fix(agent-core/mcp): sanitize recursive MCP JSON Schemas for Moonshot validator compatibility by creatiVision · Pull Request #2216 · MoonshotAI/kimi-code

creatiVision · 2026-07-26T16:02:32Z

Related Issue

Supersedes / continues the work from #830 and #1605.

Problem

Some MCP servers advertise tool input schemas that are valid standard JSON Schema but fail Moonshot's stricter “MFJS” validator, or crash Kimi during discovery:

Circular / recursive $ref (e.g. self-referential $defs) caused Maximum call stack size exceeded during schema processing.
Tuple-style items arrays (items: [{...}, {...}]) are rejected with items must be an object.
Property schemas that omit type (relying on enum / structural keywords) are rejected with type is not defined.

Without sanitization, affected MCP servers fail to connect or poison inference requests with HTTP 400.

What changed

Add sanitizeMcpSchema (TS port of the legacy kosong JSON Schema interceptor) to:
- safely dereference local $refs (including circular roots)
- fill missing type on property schemas where safe
- normalize array-tuple items into { anyOf: items }
Wire sanitization into McpConnectionManager after tool discovery
Small config compatibility mappings: disabled → enabled, max_tokens / max_output_tokens → max_output_size
Tests for sanitizer + config compatibility

Notes for reviewers

Plugin / lockfile / engine-strict noise from earlier branch merges may still need cleanup before merge (see bot review on this PR).
This PR does not fix NVIDIA / custom OpenAI-compatible prompt_cache_key 400s — that is fix(agent-core): only send prompt_cache_key to official OpenAI endpoints #2203.

Checklist

I have read the CONTRIBUTING document.
I have linked related issues / explained the problem above.
I have added tests that prove my feature works.
Changeset included for agent-core / kimi-code.
Docs update (not required for this fix).

…nitizeMcpSchema

… max_tokens config fields

…ools

…fixes

… resolvePointer

# Conflicts: # packages/agent-core/src/config/toml.ts # packages/agent-core/src/mcp/connection-manager.ts

…dation compatibility

… local running environment

changeset-bot · 2026-07-26T16:02:36Z

🦋 Changeset detected

Latest commit: 424d2b5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@moonshot-ai/agent-core	Patch
@moonshot-ai/kimi-code	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 424d2b587f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-26T16:09:40Z

-  ssh2@1.17.0>cpu-features: '-'
-  ssh2@1.17.0>nan: '-'
-
 importers:


Restore the workspace overrides in the lockfile

pnpm-workspace.yaml still declares the two ssh2 overrides, but this lockfile no longer records them. The CI workflow at .github/workflows/ci.yml:26 runs pnpm install --frozen-lockfile; running that command against this tree stops before the build with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH: The current "overrides" configuration doesn't match the value found in the lockfile. Regenerate the lockfile while preserving the workspace overrides.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T16:09:40Z

+{
+  "name": "frontend-design",
+  "version": "1.1.0",
+  "description": "Frontend design skill for UI/UX implementation",


Declare the nested skills directory

Installing this plugin produces a manifest with no skills: parseManifest only uses the explicit skills field or falls back to a SKILL.md at the plugin root, while this plugin's only skill is under skills/frontend-design/SKILL.md. Consequently the newly added plugin installs without exposing its advertised frontend-design skill; add a "skills": "./skills/" entry.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T16:09:40Z

+  }
+  if (inferred.size === 1) return [...inferred][0]!;
+  if (inferred.size === 2 && inferred.has('integer') && inferred.has('number')) return 'number';
+  return 'string';


Preserve mixed enum value types

For a valid MCP schema such as enum: [1, "auto"], this fallback adds type: "string", making the numeric enum member invalid because JSON Schema applies type and enum together. Since McpConnectionManager applies this sanitizer to every discovered MCP tool before provider selection, providers that previously accepted mixed enums now receive a corrupted schema and may reject the request or prevent the model from selecting the numeric option.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T16:09:40Z

+    if (pathStr === '') {
+      return root;
+    }
+    const parts = pathStr.split('/');


Decode JSON Pointer path segments

Local JSON Pointer segments must decode ~1 to / and ~0 to ~, but this split leaves them escaped before looking up the definition. A valid schema with $ref: "#/$defs/a~1b" and a definition named a/b therefore throws during tool discovery and can mark the MCP server failed; unescape each segment before indexing the schema.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T16:09:40Z

@@ -1,3 +1,3 @@
 auto-install-peers=true
-engine-strict=true
+engine-strict=false


Keep the repository's Node engine check enabled

When a developer runs pnpm install with Node older than 24.15.0, this setting now permits installation even though package.json and .nvmrc still require 24.15.0, deferring failures to later scripts that may rely on unsupported runtime behavior. The repository explicitly requires installs to fail on an unsatisfied Node engine, so this must remain enabled unless all version declarations and runtime requirements are intentionally lowered together.

AGENTS.md reference: AGENTS.md:L30-L33

Useful? React with 👍 / 👎.

creatiVision · 2026-07-27T08:37:06Z

Superseded by the cleaned-up #830. This branch had merge conflicts and unrelated plugin/lockfile/engine-strict changes. Canonical PR: #830

mb and others added 13 commits June 16, 2026 23:50

fix(agent-core): prevent stack overflow on circular schema refs in sa…

519a531

…nitizeMcpSchema

feat(agent-core): add compatibility mapping for standard disabled and…

7ba1449

… max_tokens config fields

fix(agent-core): integrate sanitizeMcpSchema into connectAndDiscoverT…

6f20830

…ools

docs: add changeset for circular mcp schema and config compatibility …

6dc734f

…fixes

fix(agent-core): resolve root self-recursive references (#) safely in…

8384b5c

… resolvePointer

feat: add webdesign wp plugin files directly

c5ca92b

Merge remote-tracking branch 'origin/main' into debian1branch

7c20417

# Conflicts: # packages/agent-core/src/config/toml.ts # packages/agent-core/src/mcp/connection-manager.ts

Merge remote-tracking branch 'origin/main' into debian1branch

6a2f70e

Merge branch 'main' into debian1branch

9b79ee8

fix(agent-core/mcp): support array items in schemas for Moonshot vali…

573c74c

…dation compatibility

merge: merge origin/main into debian1branch to resolve conflicts

d983b7d

chore(debian1): stabilize tests and relax node engine constraints for…

e23a98f

… local running environment

Merge branch 'debian1branch'

424d2b5

chatgpt-codex-connector Bot reviewed Jul 26, 2026

View reviewed changes

creatiVision changed the title ~~upate to new version kimi-code~~ fix(agent-core/mcp): sanitize recursive MCP JSON Schemas for Moonshot validator compatibility Jul 27, 2026

creatiVision mentioned this pull request Jul 27, 2026

fix(agent-core/mcp): sanitize MCP JSON Schemas for Moonshot MFJS validator #830

Open

5 tasks

creatiVision closed this Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(agent-core/mcp): sanitize recursive MCP JSON Schemas for Moonshot validator compatibility#2216

fix(agent-core/mcp): sanitize recursive MCP JSON Schemas for Moonshot validator compatibility#2216
creatiVision wants to merge 13 commits into
MoonshotAI:mainfrom
creatiVision:main

creatiVision commented Jul 26, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 26, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Uh oh!

creatiVision commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

creatiVision commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Issue

Problem

What changed

Notes for reviewers

Checklist

Uh oh!

changeset-bot Bot commented Jul 26, 2026

🦋 Changeset detected

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

creatiVision commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

creatiVision commented Jul 26, 2026 •

edited

Loading