shreemaan-abhishek opened a new issue, #14158:
URL: https://github.com/apache/apisix/issues/14158
## Current Behavior
`openapi-to-mcp` can send an unresolved path template expression literally
to the upstream when a path argument is absent.
OpenAPI requires path parameters to be marked as required, but the plugin
accepts inconsistent documents and reproduces their `required` setting in the
generated tool schema. If such a document omits `required: true`, validation
allows the tool call without the argument. `build_path()` only substitutes
supplied parameters and does not verify that every expression was filled.
For example:
- `/items/{id}/detail` with no `id` is sent as `/items/{id}/detail`.
- `/x/{a}{b}` with only `a=..` is sent as `/x/..{b}`.
The second result is not itself a dot segment and this report does not claim
direct path traversal. Both results are nevertheless paths the declared
operation did not produce intentionally.
This was identified as a pre-existing issue while reviewing #14154:
https://github.com/apache/apisix/pull/14154#discussion_r4475591464
## Expected Behavior
Before sending the upstream request, `openapi-to-mcp` should fail the tool
call if any path template expression remains unresolved. The error should
identify the missing path parameter when possible.
## Steps to Reproduce
1. Serve an OpenAPI document containing `/items/{id}/detail` and a path
parameter named `id` that is not marked `required: true`.
2. Configure an `openapi-to-mcp` Route using that document.
3. Call the generated tool without `id`.
4. Observe that the upstream request path still contains `{id}` instead of
the tool call failing.
5. Repeat with `/x/{a}{b}`, supply only `a=..`, and observe `/x/..{b}`
upstream.
## Environment
- APISIX: current `master` / pull request #14154 base
- Component: `apisix/plugins/openapi-to-mcp/tools/handler.lua`
- Identified through source inspection of `build_path()` and the generated
input-schema flow
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
