CLI --server with an Object.prototype name (e.g. 'constructor') fails with an unrelated error instead of 'not found'

[cliffhall]

Problem

Raised by Copilot on the v2.9.0 milestone-merge PR (#2536) and reproduced there.

loadServerFromConfig in core/mcp/node/config.ts (lines 184-190) checks and returns config.mcpServers[serverName] with a bare dynamic lookup. A server name that matches an inherited Object.prototype member (constructor, toString, …) finds the inherited function instead of reporting "not found", and the CLI then fails with an unrelated error:

$ mcp-inspector --cli --config servers.json --server constructor --method tools/list
{"error":{"code":"error","message":"Cannot use 'in' operator to search for 'type' in undefined"}}
$ mcp-inspector --cli --config servers.json --server nope --method tools/list
{"error":{"code":"error","message":"Server 'nope' not found. Available servers: real"}}

store-id.ts deliberately keeps these names valid as store ids (8d83c83), which is only safe while every dynamic read over a user-keyed map is an own-property lookup. This one is not.

Not a regression: 2.8.0 prints the same error.

Expected

An absent server named constructor (or any other inherited name) reports Server 'constructor' not found, like any other absent name. Use Object.hasOwn(config.mcpServers, serverName) here, and check the remaining bare reads over user-keyed maps.

[cliffhall]

Triage: Priority Medium (total 6)

• Severity 2 — a confusing error for an unusual server name; renaming the server is an easy workaround
• Urgency 2 — wanted eventually; not blocking v2.9.0 (not a regression, 2.8.0 behaves the same)
• Bonuses: +1 bug label, +1 milestoned (v2.10.0)

Board: #28, Status Todo.

[Gauravtiwari31]

Hi @cliffhall , I'd like to take this one.

I reproduced it on v2/main: --server constructor fails with "Cannot use 'in' operator to search for 'type' in undefined" instead of "Server 'constructor' not found".

Plan: switch loadServerFromConfig to Object.hasOwn(config.mcpServers, serverName), then grep for other bare reads over user-keyed maps (including around store-id.ts) and convert them the same way. I'll add tests for constructor, toString and proto.

Could you assign it to me? I'll open the PR against v2/main.

[cliffhall]

Fixed by #2583, merged into v2/main.