{"record":{"id":"27621396dfef3e98","repo":"vercel/ai","slug":"invalid-resources-read-params","errorCode":null,"errorMessage":"Invalid resources/read params","messagePattern":"Invalid resources/read params","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/react/src/mcp-apps/bridge.ts","lineNumber":71,"sourceCode":" * Validates the params for app-initiated `tools/call` requests.\n */\nfunction assertToolCallParams(params: unknown): MCPAppToolCallParams {\n  if (!isJSONObject(params) || typeof params.name !== 'string') {\n    throw new Error('Invalid tools/call params');\n  }\n\n  return {\n    name: params.name,\n    arguments: isJSONObject(params.arguments) ? params.arguments : undefined,\n  };\n}\n\n/**\n * Validates `resources/read` params and limits reads to `ui://` app resources.\n */\nfunction assertResourceReadParams(params: unknown): { uri: string } {\n  if (!isJSONObject(params) || typeof params.uri !== 'string') {\n    throw new Error('Invalid resources/read params');\n  }\n  if (!params.uri.startsWith('ui://')) {\n    throw new Error(\n      `resources/read is limited to ui:// resources: ${params.uri}`,\n    );\n  }\n  return { uri: params.uri };\n}\n\n/**\n * Validates `ui/open-link` params and allows only `https:`/`http:`/`mailto:`\n * URLs.\n */\nfunction assertOpenLinkParams(params: unknown): { url: string } {\n  if (!isJSONObject(params) || typeof params.url !== 'string') {\n    throw new Error('Invalid ui/open-link params');\n  }\n","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/react/src/mcp-apps/bridge.ts#L53-L89","documentation":"The bridge validates `resources/read` requests from the MCP App iframe and requires a `uri` string param. This error is thrown when params are not a JSON object or `params.uri` is missing or not a string. It prevents the host's readResource callback from being called with malformed data.","triggerScenarios":"The iframe sends `resources/read` with params missing entirely, with `params` not an object, or with a non-string/absent `uri` (e.g. `{ uri: 123 }` or `{}`).","commonSituations":"A custom app iframe constructed by hand; a spec-noncompliant SDK inside the iframe; passing a resource object instead of its uri string; typo like `url` instead of `uri`.","solutions":["Ensure the iframe sends `{ method: 'resources/read', params: { uri: '<string>' } }`.","Check for a `uri` vs `url` key typo in the app's request.","Inspect the failing request in the host `onError` callback to see what the iframe actually sent.","Update the app-side MCP SDK to a version that conforms to the MCP Apps resources/read schema."],"exampleFix":"// before\nclient.readResource({ url: 'ui://resource' })\n// after\nclient.readResource({ uri: 'ui://resource' })","handlingStrategy":"validation","validationCode":"function isValidResourceReadParams(params: unknown): boolean {\n  return (\n    typeof params === 'object' && params !== null && !Array.isArray(params) &&\n    typeof (params as any).uri === 'string'\n  );\n}\n// before calling resources/read:\nif (!isValidResourceReadParams({ uri })) throw new Error('resources/read requires a string uri');","typeGuard":"function isResourceReadParams(v: unknown): v is { uri: string } {\n  return typeof v === 'object' && v !== null && !Array.isArray(v) &&\n    typeof (v as any).uri === 'string';\n}","tryCatchPattern":"try {\n  const result = await readResource({ uri });\n} catch (error) {\n  if (error instanceof Error && error.message === 'Invalid resources/read params') {\n    console.error('resources/read params must include a string uri field');\n  }\n}","preventionTips":["Use the `uri` key (not `url`) with a string value.","Validate params shape app-side before posting the JSON-RPC request.","Keep the iframe app on a spec-conformant MCP SDK version."],"tags":["mcp-apps","validation","iframe","json-rpc"],"backgroundTag":"invalid-rpc-params","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}