Survive recursive and hostile specs; add build_info/uptime metrics - #44
Merged
Conversation
Recursive $refs (self-referencing schemas, common in real APIs) crashed
the server two ways: the lint walker recursed the cyclic dereferenced
document until stack overflow, and the compile cache JSON.stringify
threw on cyclic operation models. The linter now tracks visited nodes,
the schema normalizer cuts cycles to the permissive empty schema so
compiled models are serializable and AJV/Zod-compilable, the cache
write is best-effort, and the spec resource renders back-references as
"[Circular]".
Schema property names like __proto__ were silently dropped from Zod
shapes (computed assignment hits the prototype setter); shapes and
normalized schema nodes now use null-prototype objects so such
properties are validated like any other.
/metrics gains mcp_openapi_build_info{version} and
mcp_openapi_uptime_seconds.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqBsGC7xLvihtBxhCdWKz5
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adversarial-input hardening, found by feeding the server deliberately hostile specs (closes the concrete part of #21, plus the telemetry ask in #22):
Recursive
$refs crashed the server — any spec with a self-referencing schema (Node.child -> Node, common in real APIs) failed twice:lintOpenApiDocument's broken-ref walker recursed the cyclic dereferenced document untilMaximum call stack size exceeded— startup fatal.JSON.stringifythrew on cyclic operation models.Fixes: the lint walker tracks visited nodes; the schema normalizer cuts cycle back-references to the permissive empty schema so compiled models are serializable and AJV/Zod-compilable; cache writes are best-effort (warn and continue); the
openapi://<name>/specresource renders back-references as"[Circular]".__proto__schema properties were silently unvalidated — building Zod shapes via computed assignment on a plain object hits the prototype setter, so a property literally named__proto__was dropped from validation. Shapes and normalized schema nodes now use null-prototype objects; such properties validate like any other, and the tests assertObject.prototypestays clean.Telemetry:
/metricsgainsmcp_openapi_build_info{version="…"} 1andmcp_openapi_uptime_seconds.Tests: 6 new (58 total) — cyclic-spec compile/serialize/validate, full
--validate-specstartup on a cyclic spec, cyclic spec resource read over stdio,__proto__validation + no-pollution assertions, duplicate-operationId suffixing, metrics rendering.🤖 Generated with Claude Code
https://claude.ai/code/session_01LqBsGC7xLvihtBxhCdWKz5