Mental model
A schema defines shape, not permission or truth. Inputs require semantic and policy validation; outputs require parsing, provenance, size, and trust controls.
Learning outcomes
- Explain the mechanism and ownership boundaries behind Tool Input and Output Validation.
- Compare the main design alternatives and their operational trade-offs.
- Diagnose common failures and select evidence for a production decision.
Theory
Reject unknown fields, ambiguous identifiers, invalid ranges, and unsafe encodings. Normalize once, authorize normalized values, cap output size, preserve provenance, and prevent returned text from becoming executable instructions.
Trade-offs
Strict validation reduces ambiguity and injection but can reject forward-compatible fields. Permissive parsing eases integration while increasing attack and failure surface.
Failure modes and misconceptions
Validating only JSON syntax; coercing dangerous values; using output as a prompt instruction; trusting MIME types; rendering unsanitized HTML; and skipping schema version checks.
Decision scenario
A search tool returns text containing instructions to upload secrets. Decide how the agent should store, display, and reason over that output.
Why is schema-valid tool output still untrusted?
Primary sources
mcp-specificationowasp-llm