Crate turul_mcp_schema_validation 

JSON Schema 2020-12 dialect validation for MCP tool inputSchema.

2026-07-28 (SEP-2106) opens Tool.inputSchema to the full JSON Schema 2020-12 vocabulary (oneOf/anyOf/allOf/$ref/$defs/conditionals). The spec states the MUST this crate satisfies: “Clients and servers MUST validate schemas according to their declared or default dialect and MUST handle unsupported dialects gracefully by returning an appropriate error.” validate_tool_input_schema’s dialect check and 2020-12 meta-validation compile step are that MUST.

Two additional checks in this crate are framework security policy, not a JSON Schema spec requirement: rejecting a remote $ref (prevents SSRF — fetching attacker-controlled schema content over the network) and enforcing size/nesting/composition-depth bounds (prevents resource- exhaustion DoS from an oversized or pathologically nested schema). Both are deliberate hardening layered on top of the spec MUST, not mandated by it.

This crate is used by both trust boundaries: a server MUST NOT advertise an invalid inputSchema (enforced at tool registration), and a client MUST exclude a tool whose inputSchema is invalid from tools/list.

Enums

SchemaValidationError

Why a tool inputSchema failed validation.

Constants

MAX_COMPOSITION_DEPTH

Maximum nesting depth through composition keywords (allOf/anyOf/oneOf/ not/if/then/else) and structural keywords (items/properties). Framework security policy (DoS hardening), not a JSON Schema spec requirement.

MAX_REF_DEPTH

Reserved for a future resolved-$ref-chain bound. The current bounds walk is deliberately cycle-safe: it traverses only the literal JSON document tree and never resolves/follows a $ref (see validate_tool_input_schema docs) — a legitimate cyclic local $ref (e.g. a recursive tree-node schema) MUST pass. Because $ref targets are never resolved, there is no “chain” to measure without reintroducing the cycle risk this bound would otherwise guard against, so this constant is not currently exercised.

MAX_SCHEMA_BYTES

Maximum serialized size of a tool inputSchema, in bytes. Framework security policy (DoS hardening), not a JSON Schema spec requirement.

Functions

validate_tool_input_schema

Validate a tool inputSchema: size bound, $ref/composition bounds (checked over the literal JSON tree only — see below), remote-$ref rejection, dialect check, then 2020-12 meta-validation. Checks run cheapest-first so a pathological schema is rejected before the (relatively) expensive compile step.