How to Validate MCP Tool Arguments with JSON Schema (Input Contracts)

Every MCP tool declares a JSON Schema for its arguments — that’s how models know what to send. Here’s the part that surprises people: almost nobody enforces it. The schema is a suggestion the model usually follows; the server trusts whatever arrives. Models send the wrong types, invent extra fields, omit required ones — and, in the security-relevant case, prompt injection steers a model into sending arguments the tool author never anticipated: a filename argument that’s actually a path traversal, an “id” that’s a query fragment, a field stuffed with smuggled instructions.

Argument-level attacks are exactly the gap a tool allowlist can’t close: the tool is permitted; the arguments are the problem. Input contract enforcement on MCP Trail closes it — the gateway validates every tools/call against the tool’s own declared schema (JSON Schema Draft 7) and rejects non-conforming calls before they reach your server.

What enforcement gets you

• Malformed calls die at the gate with an explicit validation error the model can correct against — cheaper and clearer than a confusing upstream failure
• Unexpected fields and types are rejected, cutting off the “extra argument the server happens to honor” class of surprises
• The contract is the one the tool itself declared — synced from the server’s catalog, not a second schema you have to write and maintain

Step 1: Create your free MCP Trail account and add a server

Sign up at app.mcptrail.com and route your server through the gateway. The tool schemas come from catalog sync — the same discovery that lists your tools.

Step 2: Turn on input contract enforcement

Open the server under Guardian servers → Security tab → Request limits. Enable the Input contract enforcement card: from now on, tools/call arguments are validated against each tool’s declared JSON Schema. Per-tool overrides live on the Tools tab, so one tool with a sloppy schema doesn’t force the feature off server-wide.

Step 3: Send a bad call on purpose

From the playground, invoke a tool with a wrong-typed or missing required argument. The gateway rejects it with a validation error naming what failed — the schema working as a contract instead of a comment.

Step 4: Watch for legitimate friction

Check the Audit log for validation rejections over the first days. Two things you might find, both useful:

• A model repeatedly failing validation on one tool — usually a badly written schema or description upstream; fix the tool’s schema and everyone benefits
• A tool whose declared schema is too loose to matter ({"type": "object"}) — enforcement can’t add strictness the author didn’t declare; consider a per-tool override or pair with the controls below

The layers around it

Schema validation checks shape, not content — a perfectly-shaped argument can still contain a secret or a destructive command. That’s what the neighboring layers are for:

• Size limits bound how big arguments can be
• DLP scans argument content for secrets and sensitive data
• Shell safety inspects command-running tools’ arguments for destructive patterns
• Session risk scoring weighs argument size as one of its signals

FAQ

Where do the schemas come from?

From the tools themselves — each MCP tool publishes its argument schema, captured during catalog sync. Validation uses JSON Schema Draft 7.

What does the model see on a rejected call?

An explicit validation error identifying the failing constraint. Models are good at reading these — the usual outcome is an immediately corrected retry.

Can I exempt one tool?

Yes — per-tool overrides on the Tools tab let you relax or disable validation for a specific tool without turning the server-wide contract off.

Does this stop prompt injection?

It stops one of injection’s favorite exits: arguments that deviate from the declared contract. Injection defense is layered — combine with tool policies, DLP, and sequence rules for the rest.

Related Articles

• Threat: Argument-Level Attacks on MCP
• How to Set Request & Response Size Limits
• How to Protect Sensitive Data When Using MCP Servers
• How to Control Which MCP Tools Your AI Can Run

Your tools already declared their contracts. Create your free MCP Trail account and start holding calls to them.