LOW SEVERITYCONFIRMED
validate_and_warn_tool_name return value ignored — invalid names register without error
Package
mcp
Version
1.26.0
Verified
2026-03-28
Description
mcp's `Tool.from_function()` calls `validate_and_warn_tool_name(func_name)` but ignores its boolean return value. The validator returns `False` for names containing `<>`, spaces, null bytes, or names exceeding 128 characters, but registration proceeds regardless. Tools with names containing null bytes or angle brackets can appear in the tool listing sent to clients and may break downstream JSON schema parsers or LLM tokenizers.
Reproduction
from mcp.server.fastmcp.tools.base import Tool
from mcp.shared.tool_name_validation import validate_and_warn_tool_name
def fn(x: str) -> str: return x
for bad_name in ['<script>', 'IGNORE PREVIOUS', 'tool\x00null', 'a' * 200]:
result = validate_and_warn_tool_name(bad_name) # returns False
tool = Tool.from_function(fn, name=bad_name) # succeeds anyway
assert tool.name == bad_name # registered with invalid name