[rudycelekli]

Bug

Two validators compile the JSON Schema that an upstream server declares for its tools:

• internal/outputvalidation/validator.go compile(): the outputSchema, used for output-schema validation (Spec 056; on by default in warn mode).
• internal/server/mcp_input_validation.go compileInputSchema(): the inputSchema, used for pre-dispatch argument validation (Spec 085; always on).

Both call jsonschema.NewCompiler() without setting a loader. In santhosh-tekuri/jsonschema/v6 the default loader is FileLoader, which opens any file:// URL. So when a schema contains {"$ref": "file:///any/path.json"}, mcpproxy opens that path on the user's machine, parses it, and compiles it into the tool's schema. The verdict then depends on a local file the upstream chose.

Trigger

Any upstream, including a remote HTTP one, can list a tool whose inputSchema or outputSchema contains a file:// $ref. The file is read on the first call to that tool. No user action is needed beyond calling the tool.

Fix

Call c.UseLoader(jsonschema.SchemeURLLoader{}) on both compilers. The empty loader rejects every external URL scheme. Two things keep working:

• In-document refs (#/$defs/...) resolve against the in-memory resource and never reach the loader.
• The standard $schema metaschemas are embedded in the library and are served before the loader is consulted.

A schema that uses an external ref now fails to compile and takes the existing fail-open path (FR-A9 / FR-013b).

Tests

• TestCompile_RefusesFileRef (outputvalidation) and TestCompileInputSchema_RefusesFileRef (server): a temp file holds {"type":"string"}, and the schema is {"$ref":"file://<that file>"}. With the fix it must not compile.
• TestCompile_LocalRefsAndMetaSchemaStillWork and TestCompileInputSchema_LocalRefStillWorks: a #/$defs ref and the draft 2020-12 $schema still compile and validate.

Commands run

• CGO_ENABLED=0 go test -count=1 -run 'Test' ./internal/outputvalidation/: ok
• CGO_ENABLED=0 go test -count=1 -run 'TestCompileInputSchema_|TestPreDispatchValidation_' ./internal/server/: ok
• CGO_ENABLED=0 go vet ./internal/outputvalidation/: ok
• On current main (and again with both one-line fixes reverted), both RefusesFileRef tests fail, with schema with $ref file:///…/local.json compiled; the local file was loaded.

I did not run the full ./internal/server package locally.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.

[Dumbris]

Merged. Thank you, @rudycelekli! Upstream tool schemas can no longer make mcpproxy load local files through $ref.