{"record":{"id":"c5c9d6010f229cd8","repo":"vercel/ai","slug":"invalid-tools-call-params","errorCode":null,"errorMessage":"Invalid tools/call params","messagePattern":"Invalid tools/call params","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/react/src/mcp-apps/bridge.ts","lineNumber":57,"sourceCode":"function isNotification(\n  message: MCPAppJsonRpcMessage,\n): message is MCPAppJsonRpcNotification {\n  return 'method' in message && !('id' in message);\n}\n\n/**\n * Normalizes unknown thrown values into an `Error`.\n */\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\n/**\n * Validates the params for app-initiated `tools/call` requests.\n */\nfunction assertToolCallParams(params: unknown): MCPAppToolCallParams {\n  if (!isJSONObject(params) || typeof params.name !== 'string') {\n    throw new Error('Invalid tools/call params');\n  }\n\n  return {\n    name: params.name,\n    arguments: isJSONObject(params.arguments) ? params.arguments : undefined,\n  };\n}\n\n/**\n * Validates `resources/read` params and limits reads to `ui://` app resources.\n */\nfunction assertResourceReadParams(params: unknown): { uri: string } {\n  if (!isJSONObject(params) || typeof params.uri !== 'string') {\n    throw new Error('Invalid resources/read params');\n  }\n  if (!params.uri.startsWith('ui://')) {\n    throw new Error(\n      `resources/read is limited to ui:// resources: ${params.uri}`,","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/react/src/mcp-apps/bridge.ts#L39-L75","documentation":"MCPAppBridge validates every app-initiated `tools/call` JSON-RPC request coming from the untrusted MCP App iframe. This error is thrown when the request params are not a JSON object or lack a string `name` field. The error surfaces via the host's `onError` handler and as a JSON-RPC -32603 error response to the iframe.","triggerScenarios":"The iframe posts a `tools/call` request whose params are missing, not a JSON object, or whose `params.name` is absent or not a string (e.g. params is null, an array, or `{ arguments: {...} }` without `name`).","commonSituations":"A buggy or malicious app iframe sends malformed requests; a hand-rolled iframe client deviates from the MCP Apps spec; protocol version mismatches where the app builds params differently; testing with synthetic window messages that omit `name`.","solutions":["Fix the iframe app so `tools/call` params include a string `name` field: `{ name: 'toolName', arguments: {...} }`.","Check `onError` logging on the host bridge to see the raw failing request and compare against the MCP Apps spec.","If simulating the iframe, ensure the posted message is a JSON-RPC 2.0 request with a valid params object.","Verify both host and app use a compatible MCP Apps protocol version."],"exampleFix":"// before (app-side iframe request)\npostMessage({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { arguments: { q: 'x' } } })\n// after\npostMessage({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'search', arguments: { q: 'x' } } })","handlingStrategy":"validation","validationCode":"function isValidToolCallParams(params: unknown): boolean {\n  return (\n    typeof params === 'object' && params !== null && !Array.isArray(params) &&\n    typeof (params as any).name === 'string'\n  );\n}\n// app-side, before posting:\nif (!isValidToolCallParams(params)) throw new Error('tools/call params need a string name');","typeGuard":"function isToolCallParams(v: unknown): v is { name: string; arguments?: Record<string, unknown> } {\n  return typeof v === 'object' && v !== null && !Array.isArray(v) &&\n    typeof (v as any).name === 'string' &&\n    ((v as any).arguments === undefined || typeof (v as any).arguments === 'object');\n}","tryCatchPattern":"try {\n  await bridgeResult;\n} catch (error) {\n  if (error instanceof Error && error.message === 'Invalid tools/call params') {\n    console.error('App sent malformed tools/call params; check iframe request shape');\n  }\n}","preventionTips":["Always include a string `name` in tools/call params from the app.","Use the official MCP Apps client SDK inside the iframe instead of hand-rolled postMessage calls.","Log outgoing JSON-RPC requests in development to catch malformed params early.","Wire `handlers.onError` on the host to surface these errors during development."],"tags":["mcp-apps","validation","iframe","json-rpc"],"backgroundTag":"invalid-rpc-params","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}