modelcontextprotocol / modelcontextprotocol/typescript-sdk

Do not return and expose internal errors to the client as this is a security risk

Open
#1,429 3 comments 0 reactions 1 assignee View on GitHub

@felixweinberger is already working on this.

Since Apr 2, 2026.

bug fix proposed P2 ready for work
Dominant language
TypeScript
Stars
13.4k
Forks
2.2k
Avg merge
3d 15h
Merged PRs (30d)
4

Description

Describe the bug
Tools automatically catch, wrap and return errors as JSON-RPC responses to the consuming client.
This has the potential to reveal sensitive internal information of a back end system to the MCP Client and MCP Host.

Even if an error is harmless at the first glance, internal errors can reveal system behavior to an attacker and act as a measurement for attackers actions impact.

To Reproduce

  server.registerTool(
    "example-tool",
    {
      description:
        `Example tool that returns an potentially sensitive error to the client`,
    },
    async ({}): Promise<CallToolResult> => {

      throw new Error("Internal services not reachable fake error");

      return {
        content: [
          {
            type: "text",
            text: "This part is unreachable"
          }
        ],
      };
    }
  );

This automatically wraps into an JSON-RPC error which is returned to the client:

{
content: [
  0: {
    type: "text",
    text: "Internal services not reachable fake error "
   }
],
  isError: true
}

Expected behavior
Do not expose internal errors as responses. Error hard with "Unhandled exception".
Provide error helpers, so the developer can catch and wrap errors and return them to the client in a curated manner.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.