Repository navigation
CLI --server with an Object.prototype name (e.g. 'constructor') fails with an unrelated error instead of 'not found' #2537
Description
Problem
Raised by Copilot on the v2.9.0 milestone-merge PR (#2536) and reproduced there.
loadServerFromConfig in core/mcp/node/config.ts (lines 184-190) checks and returns config.mcpServers[serverName] with a bare dynamic lookup. A server name that matches an inherited Object.prototype member (constructor, toString, …) finds the inherited function instead of reporting "not found", and the CLI then fails with an unrelated error:
$ mcp-inspector --cli --config servers.json --server constructor --method tools/list
{"error":{"code":"error","message":"Cannot use 'in' operator to search for 'type' in undefined"}}
$ mcp-inspector --cli --config servers.json --server nope --method tools/list
{"error":{"code":"error","message":"Server 'nope' not found. Available servers: real"}}
store-id.ts deliberately keeps these names valid as store ids (8d83c83), which is only safe while every dynamic read over a user-keyed map is an own-property lookup. This one is not.
Not a regression: 2.8.0 prints the same error.
Expected
An absent server named constructor (or any other inherited name) reports Server 'constructor' not found, like any other absent name. Use Object.hasOwn(config.mcpServers, serverName) here, and check the remaining bare reads over user-keyed maps.
Activity
cliffhall commentedon Sep 30, 2026
Triage: Priority Medium (total 6)
buglabel, +1 milestoned (v2.10.0)Board: #28, Status
Todo.Gauravtiwari31 commentedon Oct 2, 2026
Hi @cliffhall , I'd like to take this one.
I reproduced it on v2/main:
--server constructorfails with "Cannot use 'in' operator to search for 'type' in undefined" instead of "Server 'constructor' not found".Plan: switch loadServerFromConfig to Object.hasOwn(config.mcpServers, serverName), then grep for other bare reads over user-keyed maps (including around store-id.ts) and convert them the same way. I'll add tests for constructor, toString and proto.
Could you assign it to me? I'll open the PR against v2/main.
Merge pull request #2583 from modelcontextprotocol/v2/fix/2537-own-pr…
cliffhall commentedon Oct 5, 2026
Fixed by #2583, merged into
v2/main.fix(core): own-property server lookup so --server constructor reports…