re validate the outbound payload for mutation

Author: vijay

src/mcp/server/skills.py

@@ -104,19 +104,24 @@ def methods(self) -> Sequence[MethodBinding]:
     async def _handle_list(self, ctx: ServerRequestContext[Any, Any], params: ListSkillsParams) -> HandlerResult:
         # `ListSkillsResult`/`Skill` self-validate on construction, so a handler that builds a
         # non-conformant listing raises `ValidationError` here — a server fault, surfaced as an
-        # Internal error rather than the framework's default Invalid params for a bad body.
+        # Internal error rather than the framework's default Invalid params for a bad body. The
+        # models stay mutable, so re-validate the outbound payload too: a handler that mutates a
+        # skill after building the result can't ship a non-conformant listing past this point.
         try:
             result = await self._list_skills(ctx, params)
+            ListSkillsResult.model_validate(result.model_dump())
         except ValidationError:
             logger.exception("list_skills handler returned an invalid result")
             raise MCPError(code=INTERNAL_ERROR, message="Handler returned an invalid result") from None
         return _finalize_cacheable(result, ctx.protocol_version)
 
     async def _handle_get(self, ctx: ServerRequestContext[Any, Any], params: GetSkillParams) -> HandlerResult:
         _require_skill_md_uri(params.uri)
-        # `Skill` self-validates on construction (see `_handle_list`).
+        # `Skill` self-validates on construction, and the re-validation guards post-construction
+        # mutation, both as in `_handle_list`.
         try:
             result = await self._get_skill(ctx, params)
+            GetSkillResult.model_validate(result.model_dump())
         except ValidationError:
             logger.exception("get_skill handler returned an invalid result")
             raise MCPError(code=INTERNAL_ERROR, message="Handler returned an invalid result") from None

tests/server/test_skills.py

@@ -150,6 +150,23 @@ async def bad_list(ctx: ServerRequestContext[Any, Any], params: ListSkillsParams
     assert exc_info.value.code == INTERNAL_ERROR
 
 
+async def test_skills_list_rejects_a_skill_mutated_after_the_result_is_built() -> None:
+    """SDK-defined: the value models validate on construction but stay mutable. A handler that
+    builds a valid result and then mutates a skill in place must not slip a non-conformant
+    listing past the server — the outbound payload is re-validated, so this is an Internal error."""
+
+    async def mutating_list(ctx: ServerRequestContext[Any, Any], params: ListSkillsParams) -> ListSkillsResult:
+        result = ListSkillsResult(skills=[_git_workflow_skill()])
+        result.skills[0].frontmatter["name"] = "not the uri name"
+        return result
+
+    server = MCPServer("catalog", extensions=[Skills(list_skills=mutating_list, get_skill=_get_skill)])
+    async with Client(server) as client:
+        with pytest.raises(MCPError) as exc_info:
+            await client.session.send_request(ListSkillsRequest(), ListSkillsResult)
+    assert exc_info.value.code == INTERNAL_ERROR
+
+
 async def test_skills_get_returns_the_matching_skill() -> None:
     async with Client(_server()) as client:
         result = await client.session.send_request(
@@ -247,6 +264,23 @@ async def bad_skill(ctx: ServerRequestContext[Any, Any], params: GetSkillParams)
     assert exc_info.value.code == INTERNAL_ERROR
 
 
+async def test_skills_get_rejects_a_skill_mutated_after_the_result_is_built() -> None:
+    """SDK-defined: as on `skills/list`, a handler that mutates the skill in place after building
+    the result can't ship a non-conformant body — the re-validated outbound payload fails it as an
+    Internal error."""
+
+    async def mutating_get(ctx: ServerRequestContext[Any, Any], params: GetSkillParams) -> GetSkillResult:
+        result = GetSkillResult(skill=_git_workflow_skill())
+        result.skill.resources.clear()
+        return result
+
+    server = MCPServer("catalog", extensions=[Skills(list_skills=_list_skills, get_skill=mutating_get)])
+    async with Client(server) as client:
+        with pytest.raises(MCPError) as exc_info:
+            await client.session.send_request(GetSkillRequest(params=GetSkillParams(uri=_SKILL_URI)), GetSkillResult)
+    assert exc_info.value.code == INTERNAL_ERROR
+
+
 async def test_missing_uri_param_is_rejected_before_the_handler_runs() -> None:
     """SDK-defined: `uri` is a required field on `GetSkillParams`, so an omitted param is
     rejected by params validation - the handler never sees it."""