fix: allow opting out of Mcp-Param-* validation (avoids a full tools/list per tools/call)

Closed
KA
16d ago
+64-1

Fixes #3565.

Problem

On the 2026-07-28 HTTP path, every tools/call with arguments runs the server's full tools/list handler before dispatch (_mcp_param_rejection → _tool_input_schema) to resolve the called tool's inputSchema for Mcp-Param-* header validation. There is no way to opt out, and it runs even when no tool declares x-mcp-header.

For a server whose tools/list is expensive — e.g. a gateway aggregating several backend MCP servers where listing fans out per-user credentials — this is a large per-call cost on every single tools/call.

Change

Add an explicit opt-out on the lowlevel Server:

Server(..., mcp_param_validation=False, ...)

When False, the schema-resolving tools/list walk is skipped entirely and tools/call dispatches directly. Default remains True, so every existing Mcp-Param-* validation behavior is unchanged (missing-header rejection, mismatch rejection, orphan/duplicate header rejection all still fire). The McpServer wrapper delegates to the same app, so the flag is honored there too.

Tests

  • test_modern_tools_call_skips_tools_list_when_mcp_param_validation_opted_out: with the flag off, an argument-bearing tools/call returns 200 and the tools/list handler is never invoked (list_calls == 0).
  • test_modern_tools_call_runs_tools_list_by_default_for_validation: with the flag on (default), the missing-header rejection for an annotated argument still returns 400 HEADER_MISMATCH.

Full suite: 5893 passed.