combinators) that could brick tool schemas.

Change set (commit list, incl. catalog halves of mixed commits)
  • 6db8ab6748 mcp schema hotfix
  • 02750b7401 wave E schema
  • b1f1a08bf2 wave C schema
  • 0edfce0205 wave J-C catalog anchor+regex
  • 2b95854ed3 wave M-C catalog ref
  • (catalog halves of 1ee7d234ec / 88777b8591 to be split for clean stacks)
Validation
  • Null-prototype maps, dialect/URN/anchor validation, duplicate-anchor removal; anchor-form $ref retained iff resolvable in same resource, dangling pruned; all corpora compile under ajv; catalog suite 32/0; mock capture: 0 required:{}, 0 empty combinators.

Linked: PR #48638 · tracker #49565 · sibling tracking issues listed in a follow-up comment.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the commits listed in the issue and the linked PR #48638, then review tracker #49565 and the follow-up comment for scope. Validate the MCP schema changes against the stated criteria: catalog suite 32/0, all corpora compile under ajv, resolvable anchor-form refs are retained, and mock capture reports no invalid required objects or empty combinators.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.