Hello, and apologies for the unsolicited report.
Your MCP server io.github.telsav/flutter-skill (flutter-skill) was included in an automated
conformance study of publicly registered Model Context Protocol servers. The study
installed and executed every eligible server in the official registry and drove it
through a set of protocol checks. One result looked worth reporting to you directly.
What we observed
Server crashes or stops responding after a malformed JSON-RPC frame (severity: HIGH)
A single syntactically invalid frame from a client ends the session. Any client that garbles one message -- or any peer that sends one deliberately -- can terminate the server. This is a denial-of-service primitive.
Observed during the check malformed-json:
unresponsive after malformed input (eof)
Reproducing it
The harness is open source. With Docker installed:
git clone https://github.com/Ahmad-Faraj/mcp-conformance
cd mcp-conformance
python driver/mcpprobe.py --cmd "docker run --rm -i --init --memory 768m --cpus 1 --pids-limit 256 --security-opt no-new-privileges --cap-drop ALL node:22-slim npx -y flutter-skill@0.7.6"
The relevant verdict is malformed-json in the JSON output.
Suggested fix
Wrap frame parsing so a JSON decode error is answered with a JSON-RPC parse error (-32700) and the read loop continues, instead of propagating.
About the study
This is part of an academic measurement study of MCP server conformance. Your
server is not named in the paper or the public dataset -- results are reported only
in aggregate, and servers behind security-relevant findings are pseudonymised. We are
contacting maintainers before publication so that anyone who wants to fix an issue
can do so first. There is no deadline attached and no follow-up is required.
If this is a false positive, we would genuinely like to know: the harness may be
wrong, and we will correct both it and the dataset.
Repository: https://github.com/Ahmad-Faraj/mcp-conformance
Hello, and apologies for the unsolicited report.
Your MCP server
io.github.telsav/flutter-skill(flutter-skill) was included in an automatedconformance study of publicly registered Model Context Protocol servers. The study
installed and executed every eligible server in the official registry and drove it
through a set of protocol checks. One result looked worth reporting to you directly.
What we observed
Server crashes or stops responding after a malformed JSON-RPC frame (severity: HIGH)
A single syntactically invalid frame from a client ends the session. Any client that garbles one message -- or any peer that sends one deliberately -- can terminate the server. This is a denial-of-service primitive.
Observed during the check
malformed-json:Reproducing it
The harness is open source. With Docker installed:
The relevant verdict is
malformed-jsonin the JSON output.Suggested fix
Wrap frame parsing so a JSON decode error is answered with a JSON-RPC parse error (-32700) and the read loop continues, instead of propagating.
About the study
This is part of an academic measurement study of MCP server conformance. Your
server is not named in the paper or the public dataset -- results are reported only
in aggregate, and servers behind security-relevant findings are pseudonymised. We are
contacting maintainers before publication so that anyone who wants to fix an issue
can do so first. There is no deadline attached and no follow-up is required.
If this is a false positive, we would genuinely like to know: the harness may be
wrong, and we will correct both it and the dataset.
Repository: https://github.com/Ahmad-Faraj/mcp-conformance