Repository navigation
P16 Comprehensive MCP type safety and validation guardrails #473
Description
Objective
Make every MCP tool input contract derive from strict canonical Zod schemas, normalize bounded LLM numeric-string inputs safely, generate JSON Schema without handwritten drift, and fail before invalid values reach business logic.
Scope
- T16-01: Canonical Zod MCP inputs, coercion, generated schemas, and assurance
Governance
Tracked in Conductor and Project #38. No live Substack writes or credentials.
Activity
edithatogo commentedon Aug 9, 2026
Completion receipt: PR #475 was squash-merged after every available non-conditional check passed, including Quality, CodeQL, strict TypeScript, dependency declaration strictness, production audit and secret scan, SBOM, Node 20/22/24 compatibility, smoke, deterministic assurance, Codecov patch coverage, release-draft update, and mutation testing. All PR comments, inline comments, and reviews were inspected; no actionable feedback remained. All 29 MCP tools now use complete strict Zod input objects at the MCP SDK boundary, pagination accepts bounded decimal integer strings with a default of 10, unknown and missing fields fail validation, and Draft 2020-12 JSON Schemas are generated from the same Zod 4 source. zod-to-json-schema was not retained because its compatibility probe emitted an empty Zod 4 schema. No live Substack call, write, browser state, or credential was used.