fix(server): guard against non-string content text in tool results (#50)

JSON.stringify(undefined) returns the VALUE undefined, so any domain
handler that stringifies a missing SDK response (e.g. actor.get()
returning undefined from @wyre-technology/node-huntress) emitted
{type: 'text', text: undefined}, which fails MCP client Zod validation
(invalid_union on content[0]) on every call. Surfaced by the EpiOn
customer tool audit via the Conduit gateway: huntress_accounts_actor
was broken on every call.

Sanitize at the single dispatch choke point in server.ts so every
domain (accounts, agents, organizations, incidents, billing, signals,
users) is covered: coerce any non-string text to the string 'null' and
log a warning when the guard fires.

Author: asachs01

src/__tests__/server.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { createServer } from '../server.js';
+
+// Regression for the EpiOn audit finding: the node-huntress SDK can return
+// undefined from client.actor.get(), and JSON.stringify(undefined, null, 2)
+// yields the VALUE undefined — so the server emitted
+// {type: 'text', text: undefined}, which fails MCP client Zod validation
+// (invalid_union on content[0]) on every call.
+vi.mock('@wyre-technology/node-huntress', () => ({
+  HuntressClient: class {
+    accounts = { get: vi.fn().mockResolvedValue(undefined) };
+    actor = { get: vi.fn().mockResolvedValue(undefined) };
+  },
+}));
+
+describe('server content guard', () => {
+  beforeEach(() => {
+    process.env.HUNTRESS_API_KEY = 'test-key';
+    process.env.HUNTRESS_API_SECRET = 'test-secret';
+  });
+
+  afterEach(() => {
+    delete process.env.HUNTRESS_API_KEY;
+    delete process.env.HUNTRESS_API_SECRET;
+  });
+
+  async function connectedClient(): Promise<Client> {
+    const server = createServer();
+    const client = new Client({ name: 'test-client', version: '1.0.0' });
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+    return client;
+  }
+
+  it('never emits a text content block whose text is not a string, even when the SDK returns undefined', async () => {
+    const client = await connectedClient();
+
+    const result = await client.callTool({ name: 'huntress_accounts_actor', arguments: {} });
+
+    const content = result.content as Array<{ type: string; text: unknown }>;
+    expect(Array.isArray(content)).toBe(true);
+    expect(content.length).toBeGreaterThan(0);
+    for (const block of content) {
+      expect(block.type).toBe('text');
+      expect(typeof block.text).toBe('string');
+    }
+  });
+});

src/server.ts

@@ -4,9 +4,24 @@ import { getNavigationTools, DOMAINS } from './domains/navigation.js';
 import { getDomainHandler } from './domains/index.js';
 import { getCredentials } from './utils/client.js';
 import { logger } from './utils/logger.js';
-import type { DomainName } from './utils/types.js';
+import type { CallToolResult, DomainName } from './utils/types.js';
 import { registerPromptHandlers } from './prompts.js';
 
+// Belt-and-braces guard: never emit a content block whose text is not a
+// string. JSON.stringify(undefined) returns the VALUE undefined, so any
+// handler that stringifies a missing SDK response would otherwise emit
+// {type: 'text', text: undefined} — which fails MCP client validation
+// (Zod invalid_union on content[0]) on every call.
+function sanitizeResult(toolName: string, result: CallToolResult): CallToolResult {
+  for (const block of result.content) {
+    if (typeof block.text !== 'string') {
+      logger.warn('Coerced non-string content text to "null"', { tool: toolName, textType: typeof block.text });
+      block.text = 'null';
+    }
+  }
+  return result;
+}
+
 export function createServer(): Server {
   const server = new Server(
     { name: 'huntress-mcp', version: '1.0.0' },
@@ -78,7 +93,8 @@ export function createServer(): Server {
       const toolNames = handler.getTools().map(t => t.name);
       if (toolNames.includes(name)) {
         try {
-          return await handler.handleCall(name, (args || {}) as Record<string, unknown>, extra);
+          const result = await handler.handleCall(name, (args || {}) as Record<string, unknown>, extra);
+          return sanitizeResult(name, result);
         } catch (error) {
           logger.error('Tool call failed', { tool: name, error: (error as Error).message });
           return {