Tool arguments are validated against inputSchema before execution

Tool arguments come from AI model output, which can be manipulated via prompt injection (OWASP LLM01). An MCP tool that executes a shell command, writes a file, or queries a database using arguments it hasn't validated is wide open to CWE-78 (OS command injection) and CWE-22 (path traversal). Even without a malicious actor, an AI model generating plausible-but-wrong parameter values (wrong types, out-of-range numbers) will hit unvalidated code paths and produce crashes or corrupted state. Input schema validation is the gating control before any side effect executes.

Use Zod schemas in the SDK — validation happens automatically before the handler runs. Add security-specific refinements for file paths and sensitive inputs.

// src/tools/files.ts — validated file write
server.tool('write_file', 'Write content to a file within the project', {
  path: z.string()
    .refine(p => !p.includes('..'), 'Path traversal not allowed')
    .refine(p => p.startsWith('/workspace/'), 'Must be within /workspace'),
  content: z.string().max(1_000_000, 'Content exceeds 1MB limit'),
}, async ({ path, content }) => {
  // path and content are validated before this line executes
  await fs.writeFile(path, content)
  return { content: [{ type: 'text', text: `Wrote ${content.length} bytes` }] }
})

For Python, use Pydantic model validation on the function arguments decorated with @mcp.tool().