diff --git a/scripts/memory-mcp.mjs b/scripts/memory-mcp.mjs index cb1ea8e16..5cde5e80e 100755 --- a/scripts/memory-mcp.mjs +++ b/scripts/memory-mcp.mjs @@ -437,7 +437,10 @@ function createMemoryMcpService(options = {}) { !isRecord(params) || typeof name !== 'string' || !TOOL_BY_NAME.has(name) - || Object.keys(params).some(key => !['name', 'arguments'].includes(key)) + // `_meta` is reserved by MCP for request metadata (e.g. progressToken); accept it, + // but when present it must be a metadata object — reject null, arrays, and scalars. + || (Object.prototype.hasOwnProperty.call(params, '_meta') && !isRecord(params._meta)) + || Object.keys(params).some(key => !['name', 'arguments', '_meta'].includes(key)) ) { return jsonRpcError(message.id, -32602, 'Unknown or missing memory tool.'); } diff --git a/tests/scripts/memory-mcp.test.js b/tests/scripts/memory-mcp.test.js index 2f540bf84..0a3a7a7a0 100644 --- a/tests/scripts/memory-mcp.test.js +++ b/tests/scripts/memory-mcp.test.js @@ -136,6 +136,7 @@ async function withClient(fn, options = {}) { 'tools/call', { name, arguments: toolArguments } ), + callToolRaw: params => request('tools/call', params), }; try { @@ -180,6 +181,40 @@ async function main() { }); }); + await test('accepts the reserved _meta param on tools/call and rejects malformed values', async () => { + await withClient(async client => { + // A valid `_meta` object (e.g. progressToken) must not block the tool call. + const withMeta = await client.callToolRaw({ + name: 'memory_doctor', + arguments: {}, + _meta: { progressToken: 'progress-123' }, + }); + assert.ok(Array.isArray(withMeta.content)); + + // Baseline: no `_meta` still works. + const withoutMeta = await client.callToolRaw({ + name: 'memory_doctor', + arguments: {}, + }); + assert.ok(Array.isArray(withoutMeta.content)); + + // A malformed `_meta` (null, array, or scalar) must be rejected. + for (const badMeta of [null, ['not', 'an', 'object'], 'string', 42, true]) { + await assert.rejects( + client.callToolRaw({ name: 'memory_doctor', arguments: {}, _meta: badMeta }), + /-32602/, + `expected _meta=${JSON.stringify(badMeta)} to be rejected` + ); + } + + // Unrelated top-level params must still be rejected. + await assert.rejects( + client.callToolRaw({ name: 'memory_doctor', arguments: {}, unexpected: true }), + /-32602/ + ); + }); + }); + await test('starts when the npm bin invokes the server through a symlink', async () => { const binRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-memory-bin-')); const binPath = path.join(binRoot, 'ecc-memory-mcp');