SEC-002: Errors carry no stack traces

Severity	Applies to	Spec section
warn	both eras, stdio, http	2026-07-28/server/tools#security-considerations

Sends requests that should fail (an unknown method, an unknown tool, an invalid cursor, and for up to five tools that may be called a call with no arguments and one with arguments of the wrong type), then looks for stack traces in JSON-RPC error messages and data and in tool results marked isError: Python tracebacks and frames, JavaScript, Java and .NET stack frames, Go and Rust panics. Servers MUST validate all tool inputs and sanitize tool outputs; a stack trace shows the input reached code that did not expect it and tells an attacker about the server's internals. A heuristic, so a warning; patterns match only well-formed frames. Tools are called only under the usual safety rules. Runs once per server.

From the command line: mcpprobe checks explain SEC-002. To leave it out of a run, add "SEC-002" to [checks] disable in mcpprobe.toml; to change how much it counts, use severity_overrides.