cleveragents/cleveragents-core

Fork 3

UAT: MCPServerConfig transport field accepts any string value without enum validation #5461

New issue

Open

opened 2026-04-09 06:55:23 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 06:55:23 +00:00

Owner

Bug Report

Feature Area: MCP Adapter — Server Configuration / Validation
Severity: Backlog — invalid transport values are silently accepted
Found by: UAT Testing (tool-router-mcp-adapter area)

What Was Tested

Code-level analysis of src/cleveragents/mcp/adapter.py — specifically the MCPServerConfig model (lines 51–72) and _validate_config (lines 200–217).

Expected Behavior (from spec)

The MCPServerConfig.transport field should only accept the three documented transport types: "stdio", "sse", and "streamable-http". Any other value should be rejected at construction time with a clear validation error.

Actual Behavior

The transport field is declared as str with no enum constraint:

transport: str = Field(..., description="Transport: stdio | sse | streamable-http")

The _validate_config method only validates that stdio requires command and sse/streamable-http require url. It does not validate that transport is one of the three allowed values:

@staticmethod
def _validate_config(config: MCPServerConfig) -> None:
    if config.transport == "stdio" and not config.command:
        raise ValueError(...)
    if config.transport in ("sse", "streamable-http") and not config.url:
        raise ValueError(...)
    # No check that transport is one of the three valid values!

This means MCPServerConfig(name="test", transport="websocket") is silently accepted, and the adapter will fail later with a confusing NotImplementedError (or no error at all if a transport override is provided).

Code Location

Bug: src/cleveragents/mcp/adapter.py, line 65 — transport: str should be Literal["stdio", "sse", "streamable-http"]
Bug: src/cleveragents/mcp/adapter.py, lines 200–217 — _validate_config doesn't validate transport value

Fix

Use a Literal type for the transport field:

from typing import Literal

transport: Literal["stdio", "sse", "streamable-http"] = Field(
    ..., description="Transport: stdio | sse | streamable-http"
)

Or add validation in _validate_config:

VALID_TRANSPORTS = {"stdio", "sse", "streamable-http"}
if config.transport not in VALID_TRANSPORTS:
    raise ValueError(
        f"MCPServerConfig '{config.name}': invalid transport '{config.transport}'. "
        f"Must be one of: {sorted(VALID_TRANSPORTS)}"
    )

Metadata

Commit Message: fix(mcp): validate MCPServerConfig transport field against allowed values
Branch: fix/mcp-server-config-transport-validation

Subtasks

Change transport field type to Literal["stdio", "sse", "streamable-http"] or add validator
Add unit test for invalid transport value rejection
Ensure existing tests still pass

Definition of Done

MCPServerConfig(name="test", transport="invalid") raises a ValidationError
All three valid transport values are accepted
All existing tests pass

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area:** MCP Adapter — Server Configuration / Validation **Severity:** Backlog — invalid transport values are silently accepted **Found by:** UAT Testing (tool-router-mcp-adapter area) ### What Was Tested Code-level analysis of `src/cleveragents/mcp/adapter.py` — specifically the `MCPServerConfig` model (lines 51–72) and `_validate_config` (lines 200–217). ### Expected Behavior (from spec) The `MCPServerConfig.transport` field should only accept the three documented transport types: `"stdio"`, `"sse"`, and `"streamable-http"`. Any other value should be rejected at construction time with a clear validation error. ### Actual Behavior The `transport` field is declared as `str` with no enum constraint: ```python transport: str = Field(..., description="Transport: stdio | sse | streamable-http") ``` The `_validate_config` method only validates that `stdio` requires `command` and `sse`/`streamable-http` require `url`. It does not validate that `transport` is one of the three allowed values: ```python @staticmethod def _validate_config(config: MCPServerConfig) -> None: if config.transport == "stdio" and not config.command: raise ValueError(...) if config.transport in ("sse", "streamable-http") and not config.url: raise ValueError(...) # No check that transport is one of the three valid values! ``` This means `MCPServerConfig(name="test", transport="websocket")` is silently accepted, and the adapter will fail later with a confusing `NotImplementedError` (or no error at all if a transport override is provided). ### Code Location - **Bug**: `src/cleveragents/mcp/adapter.py`, line 65 — `transport: str` should be `Literal["stdio", "sse", "streamable-http"]` - **Bug**: `src/cleveragents/mcp/adapter.py`, lines 200–217 — `_validate_config` doesn't validate transport value ### Fix Use a `Literal` type for the transport field: ```python from typing import Literal transport: Literal["stdio", "sse", "streamable-http"] = Field( ..., description="Transport: stdio | sse | streamable-http" ) ``` Or add validation in `_validate_config`: ```python VALID_TRANSPORTS = {"stdio", "sse", "streamable-http"} if config.transport not in VALID_TRANSPORTS: raise ValueError( f"MCPServerConfig '{config.name}': invalid transport '{config.transport}'. " f"Must be one of: {sorted(VALID_TRANSPORTS)}" ) ``` ### Metadata ``` Commit Message: fix(mcp): validate MCPServerConfig transport field against allowed values Branch: fix/mcp-server-config-transport-validation ``` ### Subtasks - [ ] Change `transport` field type to `Literal["stdio", "sse", "streamable-http"]` or add validator - [ ] Add unit test for invalid transport value rejection - [ ] Ensure existing tests still pass ### Definition of Done - `MCPServerConfig(name="test", transport="invalid")` raises a `ValidationError` - All three valid transport values are accepted - All existing tests pass --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 06:55:44 +00:00

HAL9000 added this to the v3.2.0 milestone

2026-04-09 06:59:19 +00:00

HAL9000 added

and removed

labels

2026-04-09 07:00:17 +00:00

HAL9000 commented

2026-04-09 07:00:45 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer

HAL9000 referenced this issue

2026-04-09 07:01:00 +00:00

[AUTO-PROJ-OWN] Project Owner Report (Cycle 26) #5296

HAL9000 added a new dependency

2026-04-09 07:02:53 +00:00

#4918 Implement concrete MCP transport layer (stdio) for tool discovery and invocation

HAL9000 referenced this issue

2026-04-09 07:13:39 +00:00

[AUTO-EPIC] Epic Planning Health Report (Cycle 11) #5298

HAL9000 referenced this issue

2026-04-09 07:51:09 +00:00

[AUTO-IMP-POOL] Implementation Pool Tracking (Cycle 1) #5618