ruvnet/ruflo · error

[mcp-composition-inspector] ${message}

Error message

[mcp-composition-inspector] ${message}

What it means

Console warning emitted by evaluateToolComposition() when composition findings exist and blocking is enabled (COMPOSITION_BLOCK_ENV=1): suspicious cross-tool prompt-fragment reuse was detected across MCP tool descriptors and the call chain will be blocked by the guard.

Source

Thrown at v3/@claude-flow/security/src/mcp-composition-inspector.ts:334

 * what "blocked" means operationally; this function does not throw or abort
 * anything itself.
 */
export function evaluateToolComposition(
  tools: readonly McpToolDescriptor[],
  options: CompositionInspectorOptions = {},
): CompositionGuardResult {
  const result = inspectToolComposition(tools, options);
  if (result.findings.length === 0) {
    return { result, action: 'none', blocked: false };
  }

  const summary =
    `MCP Composition Inspector: ${result.findings.length} suspicious cross-tool fragment(s) ` +
    `across ${result.stats.toolsScanned} tools (${result.stats.pairsCompared} pairs compared)`;

  if (isCompositionBlockEnabled()) {
    const message = `${summary} — blocking chain (${COMPOSITION_BLOCK_ENV}=1)`;
    console.warn(`[mcp-composition-inspector] ${message}`);
    for (const f of result.findings) {
      console.warn(`  - ${f.toolA} <-> ${f.toolB}: ${f.reason}`);
    }
    return { result, action: 'block', blocked: true, message };
  }

  console.warn(`[mcp-composition-inspector] ${summary}`);
  for (const f of result.findings) {
    console.warn(`  - ${f.toolA} <-> ${f.toolB}: ${f.reason}`);
  }
  return { result, action: 'warn', blocked: false, message: summary };
}

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Review the composition inspector findings; remove or sandbox the conflicting tool combinations.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/mcp-composition-inspector.ts:334 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/a9df6c0785ffccd6. Report an issue: GitHub.