Tool input schemas are structurally well-formed
Authored by Stanley Hong · AgentReserve (founder).
Every tool's `inputSchema` parses as a finite, well-formed JSON Schema document — no oversize blobs (>64 KB serialized), no nesting deeper than 32 levels, no `$ref` whose target is unresolvable or non-local, no recursion cycle through `$ref`. The existing `analyzeSchemaRisk` walker tolerates malformed schemas silently (it uses a WeakSet to avoid infinite loops) — so a schema this rule fails would otherwise reach the agent unchecked, defeating pre-call validation and review.
When this rule runs
Requires a successful MCP `initialize` / `tools/list`. Skipped on perimeter-only scans where the server refused or failed the MCP handshake.
Why it matters
A malformed `inputSchema` is invisible to every other rule: the structural-shape walker uses WeakSets to avoid hangs and the capability classifier reads only the surface fields. Oversized, deeply-nested, cyclic, or unresolvable-`$ref` schemas slip past review and crash strict client validators. They are also the canonical shape of generated dump-the-protobuf code that wasn't meant for an agent surface.
Pass condition
Every advertised tool's `inputSchema` is ≤ 64 KB serialized, ≤ 32 levels deep, contains no `$ref` outside the schema document, and contains no `$ref` cycles.
Fail condition
At least one tool's `inputSchema` exceeds the size cap, exceeds the depth cap, contains an unresolvable or non-local `$ref`, or contains a cycle through `$ref`.
Evidence examples
When the rule fails, the report records evidence in roughly this shape:
{"hits": [{"toolName": "do_thing", "kind": "ref_cycle", "path": "(root)", "detail": "Cycle through $ref #/definitions/Node."}]}{"hits": [{"toolName": "ingest", "kind": "oversized", "path": "(root)", "detail": "Serialized inputSchema is 131072 bytes (limit 65536)."}]}
Remediation
Treat `inputSchema` as a contract. Keep it small (the agent reads it on every call), keep `$ref` targets local and resolvable, and break recursive shapes with an explicit terminator. A schema your validator can't traverse is a contract you can't enforce.
Methodology
This rule belongs to the Schema quality dimension. Whether the tool surface is reviewable without invoking it. Tools without input schemas force agents to guess argument shapes; tool names that aren't plain ASCII identifiers confuse logging and allow-listing.
Read the full methodology for how rules are aggregated into a score, how verdicts are decided, and how hard-fail rules override the aggregate.