[vishalhabib99]

Summary

Seven GTI tool parameters default to None but are annotated with a non-Optional type (e.g. collection_type: str = None in search_threats). FastMCP builds the input schema from the annotation, so it advertises {"type": "string", "default": null}. A client that sends the advertised default explicitly (some agent frameworks fill every optional field with null) is rejected at argument validation:

Error executing tool search_threats: 1 validation error for search_threatsArguments
collection_type
  Input should be a valid string [type=string_type, input_value=None, input_type=NoneType]

…even though None is the intended default. Reproduced on mcp 1.23.0 and 1.30.0 with an in-memory client; the rejection happens before the tool body runs.

Change

Annotate these as typing.Optional[...] so the schema becomes anyOf: [{type: X}, {type: null}]. No behavior change for callers that omit the argument.

• search_threats: collection_type
• update_collection_attributes: attributes
• get_collection_rules: rule_types
• search_digital_threat_monitoring: since, until, page, truncate

Tests

• test_none_default_params_accept_null: fails if any tool advertises "default": null on a type that excludes null.
• test_search_threats_accepts_null_collection_type: end-to-end call with collection_type=None through the existing mock VT fixture.

Both fail on main and pass with this change; server/gti suite: 55 → 57 passed.

The same pattern exists in server/scc (6 tools) and server/secops (4 tools); I kept this PR to GTI and can send those separately if you'd like.

Found with mcp-doctor (https://github.com/vishalhabib99/mcp-doctor); happy to run a no-install scan on your other servers if useful.

🤖 Generated with Claude Code

[vishalhabib99]

Hi @dandye, just checking this one is still on your radar. It's still mergeable and includes a regression test for the seven parameters. Happy to change anything.