MCP-SEC-005

No $ref in tool schemas resolves to a network URI

“Implementations MUST NOT automatically dereference $ref values that resolve to a network URI.” — spec anchor

How to fix this

Keep `$ref` values local, such as `#/$defs/Thing`. A `$ref` pointing at a network URI must never be automatically dereferenced, so a schema that depends on one will not resolve.

Example: failing and passing

The tool's inputSchema references an external schema by network URL.

Violates MCP-SEC-005 · JSON

{
  "name": "create_contact",
  "inputSchema": {
    "type": "object",
    "properties": {
      "address": { "$ref": "https://schemas.example.net/address.json" }
    }
  }
}

The same subschema is defined in $defs and referenced with a local JSON pointer, so nothing needs to be fetched.

Complies with MCP-SEC-005 · JSON

{
  "name": "create_contact",
  "inputSchema": {
    "type": "object",
    "properties": {
      "address": { "$ref": "#/$defs/address" }
    },
    "$defs": {
      "address": { "type": "object", "properties": { "city": { "type": "string" } } }
    }
  }
}

How the validator checks this

Probe P2.1, against a streamable-http server on the modern protocol. What it reports:

pass: No $ref in … advertised schema… resolves to a network URI
fail: Schema contains … $ref pointing at a network URI, which an implementation MUST NOT dereference

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-HDR-008, MCP-HDR-009, MCP-RES-003, MCP-RES-006, MCP-RES-007, MCP-ERR-003, MCP-ERR-004, MCP-ERR-005, MCP-ERR-008, MCP-CAC-001, MCP-CAC-002, MCP-CAC-003, MCP-CAC-004, MCP-CAC-005, MCP-SCH-001, MCP-SCH-002, MCP-SCH-003, MCP-SCH-004, MCP-SCH-005, MCP-SCH-006, MCP-SCH-007, MCP-SEC-004, MCP-SEC-006, MCP-DEP-005.

Check your own server against MCP-SEC-005

Probe P2.1 checks MCP-SEC-005 in the same request as 24 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.