{"record":{"id":"093628d8c78492f6","repo":"apache/incubator-seata","slug":"confirmation-string-must-explicitly-contain-o","errorCode":null,"errorMessage":"Confirmation string must explicitly contain '确认' or 'confirm' and repeat the modification content. This must come from the user.","messagePattern":"Confirmation string must explicitly contain '确认' or 'confirm' and repeat the modification content\\. This must come from the user\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"console/src/main/java/org/apache/seata/mcp/tools/ModifyConfirmTools.java","lineNumber":52,"sourceCode":"    private final ModifyConfirmService modifyConfirmService;\n\n    public ModifyConfirmTools(ModifyConfirmService modifyConfirmService) {\n        this.modifyConfirmService = modifyConfirmService;\n    }\n\n    @McpTool(\n            description = \"Before modifying (update or delete) a transaction or lock, the user MUST manually confirm.\"\n                    + \"You are NOT allowed to fabricate or auto-confirm on behalf of the user.\")\n    public Map<String, String> confirmAndGetKey(\n            @McpToolParam(\n                            description =\n                                    \"The confirmation string provided by the USER (not generated by the LLM).The content must repeat the modification action clearly.\")\n                    String userInputStr) {\n        if (StringUtils.isBlank(userInputStr)) {\n            throw new IllegalArgumentException(\"User confirmation string is required.\");\n        }\n        if (!userInputStr.contains(\"确认\") && !userInputStr.contains(\"confirm\")) {\n            throw new IllegalArgumentException(\n                    \"Confirmation string must explicitly contain '确认' or 'confirm' and repeat the modification content. This must come from the user.\");\n        }\n        Map<String, String> keyMap = modifyConfirmService.confirmAndGetKey();\n        LOGGER.info(\"the user obtains a modify key:{}\", keyMap.get(\"modify_key\"));\n        return keyMap;\n    }\n}\n","sourceCodeStart":34,"sourceCodeEnd":60,"githubUrl":"https://github.com/apache/incubator-seata/blob/e01f97c6db397165050caa6764020410c2c8199a/console/src/main/java/org/apache/seata/mcp/tools/ModifyConfirmTools.java#L34-L60","documentation":"Thrown by Seata MCP ModifyConfirmTools when the user confirmation string is present but does not contain either '确认' (Chinese) or 'confirm' (English). The check is a deliberate keyword gate ensuring the string reads as an explicit confirmation of the modification, and the parameter description forbids the LLM from fabricating it.","triggerScenarios":"confirmAndGetKey is called with text like 'yes', 'ok', 'go ahead', 'sure', or a paraphrase in another language that lacks the literal substrings 'confirm' or '确认'.","commonSituations":"Non-English/non-Chinese users typing 'si', 'ja', '확인'; LLM paraphrasing the user's intent instead of forwarding their literal words; users pasting only the transaction description without the word confirm.","solutions":["Re-run the tool with a string that literally contains 'confirm' or '确认', e.g. 'confirm delete global transaction 192.168.1.1:8091:123456'.","Instruct the MCP client/LLM prompt to echo the user's exact confirmation text, never a summary.","For non-EN/ZH deployments, upstream-patch the keyword set or standardize on the English keyword in team runbooks."],"exampleFix":"// before\nconfirmAndGetKey(\"yes, do it\");\n// after\nconfirmAndGetKey(\"confirm: delete global transaction 192.168.1.1:8091:123456\");","handlingStrategy":"validation","validationCode":"String CONFIRM_RE = \"(?i).*(confirm|确认).*\";\nif (!userInputStr.matches(CONFIRM_RE)) {\n    return \"Include the literal word 'confirm' (or '确认') and restate the action.\";\n}","typeGuard":"boolean isExplicitConfirmation(String s) {\n    return s != null && (s.toLowerCase().contains(\"confirm\") || s.contains(\"确认\"));\n}","tryCatchPattern":null,"preventionTips":["Echo the user's literal text, never a paraphrase","Standardize the phrase template 'confirm <action> <xid>' in runbooks","Teach non-EN/ZH users to include 'confirm' explicitly"],"tags":["mcp","validation","human-in-the-loop","i18n"],"backgroundTag":null,"analyzedSha":"e01f97c6db397165050caa6764020410c2c8199a","analyzedAt":"2026-08-14T10:23:53.097Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}