antvis / antvis/mcp-server-chart
All 27 tools crash (not a structured error) on missing-required or wrong-type input
- Dominant language
- TypeScript
- Stars
- 4.4k
- Forks
- 417
- Avg merge
- 5d 16h
- Merged PRs (30d)
- 1
Description
## Summary
All 27 generation tools (`generate_bar_chart`, `generate_line_chart`, `generate_pie_chart`, etc. — full list below) return a raw internal error instead of a clean, structured MCP tool error when called with realistic bad input: a missing required field, or a field of the wrong type. These are exactly the kinds of mistakes a real LLM agent can make (a hallucinated missing or wrong-typed argument), not edge-case or adversarial input.
Found with [mcp-fuzz](https://github.com/vishalhabib99/mcp-fuzz), a tool that calls each of a server's tools with inputs derived from its own declared JSON schema and checks whether the server handles missing-required/wrong-type cases with a structured error rather than crashing. Across all 27 tools: 133 of 214 such calls came back as a raw internal exception (JSON-RPC `-32603`) rather than a graceful tool-level error.
## Reproduction (generate_bar_chart)
- Omit the required `data` array entirely →
```
Failed to generate chart: Cannot read properties of null (reading 'map')
```
- Pass `data` as the wrong type (e.g. a number instead of an array) →
```
Failed to generate chart: e.map is not a function
```
- Pass `width`/`height` as the wrong type →
```
Failed to generate chart: Cannot read properties of null (reading '0')
Failed to generate chart: the surface type is not appropriate for the operation
```
- Pass `title` as the wrong type →
```
Failed to generate chart: Request failed with status code 500
```
(this one crashes a downstream call to what looks like a remote rendering API)
## Why this looks like a shared root cause, not 27 separate bugs
The error messages are nearly identical across every affected tool for the same parameter:
- Every tool's `width`/`height` wrong-type case fails with the same "Cannot read properties of null (reading '0')" / "the surface type is not appropriate for the operation" pair.
- Every tool's missing/wrong-typed `data` case fails with the same shape of error (`.map is not a function`, `Cannot read properties of undefined/null (reading 'map'/'length')`, or `i is not iterable`/`a.map is not a function` for chart types with different data shapes).
- Several tools' wrong-typed `title` case fails the same way with an HTTP 500 from what appears to be a shared remote rendering call.
This suggests the fix is likely concentrated in a small number of shared code paths (common width/height handling, a common data-shape check before rendering, and the shared remote-render request builder) rather than requiring 27 independent per-tool fixes.
## Affected tools (27/27 tested)
`generate_area_chart`, `generate_bar_chart`, `generate_boxplot_chart`, `generate_column_chart`, `generate_district_map`, `generate_dual_axes_chart`, `generate_fishbone_diagram`, `generate_flow_diagram`, `generate_funnel_chart`, `generate_histogram_chart`, `generate_line_chart`, `generate_liquid_chart`, `generate_mind_map`, `generate_network_graph`, `generate_organization_chart`, `generate_path_map`, `generate_pie_chart`, `generate_pin_map`, `generate_radar_chart`, `generate_sankey_chart`, `generate_scatter_chart`, `generate_spreadsheet`, `generate_treemap_chart`, `generate_venn_chart`, `generate_violin_chart`, `generate_waterfall_chart`, `generate_word_cloud_chart`
## Environment
- Package: `@antv/mcp-server-chart@0.9.10`
- Run via `npx -y @antv/mcp-server-chart` over stdio
- Detected with `mcp-fuzz --timeout 15 -- npx -y @antv/mcp-server-chart`
Happy to share the full raw report (all 214 calls, JSON) if useful — didn't want to paste the whole thing here. Not opening a PR for this unprompted since I haven't traced the shared code paths myself yet, but glad to take a pass at it if that would help.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running the reported mcp-fuzz command against @antv/mcp-server-chart and reproduce the generate_bar_chart cases for missing or wrong-typed data, width, height, and title. Trace the shared tool input and rendering request paths across the listed 27 generation tools. Done means these invalid inputs return structured MCP tool errors instead of raw JSON-RPC -32603 exceptions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100