Schema bypass risk

What mcp-scan saw

The prompt-injection scanner checked for additionalProperties set to exactly true at the root of server.schema. It is a strict equality check on one property at one level, so per-tool inputSchema settings are not inspected and an absent value is not treated as true.

Why it fires

additionalProperties: true means the declared schema is not the contract: anything extra passes validation and reaches the handler. In an MCP server, arguments are composed by a model that reads the schema, so undeclared fields are exactly the surface an injected instruction would aim at.

When this is a false positive

• Framework defaults. Several schema generators emit additionalProperties: true at the root unless told otherwise, so the value reflects the generator rather than a decision.
• The server ignores undeclared fields at the handler regardless of what the schema permits, which makes the permissive schema inert.
• A passthrough or proxy server that deliberately forwards arbitrary fields to an upstream API, where the upstream does the validation.
• The check only reads the server schema root, so a per-tool inputSchema with additionalProperties: true does not report. A clean result here says nothing about the tools.

How to fix it

1. Open the schema and set additionalProperties to false at the root.
2. Check the per-tool inputSchema objects too. The rule does not look at them, and they are where arguments actually arrive.
3. If the server forwards arbitrary fields on purpose, allowlist the fields it forwards rather than accepting everything.
4. If a generator sets the value, configure the generator rather than patching the output, so it does not come back.
5. To suppress, add 'schema-bypass-risk' to suppressRules in .mcp-scan.json.