Dev by h3xxit · Pull Request #92 · universal-tool-calling-protocol/python-utcp · GitHub
Skip to content

Dev#92

Merged
h3xxit merged 9 commits into
mainfrom
dev
Jun 24, 2026
Merged

Dev#92
h3xxit merged 9 commits into
mainfrom
dev

Conversation

@h3xxit

@h3xxit h3xxit commented Jun 24, 2026

Copy link
Copy Markdown
Member

Summary by cubic

Hardened HTTP, WebSocket, and GraphQL transports to block SSRF and credential leaks, and added first-class JSON Schema examples to improve OpenAPI-driven tools.

  • Bug Fixes

    • Enforce secure URL validation across utcp-http, utcp-websocket, and utcp-gql; allow http:///ws:// only for literal loopback (now including 0.0.0.0, ::, IPv4-mapped IPv6).
    • Handle redirects safely with safe_request_with_redirects (no cross-origin hops; auth headers never forwarded across origins); protect OAuth2 tokenUrl.
    • Patch GraphQL transport during connect to block redirects on schema introspection.
    • Reject CR/LF in attacker-controlled header values to prevent header injection.
    • Extensive tests added for URL checks, redirects, OAuth2 flows, and WebSocket validation.
  • New Features

    • Added examples to JsonSchema and surfaced parameter/body/response examples in the OpenAPI converter.
    • Converter now skips unsupported HTTP methods and validates/normalizes schema-level examples.

Dependencies: bumped utcp to 1.1.3, utcp-http to 1.1.8, utcp-websocket to 1.1.4, utcp-gql to 1.1.4; added aiohttp to utcp-gql.

Written for commit 51683c5. Summary will update on new commits.

Review in cubic

shane-rand and others added 9 commits June 16, 2026 21:17
JsonSchema previously accepted `examples` only via `extra="allow"`, leaving
it untyped, undocumented, and invisible to type checkers. Declare it as
Optional[List[JsonType]] so the JSON Schema `examples` keyword is a
first-class, validated field.

Supports PR #88 (OpenAPI converter examples parsing), which currently
relies on the extra-field fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…schema-examples-field

feat(core): add explicit examples field to JsonSchema
Issue 2 — replace the blind cast on http_method with an explicit guard.
OpenAPI allows operations (options/head/trace) that HttpCallTemplate's
Literal type rejects; these are now skipped with a warning instead of
crashing conversion via a Pydantic ValidationError. A shared
SUPPORTED_HTTP_METHODS constant backs both the operation-loop filter and
the per-operation check, so the cast is now truthful rather than assumed.

Issue 3 — make example handling consistent across params, request bodies,
and responses. Examples that appear at the schema level (not just the media
type / parameter object) are now collected via _merge_examples and surfaced
in the normalized JSON Schema 'examples' keyword, and the raw OpenAPI
'example'/'examples' keys are stripped before the schema is spread onto the
property so they no longer leak through as untyped extra fields. This lines
up with the explicit examples field added to JsonSchema in core (#91).

Adds tests for unsupported-method skipping and schema-level example
normalization.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…xamples-on-params

fix: OpenAPI Converter was not parsing examples for request parameters
Publishes the OpenAPI examples parsing work: the explicit JsonSchema
`examples` field (core) and the converter changes that normalize examples
and validate HTTP methods (http).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@h3xxit h3xxit merged commit ae4cebc into main Jun 24, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants