Skip to content

FUZZ-003: Invalid tool arguments are not accepted as a success

Severity Applies to Spec section
warn both eras, stdio, http 2026-07-28/server/tools#security-considerations

Judged from the FUZZ-001 traffic. Servers MUST validate all tool inputs, so arguments that fail the tool's own inputSchema should not come back as a successful result (isError absent or false). A warning rather than an error because lenient servers that coerce, say, "5" to 5 are common and often harmless; the fix is either to validate, or to widen the schema to what the tool really accepts. The failing input is shrunk and saved for mcpprobe replay.

From the command line: mcpprobe checks explain FUZZ-003. To leave it out of a run, add "FUZZ-003" to [checks] disable in mcpprobe.toml; to change how much it counts, use severity_overrides.