Sanitize search structuredContent to remove undeclared Docker Hub API fields

[btorbich]

Bug description

The search MCP tool parses the Docker Hub /api/search/v4 response with its Zod output schema for exact-match detection, but it continues returning the original, unsanitized response.structuredContent.

The live API currently returns undeclared fields including:

• top-level search_after
• per-result media_types
• per-result content_types
• per-result score
• per-result raw_pull_count
• per-result additional_metadata

Because the MCP tool's generated output schema uses additionalProperties: false, strict MCP clients can reject an otherwise successful response.

PR #87 fixed the separate stale enum values type: "dhi" and badge: "hardened". This report concerns only the remaining undeclared-field handling: #87

Current live evidence

On 2026-08-31, this request:

GET https://hub.docker.com/api/search/v4?query=nginx&size=5

returned top-level keys:

results, search_after, total

Each inspected result included the undeclared fields listed above.

Current src/search.ts calls:

const results = searchResults.parse(response.structuredContent).results;

but subsequently returns either response.structuredContent or the original response, so Zod's stripped/normalized parsed value is not used as the returned structured content.

Steps to reproduce

1. Call the MCP search tool with a common query such as nginx.
2. Inspect the live Docker Hub v4 response and the MCP tool's returned structuredContent.
3. Validate that structured content against the advertised search output schema with strict additionalProperties: false handling.

Expected behavior

The returned structuredContent conforms exactly to the tool's advertised output schema. Undeclared upstream API fields should not leak into it.

Actual behavior

The tool validates/parses the response for internal exact-match logic, but returns the original upstream structured content, including fields absent from the advertised schema.

Suggested fix

Parse once and return the normalized value:

• parse response.structuredContent through searchResults
• assign the parsed value back to response.structuredContent, or construct the returned response with that parsed value
• add a regression test proving top-level and per-result unknown fields are removed
• return a schema-safe MCP error if parsing fails rather than returning known-invalid structured content

This keeps the public output schema synchronized with what the tool actually returns and makes the implementation resilient to additive Docker Hub API fields.