Invalid JSON and malformed parameters return InvalidParams

Malformed JSON is a normal input condition in production — network truncation, client bugs, and injection attempts all produce broken payloads. A server that crashes on JSON.parse() failure (CWE-1286: improper validation of syntactic correctness) takes down all tools with no error sent to the client. OWASP A03 (Injection) is the active risk when valid JSON with adversarial parameter values reaches a handler that doesn't validate types or required fields. CWE-20 (improper input validation) covers both: the server must reject bad input before it reaches business logic.

The MCP SDK handles JSON parse errors at the transport layer. For custom implementations, wrap JSON.parse explicitly and validate parameters before handler dispatch.

// src/transport/handler.ts
function processMessage(raw: string) {
  let message
  try {
    message = JSON.parse(raw)
  } catch {
    // id is unknown when JSON is invalid — use null
    return { jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error: invalid JSON' } }
  }

  if (message.method === 'tools/call' && !message.params?.name) {
    return {
      jsonrpc: '2.0', id: message.id,
      error: { code: -32602, message: 'Invalid params: missing required field "name"' }
    }
  }
  // ... dispatch
}