fix(mcp): reject malformed JSON-array tag strings in search_notes

strict_search_tags guarded native lists with non-string elements but still
delegated JSON-array strings directly to parse_tags, whose recursive JSON
handling stringified bad elements ('[42]' -> ["42"]) before Pydantic could
validate List[str] — preserving the silent no-result behavior for MCP
clients that serialize arrays as strings.

Mirror parse_tags' JSON-array detection at the boundary: if the parsed list
contains any non-string element, pass the original string through unchanged
so Pydantic rejects it with a clear validation error. Valid all-string JSON
arrays and plain comma strings keep working as before. parse_tags itself is
unchanged (frontmatter callers rely on its lenient behavior).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: phernandez <paul@basicmachines.co>

Author: phernandez

src/basic_memory/utils.py

@@ -576,9 +576,25 @@ def strict_search_tags(v: Any) -> Any:
     str, all-string lists, and None are valid tag inputs; everything else — including
     lists with non-string elements like [42] — passes through unchanged so Pydantic
     rejects it with a clear validation error.
+
+    JSON array strings (the MCP clients-serialize-arrays-as-strings path) get the same
+    all-string check: '[42]' or '["ok", 42]' would otherwise be stringified by
+    parse_tags' recursive JSON handling before Pydantic ever sees the bad elements.
     """
     if isinstance(v, list) and not all(isinstance(item, str) for item in v):
         return v
+    # Trigger: a str that looks like a JSON array, mirroring parse_tags' detection.
+    # Why: parse_tags recursively parses JSON arrays, stringifying non-string elements
+    #   ('[42]' -> ["42"]) and hiding the type error from Pydantic.
+    # Outcome: malformed arrays pass through unchanged so Pydantic rejects them; valid
+    #   all-string arrays and plain comma strings still delegate to parse_tags.
+    if isinstance(v, str) and v.strip().startswith("[") and v.strip().endswith("]"):
+        try:
+            parsed = json.loads(v)
+        except json.JSONDecodeError:
+            parsed = None
+        if isinstance(parsed, list) and not all(isinstance(item, str) for item in parsed):
+            return v
     if v is None or isinstance(v, (str, list)):
         return parse_tags(v)
     return v

tests/mcp/test_tool_search.py

@@ -1719,8 +1719,18 @@ def test_search_notes_tags_annotation_rejects_non_string_types():
     with pytest.raises(ValidationError):
         adapter.validate_python(["ok", 42])
 
-    # All-string lists remain valid.
+    # JSON-array strings with non-string elements must fail the same way — parse_tags
+    # would otherwise recursively stringify them before Pydantic validates List[str].
+    with pytest.raises(ValidationError):
+        adapter.validate_python("[42]")
+    with pytest.raises(ValidationError):
+        adapter.validate_python('[{"a": 1}]')
+    with pytest.raises(ValidationError):
+        adapter.validate_python('["ok", 42]')
+
+    # All-string lists and all-string JSON-array strings remain valid.
     assert adapter.validate_python(["a", "b"]) == ["a", "b"]
+    assert adapter.validate_python('["a","b"]') == ["a", "b"]
 
     # None stays a valid "no filter" input.
     assert adapter.validate_python(None) in (None, [])
@@ -1779,6 +1789,44 @@ async def test_search_notes_tags_invalid_type_rejected_via_mcp(mcp, client, test
                     "tags": ["ok", 42],
                 },
             )
+        # JSON-array strings with non-string elements (clients that serialize arrays as
+        # strings) must be rejected too, not recursively stringified by parse_tags.
+        with pytest.raises(ToolError):
+            await mcp_client.call_tool(
+                "search_notes",
+                {
+                    "project": test_project.name,
+                    "query": "anything",
+                    "tags": "[42]",
+                },
+            )
+        with pytest.raises(ToolError):
+            await mcp_client.call_tool(
+                "search_notes",
+                {
+                    "project": test_project.name,
+                    "query": "anything",
+                    "tags": '[{"a": 1}]',
+                },
+            )
+        with pytest.raises(ToolError):
+            await mcp_client.call_tool(
+                "search_notes",
+                {
+                    "project": test_project.name,
+                    "query": "anything",
+                    "tags": '["ok", 42]',
+                },
+            )
+        # Sanity: a valid all-string JSON-array string is still accepted.
+        await mcp_client.call_tool(
+            "search_notes",
+            {
+                "project": test_project.name,
+                "query": "anything",
+                "tags": '["a","b"]',
+            },
+        )
 
 
 @pytest.mark.asyncio

tests/test_coerce.py

@@ -73,6 +73,23 @@ def test_mixed_list_passthrough_for_pydantic_rejection(self):
         value = ["ok", 42]
         assert strict_search_tags(value) is value
 
+    def test_json_array_string_with_int_passthrough_for_pydantic_rejection(self):
+        """A JSON-array string with non-string elements must not be stringified."""
+        value = "[42]"
+        assert strict_search_tags(value) is value
+
+    def test_json_array_string_with_dict_passthrough_for_pydantic_rejection(self):
+        value = '[{"a": 1}]'
+        assert strict_search_tags(value) is value
+
+    def test_json_array_string_mixed_passthrough_for_pydantic_rejection(self):
+        """One bad element poisons the whole JSON-array string — no partial parse."""
+        value = '["ok", 42]'
+        assert strict_search_tags(value) is value
+
+    def test_json_array_string_all_strings_still_parses(self):
+        assert strict_search_tags('["a","b"]') == ["a", "b"]
+
 
 class TestCoerceDict:
     """Tests for coerce_dict."""