Tools return proper content types (text, image, resource)
Why it matters
The MCP content type system (text, image, resource) tells clients how to render tool results. Returning a raw string instead of a content array means clients receive output they cannot reliably parse or display. Image tools that omit mimeType from data content leave clients unable to decode the bytes. These are protocol conformance failures — a client following the MCP spec will reject or misrender non-conformant responses, turning working tool calls into user-visible errors.
Severity rationale
Low because malformed return structures cause display or parse failures in clients but do not expose data or enable attacks; the impact is limited to incorrect rendering.
Remediation
Return a content array with the correct type field from every tool handler. Never return a raw string.
// src/tools/screenshot.ts
server.tool('screenshot', ..., async () => ({
content: [{
type: 'image',
data: base64ImageData, // required for image
mimeType: 'image/png', // required for image
}]
}))
// Text result
server.tool('read_file', ..., async ({ path }) => ({
content: [{ type: 'text', text: await fs.readFile(path, 'utf-8') }]
}))
For tools returning multiple items, include them as separate entries in the content array — not as a concatenated string.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the MCP Server Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · mcp-spec-content-types — MCP Specification — Tool result content types (text, image, resource)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mcp-server·automated