From 454caee4ca34d9da763f38ed3616f0dfea082c2e Mon Sep 17 00:00:00 2001 From: Phoenix Wang Date: Mon, 24 Aug 2026 14:34:57 -0400 Subject: [PATCH 1/2] feat(mcp): add MCP-023, PHP tool has no type-annotated parameters PHP type hints are optional and discovery already captures HasTypedParams; this is the MCP-002 sibling the rulebook listed as a deliberate fast-follow. Co-authored-by: Cursor --- mcp/tool_definition.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/mcp/tool_definition.yaml b/mcp/tool_definition.yaml index 1e84312..9ced30c 100644 --- a/mcp/tool_definition.yaml +++ b/mcp/tool_definition.yaml @@ -309,3 +309,27 @@ rules: fix: > Rename the method (or set the `#[tool]` `name = "..."` argument) to a verb-object form, e.g. `summarize_invoice`, `fetch_weather`. + + - id: MCP-023 + title: PHP MCP tool has no type-annotated parameters + severity: medium + confidence: 0.85 + language: php + applies_to: + - mcp_tool + scope: tool + match: + has_params: true + has_typed_params: false + explanation: > + MCP derives a PHP tool's advertised input JSON schema from the handler's + parameter type hints. PHP type hints are optional; without them the + published schema is unconstrained, so connecting models send unvalidated + inputs that frequently cause runtime errors inside the server. Go, C#, + and Rust MCP tools cannot express this gap — those languages are + statically typed — which is why this sibling of MCP-002 exists only for + PHP. + fix: > + Add type hints to every parameter (`function search(string $query, int + $limit = 10): array`). Use typed properties or DTO classes for structured + inputs so the published schema constrains them. From c4c072e693a315e8561775aa50edbbba03ed9295 Mon Sep 17 00:00:00 2001 From: Phoenix Wang Date: Mon, 24 Aug 2026 15:03:25 -0400 Subject: [PATCH 2/2] refactor(mcp): renumber to MCP-029 to avoid an ID collision bradAGI's open PR stack claims MCP-023 through MCP-028. A duplicated rule ID is rejected by the loader at startup, so shipping both would break every scan rather than fail a test. MCP-029 is the first free ID above that stack. Co-authored-by: Cursor --- mcp/tool_definition.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mcp/tool_definition.yaml b/mcp/tool_definition.yaml index 9ced30c..fdc4954 100644 --- a/mcp/tool_definition.yaml +++ b/mcp/tool_definition.yaml @@ -310,7 +310,7 @@ rules: Rename the method (or set the `#[tool]` `name = "..."` argument) to a verb-object form, e.g. `summarize_invoice`, `fetch_weather`. - - id: MCP-023 + - id: MCP-029 title: PHP MCP tool has no type-annotated parameters severity: medium confidence: 0.85