By adding constraints this SEP :

• Introduces 30+ JSDoc security constraint annotations in schema/draft/schema.ts
• Enhances validation rules to mitigate common attack vectors (XSS, open redirects, injection, DoS)
• Establishes clear expectations for message formats and limits to improve client/server alignment and interoperability
• Ensures backward compatibility while enforcing new constraints for improved security and robustness
• Updates documentation and generates artifacts to reflect the new constraints

Motivation and Context

• Security: Mitigates common attack vectors (XSS, open redirects, injection, DoS)
• Client/Server Alignment: Establishes clear expectations for message formats and limits
• SDK Support: Enables SDK implementors to enforce constraints and provide better developer feedback
• Cross-language Consistency for SDKs: Ensures that SDKs in different languages behave consistently with respect to validation rules, improving overall ecosystem reliability
• Future-proofing: Establishes a foundation for further schema enhancements
• Documentation Clarity: Provides explicit constraints that can be referenced in API documentation and guidelines
• Testing Rigor: Enables more comprehensive test cases that validate constraint enforcement

How Has This Been Tested?

The enriched schema.ts functionally fully equivaltent to the existing one.

Breaking Changes

Changes are needed if and only if very uncommon values are used. E.g. negatice counters or strings of large sizes.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Maybe Breaking change iff uncommon values for basic types (negative numbers, huge string sizes) are used in existing implementations
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally, but not all SDK implmentations have been tested by the SEP's author
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

For each constraint, especially string size limits, a common census has to be reached.