JSON-RPC & Schema Validation

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R21 — MCP Spec: tool schemas & authorization

   R07 — JSON Schema

   R02 — OWASP ASVS access control

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Build mcp-proxy (D2) envelope and tool-argument validation using strict Pydantic schemas. *Lab:* Fuzz the proxy with malformed JSON-RPC envelopes, oversized payloads, and unexpected arguments.

   Add caller authentication and per-tool scope authorization to D2. Separate tools/list discovery from tools/call execution permissions. *Lab:* Test a poisoned tool description attempting to invoke an unauthorized admin tool.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 31 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   D2 protocol validation test suite + tool permission matrix and negative authorization tests.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R02OWASP ASVS↗ owasp.org

  Access-control, validation, authentication, file-handling, and logging requirements.

• R07JSON Schema↗ json-schema.org

  Core schema types, required properties, additionalProperties: false, enums, and numeric/string bounds.

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsJSON Schema · ~25 min read
  Creating your first schema

  Teaches `type`, `required`, `properties` and nested structures, the vocabulary you need before tightening `additionalProperties: false` and enums on every tool argument schema.

  R07checked 2026-11-11
• videoAutomation Step by Step · ~12 min
  What is JSON Schema

  Shows how a schema constrains types and structure and how to validate a payload against it, which is the same check the proxy must perform on envelope and argument payloads.

  R07checked 2026-11-11
• videoCorey Schafer · ~2 hr
  Python Pydantic Tutorial: Complete Data Validation Course (Used by FastAPI)

  Covers `strict` mode, `extra='forbid'`, and per-field constraints — the exact Pydantic v2 knobs that turn a permissive tool schema into a fail-closed argument validator.

  R02checked 2026-11-11
• articlep0.dev · 3 min read
  OAuth scopes don't equal secure MCP authorization

  Argues scopes are coarse capability labels and that per-tool checks must run at call time, which is precisely why `tools/list` discovery and `tools/call` execution need separate authorization.

  R21moved 2026-11-11
• labSchemathesis · Quick start 5 min, CLI tutorial 20 min
  Schemathesis

  Schema-driven property-based fuzzing that generates malformed and boundary inputs and asserts no 5xx, the tool to run the lab of hammering the proxy with bad envelopes and unexpected arguments.

  R02moved 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.