{"record":{"id":"e6b43b9e82ebe14c","repo":"koala73/worldmonitor","slug":"open-sign-in-does-not-accept-credentials-or-other-arguments","errorCode":null,"errorMessage":"open_sign_in does not accept credentials or other arguments.","messagePattern":"open_sign_in does not accept credentials or other arguments\\.","errorType":"exception","errorClass":"SafeWebMcpError","httpStatus":null,"severity":"error","filePath":"src/services/webmcp.ts","lineNumber":3101,"sourceCode":"      annotations: { readOnlyHint: true },\n      execute: withBindings(WEBMCP_SPA_TOOL.getAccessContext, async (_args, extra) => (\n        boundWebMcpAccessContext(await app.getAccessContext(extra), Boolean(extra?.signal))\n      ), trackEvent),\n    },\n    {\n      name: WEBMCP_SPA_TOOL.openSignIn,\n      title: 'Open Sign In',\n      description:\n        'Open the existing Clerk sign-in dialog on this page. Does not accept credentials, one-time codes, or provider choices. Returns a stable reason when Clerk is unavailable or the dialog is already open.',\n      inputSchema: {\n        type: 'object',\n        properties: {},\n        additionalProperties: false,\n      },\n      annotations: { readOnlyHint: false },\n      execute: withBindings(WEBMCP_SPA_TOOL.openSignIn, async (args, extra) => {\n        if (!hasOnlyOwnKeys(args, [])) {\n          throw new SafeWebMcpError(\n            'open_sign_in does not accept credentials or other arguments.',\n            'validation',\n          );\n        }\n        return boundOpenSignInResult(await app.openSignIn(extra));\n      }, trackEvent),\n    },\n  ];\n  const registered = new Set(tools.map((tool) => tool.name));\n  for (const name of WEBMCP_SPA_TOOL_NAMES) {\n    if (!registered.has(name)) {\n      throw new Error(`WebMCP SPA inventory is missing ${name}.`);\n    }\n  }\n  return tools;\n}\n\nfunction registrationFailureReason(error: unknown): RegistrationFailureReason | 'aborted' {","sourceCodeStart":3083,"sourceCodeEnd":3119,"githubUrl":"https://github.com/koala73/worldmonitor/blob/7d06c8633d256c18e38133030bc3613976a96ec9/src/services/webmcp.ts#L3083-L3119","documentation":"The WebMCP tool open_sign_in takes no arguments — it only opens the sign-in flow; credentials are never passed through MCP for security. The handler enforces hasOnlyOwnKeys(args, []) and throws SafeWebMcpError('validation') if any key is present, explicitly calling out credentials in the message.","triggerScenarios":"Calling open_sign_in with { username, password }, { token }, { email }, or any other key; attempting to pre-fill or automate authentication through the tool.","commonSituations":"Developers trying to script logins via MCP instead of the real auth flow; passing credentials because other tools in the stack accept them; automation harnesses that blanket-inject context/credentials objects into every tool call.","solutions":["Call open_sign_in with no arguments at all.","Complete authentication through the app's own sign-in UI/flow, not the MCP tool.","Remove any credential-injection middleware that adds keys to MCP tool arguments."],"exampleFix":"// before\nconst res = await mcp.callTool('open_sign_in', { username: 'u', password: 'p' });\n// after\nconst res = await mcp.callTool('open_sign_in', {});","handlingStrategy":"validation","validationCode":"if (args && Object.keys(args).length > 0) throw new Error('open_sign_in takes no arguments; never pass credentials');","typeGuard":"const isNoArgs = (a: unknown): a is Record<never, never> =>\n  a === undefined || (typeof a === 'object' && a !== null && Object.keys(a).length === 0);","tryCatchPattern":"try {\n  const res = await mcp.callTool('open_sign_in', {});\n} catch (e) {\n  if (e instanceof Error && e.message.includes('does not accept credentials')) {\n    console.error('Complete sign-in in the app UI; the MCP tool takes no args', e.message);\n  } else throw e;\n}","preventionTips":["Never route credentials through MCP tool arguments.","Disable any middleware that injects auth/context objects into tool calls.","Call this tool bare ({}) and finish auth in the app.","Audit automation scripts for blanket credential injection."],"tags":["mcp","validation","security","no-arguments"],"backgroundTag":"invalid-argument","analyzedSha":"7d06c8633d256c18e38133030bc3613976a96ec9","analyzedAt":"2026-09-15T16:44:39.439Z","contentChangedAt":"2026-09-15T16:44:39.439Z","schemaVersion":2},"datasetVersion":"2026-09-15T18:17:12.389Z"}