modelcontextprotocol / modelcontextprotocol/php-sdk
One placeholder-less resource template makes the whole server unserviceable
Nadie ha tomado este issue todavía.
- Lenguaje dominante
- PHP
- Estrellas
- 1.6k
- Forks
- 173
- Merge medio
- 2 d 49 min
- PR fusionados (30 d)
- 23
Descripción
Reported by Mariano Damian Ferro Villanueva via email, opening it here on their behalf.
Problem
A #[McpResourceTemplate] whose uriTemplate contains no placeholder takes the whole server down, not just that one template.
#[McpResourceTemplate(
uriTemplate: 'data://tags',
name: 'all_tags',
title: 'All Tags',
description: 'All Tags',
mimeType: 'application/json'
)]
public function tag_all(?int $paged = 1): array
{
// ...
}
The handshake still succeeds, and then every request fails, including ones that have nothing to do with resources:
tools/list -> {"jsonrpc":"2.0","id":2,"error":{"code":-32602,"message":"Error registering manual resource template 'data://tags': Invalid URI template : \"data://tags\" must be a valid URI template with at least one placeholder."}}
tools/call -> {"jsonrpc":"2.0","id":3,"error":{"code":-32602,"message":"Error registering manual resource template 'data://tags': Invalid URI template : \"data://tags\" must be a valid URI template with at least one placeholder."}}
Reproduced on main against Server::builder() with the Streamable HTTP transport, on both the handshake and the 2026-07-28 lifecycle.
Cause
ResourceTemplate::__construct()requires at least one placeholder and throws (src/Schema/ResourceTemplate.php#L59-L61).ReflectedElementLoaderwraps that into aConfigurationException(ReflectedElementLoader.php#L214-L219), which abortsRegistry::load()before any element is registered.Builder::$lazyLoadingdefaults totrue, so that load runs on the first read during request handling.Registry::load()setsloadedonly on success, so every subsequent request retries and fails the same way.
So one misconfigured element is enough to make a server serve nothing, and the client is told -32602 (Invalid params) for what is a server-side configuration error it cannot do anything about.
The original report saw it as a 500 with Cannot modify header information - headers already sent (output started at /vendor/symfony/http-foundation/Response.php:393), which is how it surfaces once the response is already being written. I could not reproduce that part on main, so treat it as a symptom of the surrounding stack rather than part of this issue.
Secondary issue: inconsistent handling
The same mistake behaves differently depending on the registration path:
ReflectedElementLoaderthrowsConfigurationException, a hard failure taking down the registry.Discoverer::processFile()catches\Throwable, logs it and continues, so an attribute-discovered template with the same mistake is silently dropped.
Suggested fix
Validate the URI template in Builder::addResourceTemplate(), where the developer wrote it, instead of at the first read of the registry. PR follows.
Worth considering separately: a ConfigurationException reaching a client as -32602 is misleading (it is caught by catch (\InvalidArgumentException) in Protocol), and a single failing element aborting the whole registry load is a large blast radius for any other configuration mistake.
Line references are against main.
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Línea de trabajo
Comienza con Builder::addResourceTemplate(), luego lee ResourceTemplate.php y ReflectedElementLoader.php para entender dónde se rechaza actualmente la URI no válida. Sigue Registry::load() y la ruta de carga diferida para confirmar el momento en que se produce el fallo. Se considera terminado cuando una plantilla sin placeholders se rechaza durante el registro en lugar de en la primera solicitud, sin impedir que se registren elementos válidos.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- php
- Área
- backend-api-design
- Tipo de issue
- Error
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Estado de actividad
- Activo
- Claridad
- Bien especificado
- Aptitud para principiantes
- 72/100