Finding / cursor
2026-10-24-cursor-cli-mcp-auto-review-now-receives-schemas-encoded-as-json-strings
CLI MCP Auto-review now receives schemas encoded as JSON strings. Auto-review now sees a tool’s input schema when an MCP server supplies it as a JSON string. The note identifies a missing review input, not a demonstrated arbitrary-execution path.
Channel: tagged-release. Half: defect. Date: 2026-10-22.
Operator consequence: Requalify approval decisions for affected servers with a harmless tool and inspect the schema the reviewer receives. This repair does not make model review a security boundary.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-cursor-cli-mcp-auto-review-now-receives-schemas-encoded-as-json-strings
Profile citations
- cursor / claim / mcp-json-schema-auto-review
Source links
Primary links, including exact changelog lines when available.
- official docs2026-10-24-cursor-cli-mcp-auto-review-now-receives-schemas-encoded-as-json-stringscursor.com/docs/cli/changelog#oct-22-2026official docs2026-10-24-cursor-cli-mcp-auto-review-now-receives-schemas-encoded-as-json-stringsdownloads.cursor.com/lab/2026.10.22-27dcf5f/darwin/arm64/agent-cli-package.tar.gz