refac: safer tool server handling

Author: tjbck

backend/open_webui/routers/tools.py

@@ -88,9 +88,15 @@ async def get_tools(
     # OpenAPI Tool Servers
     server_access_grants = {}
     for server in await get_tool_servers(request):
-        connection = request.app.state.config.TOOL_SERVER_CONNECTIONS[
-            server.get("idx", 0)
-        ]
+        server_idx = server.get("idx", 0)
+        connections = request.app.state.config.TOOL_SERVER_CONNECTIONS
+        if server_idx >= len(connections):
+            log.warning(
+                f"Tool server index {server_idx} out of range "
+                f"(have {len(connections)} connections), skipping server {server.get('id')}"
+            )
+            continue
+        connection = connections[server_idx]
         server_config = connection.get("config", {})
 
         server_id = f"server:{server.get('id')}"

backend/open_webui/utils/tools.py

@@ -275,11 +275,14 @@ async def get_tools(
                         continue
 
                     tool_server_idx = tool_server_data.get("idx", 0)
-                    tool_server_connection = (
-                        request.app.state.config.TOOL_SERVER_CONNECTIONS[
-                            tool_server_idx
-                        ]
-                    )
+                    connections = request.app.state.config.TOOL_SERVER_CONNECTIONS
+                    if tool_server_idx >= len(connections):
+                        log.warning(
+                            f"Tool server index {tool_server_idx} out of range "
+                            f"(have {len(connections)} connections), skipping server {server_id}"
+                        )
+                        continue
+                    tool_server_connection = connections[tool_server_idx]
 
                     # Check access control for tool server
                     if not has_connection_access(