fix(core): unwrap double-wrapped object parameters from MCP SDK

[vinaygupta-sourcefuse]

Description

Support was previously limited to @get methods, and has now been extended to other HTTP methods in mcp-inspector.

While testing, an issue was identified with how the MCP SDK passes object parameters to tools. The SDK automatically introduces an extra layer of nesting, leading to double-wrapped inputs.

Screen.Recording.2026-04-20.at.7.21.55.PM.mov

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Intermediate change (work in progress)

Checklist:

• Performed a self-review of my own code
• npm test passes on your machine
• New tests added or existing tests modified to cover all changes
• Code conforms with the style guide
• API Documentation in code was updated
• Any dependent changes have been merged and published in downstream modules

[sonarqube-agent]

SonarQube Remediation Agent

SonarQube found 2 issues in this PR that the agent can fix for you. Est. time saved: ~15 min

2 issues found

• 🔴 Refactor this code to not nest more than 3 if/for/while/switch/try statements. — mcp-server-factory.service.ts:53
• 🟠 No magic number: 3. — mcp-tool.integration.ts:153

• Run Remediation Agent
  Select the checkbox above to enable this action.

View Project in SonarCloud

💡 Got issues in your backlog? Let the agent fix them for you.

[sonarqubecloud]

SonarQube reviewer guide

Summary: Comprehensive documentation update for the loopback4-mcp extension, adding detailed integration guides, practical examples, troubleshooting, and test improvements for parameter handling.

Review Focus: The README expansion is substantial (~500 new lines) covering integration steps, hook configuration, controller examples with auth/authz, MCP endpoint usage, and parameter decorator guidelines. Ensure the documented patterns (particularly the multi-decorator stacking with @authorize, @authenticate, @mcpTool, and REST decorators) align with actual implementation. The test additions for parameter unwrapping logic should be verified against the factory service changes—specifically the double-wrapping detection pattern that unwraps {key: {key: value}} to {key: value}. Minor dependency updates (loopback4-soft-delete, jsonfile) appear safe but unrelated to core functionality.

Start review at: README.md (sections "Integration Steps" through "Parameter Decorator Guidelines"). This is the foundation for understanding the intended usage patterns. Cross-reference the McpServerFactory parameter unwrapping logic with the documented examples to confirm the documented patterns produce expected results, especially for complex object parameters in MCP requests.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[yeshamavani]

🎉 This PR is included in version 1.0.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀