apache / apache/shenyu

[BUG] McpOpenApiGenerator throws ArrayIndexOutOfBoundsException when `@OpenAPIDefinition.servers()` is empty (the default)

Open Beginner friendly
#6,666 1 comment 0 reactions 0 assignees View on GitHub
feature: plugin priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- Severity: High
- Location:
`shenyu-client/shenyu-client-mcp/shenyu-client-mcp-common/src/main/java/org/apache/shenyu/client/mcp/generator/McpOpenApiGenerator.java:51`
-
Description:
Line 51 does `server.addProperty(OPEN_API_SERVER_URL_KEY, definition.servers()[0].url());` with no length check. `@ShenyuMcpTool.definition()` defaults to `@OpenAPIDefinition`, whose `servers()` defaults to `{}` (empty). The sibling method `McpServiceEventListener.buildApiSuperPath` (`:306-309`) explicitly handles `servers.length == 0` by returning `""`, so the empty-servers case is both reachable and anticipated — yet `generateOpenApiJson` was not given the same guard. A bare `@ShenyuMcpTool` on a controller class uses the empty default; `generateOpenApiJson` is reached via `buildMcpToolsRegisterDTO` → `McpServiceEventListener.handleMethod` whenever `superPath` does not contain `"*"` (the common case), and crashes immediately.
-
Impact:
Any MCP controller using `@ShenyuMcpTool` without explicitly declaring `@OpenAPIDefinition(servers = {@Server(url=...)})` crashes at context refresh with `ArrayIndexOutOfBoundsException`, making the MCP client unusable in its default-annotation form.
-
Suggested fix:
Guard `definition.servers()` for emptiness in `generateOpenApiJson` (skip the server block or throw a descriptive `IllegalArgumentException`), mirroring `buildApiSuperPath`.
-
Confidence: High
- Related existing: none — #6113/6117/6134 cover other MCP tool issues.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-client/shenyu-client-mcp/shenyu-client-mcp-common/src/main/java/org/apache/shenyu/client/mcp/generator/McpOpenApiGenerator.java at line 51, then compare it with McpServiceEventListener.buildApiSuperPath around lines 306-309. Trace the buildMcpToolsRegisterDTO to handleMethod path for a bare @ShenyuMcpTool. Done means the empty default servers array no longer causes ArrayIndexOutOfBoundsException and the chosen behavior is covered by the relevant MCP checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.