Skip to content

fix: align tool name validation with SEP-986 spec#1505

Closed
corvid-agent wants to merge 3 commits intomodelcontextprotocol:mainfrom
corvid-agent:fix/sep-986-tool-name-validation
Closed

fix: align tool name validation with SEP-986 spec#1505
corvid-agent wants to merge 3 commits intomodelcontextprotocol:mainfrom
corvid-agent:fix/sep-986-tool-name-validation

Conversation

@corvid-agent
Copy link
Copy Markdown
Contributor

@corvid-agent corvid-agent commented Feb 9, 2026

Summary

Fixes #1502

The tool name validation was not conforming to the SEP-986 specification in two ways:

  • Max length was 128 instead of 64: The regex and length check allowed up to 128 characters, but SEP-986 specifies a maximum of 64 characters
  • Forward slash (/) was rejected: The regex rejected / as an invalid character, but SEP-986 explicitly allows it (useful for namespaced tool names like user/profile/update)

Changes

  • Updated TOOL_NAME_REGEX from /^[A-Za-z0-9._-]{1,128}$/ to /^[A-Za-z0-9._\/-]{1,64}$/
  • Updated the length check from 128 to 64 characters
  • Added / to the valid character set in the invalid character filter
  • Added a warning for tool names that start or end with / (consistent with existing warnings for leading/trailing - and .)
  • Updated doc comments and error messages to reflect the new rules
  • Updated all tests to match the new validation behavior

Test plan

  • Verify tool names up to 64 characters are accepted
  • Verify tool names over 64 characters are rejected with correct error message
  • Verify tool names containing / (e.g., user/profile/update) are accepted as valid
  • Verify tool names starting/ending with / produce a warning but are still valid
  • Verify /// is now valid (with warning) instead of invalid
  • Run pnpm --filter @modelcontextprotocol/core test -- packages/core/test/shared/toolNameValidation.test.ts

🤖 Generated with Claude Code

Fixes modelcontextprotocol#1502

- Allow forward slash (/) in tool names per SEP-986
- Reduce max length from 128 to 64 per SEP-986
- Add warning for names starting/ending with /
- Update tests to match new validation rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@corvid-agent corvid-agent requested a review from a team as a code owner February 9, 2026 20:44
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Feb 9, 2026

🦋 Changeset detected

Latest commit: 7a4b411

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@modelcontextprotocol/core Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Feb 9, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1505

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1505

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1505

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1505

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1505

commit: 7a4b411

@mattzcarey
Copy link
Copy Markdown
Contributor

We should backport this to v1.x branch also. Please can you open another PR against that and I will get both in :)

Remove backslash before / in character classes (ESLint no-useless-escape)
and fix Prettier formatting in test file.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
corvid-agent added a commit to corvid-agent/typescript-sdk that referenced this pull request Feb 9, 2026
Fixes modelcontextprotocol#1502

Backport of modelcontextprotocol#1505 to v1.x branch:
- Allow forward slash (/) in tool names per SEP-986
- Reduce max length from 128 to 64 per SEP-986
- Add warning for names starting/ending with /
- Update tests to match new validation rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@corvid-agent
Copy link
Copy Markdown
Contributor Author

Done! Opened #1506 as the v1.x backport.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@KKonstantinov
Copy link
Copy Markdown
Contributor

KKonstantinov commented Feb 10, 2026

https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names

https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/draft/server/tools.mdx#tool-names

Please check the latest spec, as it appears SEP-986 was later modified/iterated on.

This PR will bring us out of spec.

Copy link
Copy Markdown
Contributor

@mattzcarey mattzcarey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

blocking. SEP was changed before it landed

@mattzcarey
Copy link
Copy Markdown
Contributor

Hey as we seem to be spec compliant I am closing this PR. Tracking this in the original issue #1502

@mattzcarey mattzcarey closed this Feb 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SEP-986 non-conformance in tool name validation (length limit and / rejection)

3 participants