Skip to content

fetch: map Pydantic ValidationError to INVALID_PARAMS; add robots.txt timeout; tests - #4599

Closed
eltypical wants to merge 3 commits into
modelcontextprotocol:mainfrom
eltypical:fix-validate-args-and-timeout
Closed

fetch: map Pydantic ValidationError to INVALID_PARAMS; add robots.txt timeout; tests#4599
eltypical wants to merge 3 commits into
modelcontextprotocol:mainfrom
eltypical:fix-validate-args-and-timeout

Conversation

@eltypical

@eltypical eltypical commented Jul 31, 2026

Copy link
Copy Markdown

Problem

  • Tool invocation path (call_tool) only caught ValueError when parsing arguments into the Fetch pydantic model. On pydantic>=2, invalid/missing inputs raise ValidationError which does not inherit from ValueError, bubbling up as unhandled exceptions, violating MCP error contract and causing integrity failures in multi-tenant tool pipelines.
  • robots.txt fetch in check_may_autonomously_fetch_url had no explicit timeout, risking event-loop starvation / availability loss when upstream hosts hang.

Fix

  • Add parse_fetch_args() helper wrapping Fetch(**arguments) and catching ValidationError, re-raising McpError(ErrorData(code=INVALID_PARAMS, ...)).
  • Use parse_fetch_args in call_tool; preserve explicit URL-blank guard.
  • Add timeout=15 to robots.txt GET call.

Tests

  • New TestArgumentParsing::test_parse_fetch_args_maps_validation_error asserts INVALID_PARAMS mapping for missing required fields.
  • New TestCheckMayAutonomouslyFetchUrl::test_robots_fetch_has_timeout verifies timeout kwarg passed to httpx.AsyncClient.get("/robots.txt", ..., timeout=15).

Security/Resilience Impact

  • CIA: Integrity improved by ensuring invalid input never contaminates execution path; Availability improved with bounded robots.txt fetch.

Signed-off-by: Kiell Tampubolon yeheskieltampubolon@gmail.com

eltypical added 2 commits July 31, 2026 10:31
@eltypical
fetch/server: catch Pydantic ValidationError on input parsing and fac…
ab62677 
…tor parse helper; add robots.txt timeout

call_tool previously caught ValueError only, but pydantic>=2 raises ValidationError on model construction. That propagated as an unhandled exception instead of standardized INVALID_PARAMS.

- Add parse_fetch_args() catching ValidationError and raising McpError(INVALID_PARAMS)
- Use helper in call_tool
- Add timeout=15 to robots.txt fetch to avoid hanging on slow sites

Signed-off-by: Kiell Tampubolon <yeheskieltampubolon@gmail.com>
@eltypical
tests(fetch): add regression tests for ValidationError mapping and ro…
eee7f22 
…bots.txt timeout

- Simulate pydantic ValidationError on Fetch construction and assert INVALID_PARAMS via McpError
- Ensure robots.txt fetch passes timeout to AsyncClient.get

Signed-off-by: Kiell Tampubolon <yeheskieltampubolon@gmail.com>
Copilot AI review requested due to automatic review settings July 31, 2026 02:32
Copilot AI reviewed Jul 31, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@eltypical
fetch: fix robots.txt can_fetch argument order (user_agent, url)
5264af6 
Protego.can_fetch expects (user_agent, url). Passing (url, user_agent) could allow or deny erroneously under certain robots.txt, causing CI test failures in the fetch server package.

Also retains explicit 15s timeout for robots.txt preflight and centralized Pydantic ValidationError→MCP INVALID_PARAMS mapping.

Signed-off-by: Kiell Tampubolon <113831023+eltypical@users.noreply.github.com>
@cliffhall cliffhall added the closed-superseded-v2 Closed: fixed or made obsolete by the v2 / 2026-07-28 refactor (#4875) label Oct 20, 2026
@cliffhall

cliffhall commented Oct 20, 2026

Copy link
Copy Markdown
Member

Thank you for this pull request, and apologies for the long wait for a response.

Since it was opened, the reference servers have been rebuilt for the 2026-07-28 MCP specification (#4857) and released as v2 (2.0.0 on npm for the TypeScript servers, 2026.10.19 on PyPI for the Python servers). The code this PR changes has been replaced, and the behavior it addresses has either been fixed in v2 or no longer exists in the same form.

This is not a judgment on the change or on you; it's a consequence of the code it targets having been replaced. If the problem still happens on v2, please open a fresh issue with the version you're running and steps to reproduce. Note that this repository now accepts contributions as issues rather than pull requests from anyone but its maintainers; see CONTRIBUTING.md.

This is part of the backlog triage in #4875.

@cliffhall cliffhall closed this Oct 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

closed-superseded-v2 Closed: fixed or made obsolete by the v2 / 2026-07-28 refactor (#4875)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@eltypical @cliffhall