feat(core): add draft-2020-12 JSON Schema support with lenient fallback by afarber · Pull Request #15060 · google-gemini/gemini-cli

afarber · 2025-12-13T19:48:45Z

Summary

Add JSON Schema draft-2020-12 validation support for MCP servers (e.g., rmcp/Rust SDK), while keeping a lenient fallback for unknown future schema versions:

Schema Version	Validator	Behavior
draft-07 (default)	`ajvDefault`	Strict - rejects invalid data
draft-2020-12	`ajv2020`	Strict - rejects invalid data
Other/future versions	try-catch fallback	Lenient - logs warning, skips validation

Related Issues

Fixes #14970
Related to modelcontextprotocol/rust-sdk#587

How to Validate

Run unit tests: npm run test -- packages/core/src/utils/schemaValidator.test.ts
Build an rmcp MCP server (e.g., from https://github.com/modelcontextprotocol/rust-sdk):

     cd ~/rust-sdk
     cargo build --example servers_counter_stdio -p mcp-server-examples

Configure in ~/.gemini/settings.json:
{"mcpServers": {"counter": {"command": "/path/to/servers_counter_stdio"}}}
Run gemini, then /mcp schema should show tools without errors
Invoke a tool like sum - should succeed instead of failing with schema error

Pre-Merge Checklist

gemini-code-assist · 2025-12-13T19:49:00Z

Summary of Changes

Hello @afarber, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a robust solution to prevent tool invocation failures caused by the client-side JSON schema validator's inability to process newer or unsupported JSON Schema draft versions. By implementing a lenient validation approach, the system now gracefully handles schema compilation errors, effectively skipping client-side validation when a schema's version is not recognized. This ensures broader compatibility with evolving JSON Schema standards and maintains the functionality of tools interacting with updated MCP servers.

Highlights

JSON Schema Version Compatibility: Addresses an issue where the client-side JSON validator (AJV) fails to process schemas using newer or unsupported JSON Schema draft versions (e.g., draft-2020-12) sent by updated MCP servers.
Lenient Validation Strategy: Implements a try-catch block around schema compilation. If compilation fails due to an unsupported schema version or invalid references, client-side validation is skipped, preventing tool invocation failures.
Broad Compatibility: Ensures compatibility with various JSON Schema versions (draft-04, 06, 07, 2019-09, 2020-12, and future versions) without requiring new dependencies.
Consistent Behavior: Applies a lenient validation pattern similar to the existing LenientJsonSchemaValidator used for MCP output schemas, maintaining consistency in handling schema validation.
New Test Cases: Adds comprehensive unit tests to verify that schemas with draft-2020-12, draft-07, unrecognized future $schema versions, and schemas using $defs are correctly handled by skipping client-side validation.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request intends to prevent crashes from unsupported JSON Schema versions by using a "try-catch" block for schema compilation, allowing tool calls to rely on server-side validation. However, this introduces a high-severity security bypass vulnerability in packages/core/src/utils/schemaValidator.ts. Silently skipping input validation on compilation failure could allow malicious data to reach downstream tools. It is strongly recommended to implement a fail-secure approach where compilation failures are treated as errors. Furthermore, adding a log message when validation is skipped would improve debuggability.

packages/core/src/utils/schemaValidator.ts

gemini-code-assist

Code Review

This pull request introduces a lenient validation approach to handle unsupported JSON Schema versions from MCP servers, where client-side validation is skipped if schema compilation fails. However, this change introduces a high-severity validation bypass vulnerability in packages/core/src/utils/schemaValidator.ts. By silently ignoring schema compilation errors, the current 'fail-open' implementation allows an attacker to bypass validation, potentially leading to serious security implications. A 'fail-secure' approach, where validation errors result in data rejection, is strongly recommended. Furthermore, the silent error handling hinders debugging and could mask other schema-related problems; logging is advised for improved visibility.

packages/core/src/utils/schemaValidator.ts

gemini-code-assist

Code Review

This pull request aims to address issues with tool invocations failing due to unsupported JSON Schema versions by wrapping schema compilation in a try-catch block to skip client-side validation for incompatible schemas. However, a high-severity security vulnerability has been identified: the current implementation in schemaValidator.ts introduces a security bypass flaw by 'failing open'. When schema compilation fails, the validator incorrectly reports success, allowing unvalidated data to pass through, which removes a critical layer of defense. This needs to be remediated by ensuring the function fails securely. Additionally, it's recommended to add logging to the catch block to aid in debugging and prevent other potential issues from being silently masked.

packages/core/src/utils/schemaValidator.ts

afarber · 2025-12-13T20:11:09Z

/gemini review

gemini-code-assist

Code Review

This pull request addresses tool invocation failures due to unsupported JSON Schema versions by implementing a try-catch block in SchemaValidator to skip validation and log a warning for problematic schemas. However, this approach introduces a high-severity validation bypass vulnerability. The current 'fail-open' mechanism, which allows parameter validation to be bypassed when an unsupported or malformed schema is encountered, is insecure. While the changes include comprehensive unit tests and align with existing lenient validation patterns, it is critical to revise this to a 'fail-closed' principle. This ensures that if a schema cannot be processed, validation explicitly fails, blocking the tool call and preventing potential security exploits.

packages/core/src/utils/schemaValidator.ts

afarber · 2025-12-13T22:01:28Z

Successfully smoke tested on macOS 26.1:

eminence · 2025-12-25T05:21:49Z

I did a quick test of this on Linux and it also resolved my schema validation issues when testing an MCP server written with the rmcp library

LIHUA919

LGTM

eminence · 2026-01-07T05:36:13Z

According to AVJ, it does support draft-2020-12, but you need to import it from a different package:

import Ajv2020 from "ajv/dist/2020"
const ajv = new Ajv2020()

So instead of skipping validation, can we detect if this schema is used and then use the right version of the AJV validator?

jackwotherspoon · 2026-01-28T15:06:25Z

@afarber looks like this fails to build and lint job is complaining?

Mind taking a look.

afarber · 2026-01-28T16:58:48Z

@jackwotherspoon I think now it's ready, thanks @Adib234

sephriot · 2026-02-03T08:57:24Z

@jackwotherspoon do you have any clue when this will get merged?

… for the future versions

…ck (#15060) Co-authored-by: A.K.M. Adib <adibakm@google.com> Co-authored-by: Jack Wotherspoon <jackwoth@google.com>

…ck (google-gemini#15060) Co-authored-by: A.K.M. Adib <adibakm@google.com> Co-authored-by: Jack Wotherspoon <jackwoth@google.com>

afarber requested a review from a team as a code owner December 13, 2025 19:48

gemini-code-assist bot reviewed Dec 13, 2025

View reviewed changes

packages/core/src/utils/schemaValidator.ts Show resolved Hide resolved

gemini-code-assist bot reviewed Dec 13, 2025

View reviewed changes

packages/core/src/utils/schemaValidator.ts Show resolved Hide resolved

gemini-code-assist bot reviewed Dec 13, 2025

View reviewed changes

packages/core/src/utils/schemaValidator.ts Show resolved Hide resolved

gemini-code-assist bot reviewed Dec 13, 2025

View reviewed changes

packages/core/src/utils/schemaValidator.ts Show resolved Hide resolved

LIHUA919 approved these changes Dec 15, 2025

View reviewed changes

afarber force-pushed the 14970-rust-rmcp-schema branch 2 times, most recently from 9c7e7e0 to aaed29b Compare December 18, 2025 06:57

afarber force-pushed the 14970-rust-rmcp-schema branch from aaed29b to 0de7446 Compare December 25, 2025 09:39

afarber force-pushed the 14970-rust-rmcp-schema branch from 0de7446 to cd97ab7 Compare January 1, 2026 13:41

LIHUA919 reviewed Jan 2, 2026

View reviewed changes

afarber force-pushed the 14970-rust-rmcp-schema branch from 830691a to dbdc99f Compare January 7, 2026 19:32

gemini-cli bot added the area/core Issues related to User Interface, OS Support, Core Functionality label Jan 7, 2026

afarber force-pushed the 14970-rust-rmcp-schema branch from 18b5340 to 53bc253 Compare January 10, 2026 10:18

afarber force-pushed the 14970-rust-rmcp-schema branch from 53bc253 to d7da4cc Compare January 17, 2026 13:08

gemini-cli bot added the priority/p2 Important but can be addressed in a future release. label Jan 22, 2026

jacob314 added the help wanted We will accept PRs from all issues marked as "help wanted". Thanks for your support! label Jan 22, 2026

afarber force-pushed the 14970-rust-rmcp-schema branch 2 times, most recently from c51b99c to b9524eb Compare January 28, 2026 12:25

afarber changed the title ~~fix(core): handle unsupported JSON Schema versions in MCP tool validation~~ feat(core): add draft-2020-12 JSON Schema support with lenient fallback Jan 28, 2026

jackwotherspoon mentioned this pull request Jan 28, 2026

fix(core): add JSON Schema draft-2020-12 support for MCP tool validation #17775

Closed

18 tasks

afarber force-pushed the 14970-rust-rmcp-schema branch from ba23400 to a582c7b Compare January 28, 2026 16:57

afarber force-pushed the 14970-rust-rmcp-schema branch from a582c7b to 0affb47 Compare January 29, 2026 09:21

afarber force-pushed the 14970-rust-rmcp-schema branch from 0affb47 to 0925393 Compare February 1, 2026 19:30

afarber and others added 4 commits February 3, 2026 10:49

Skip validation for unsupported JSON Schema drafts

7173e5d

Add warning log when schema validation is skipped

151c7a5

Add draft-2020-12 JSON Schema support, while keeping lenient fallback…

929e6b2

… for the future versions

format and fix build

ad4c3ee

afarber force-pushed the 14970-rust-rmcp-schema branch from 0925393 to ad4c3ee Compare February 3, 2026 09:49

jackwotherspoon added 2 commits February 3, 2026 08:51

Merge branch 'main' into 14970-rust-rmcp-schema

64e73b1

Merge branch 'main' into 14970-rust-rmcp-schema

981af27

jackwotherspoon approved these changes Feb 3, 2026

View reviewed changes

jackwotherspoon added this pull request to the merge queue Feb 3, 2026

Merged via the queue into google-gemini:main with commit 19b1a74 Feb 3, 2026
26 checks passed

afarber deleted the 14970-rust-rmcp-schema branch February 3, 2026 17:43

Adib234 added a commit that referenced this pull request Feb 3, 2026

feat(core): add draft-2020-12 JSON Schema support with lenient fallba…

430b80d

…ck (#15060) Co-authored-by: A.K.M. Adib <adibakm@google.com> Co-authored-by: Jack Wotherspoon <jackwoth@google.com>

Conversation

afarber commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issues

How to Validate

Pre-Merge Checklist

Uh oh!

gemini-code-assist bot commented Dec 13, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

afarber commented Dec 13, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

afarber commented Dec 13, 2025

Uh oh!

eminence commented Dec 25, 2025

Uh oh!

LIHUA919 left a comment

Choose a reason for hiding this comment

Uh oh!

eminence commented Jan 7, 2026

Uh oh!

jackwotherspoon commented Jan 28, 2026

Uh oh!

afarber commented Jan 28, 2026

Uh oh!

sephriot commented Feb 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

afarber commented Dec 13, 2025 •

edited

Loading