A tool's inputSchema contains a $ref that points at an https URL on a third-party host. The client's validator library is capable of fetching that URL automatically. What does the specification require by default?
Select an answer to reveal the explanation.
Short Explanation
A $ref to the internet is like a stranger's note saying 'go fetch this for me': you don't just go. Network $refs stay unfetched unless someone deliberately turns on an opt-in mode. And ignoring the $ref isn't safe either.
Full Explanation
JSON Schema 2020-12 lets $ref point at an absolute URI, but MCP adds a security rule: implementations MUST NOT automatically dereference $ref values that resolve to a network URI. An implementation MAY offer an opt-in mode that fetches non-local $refs, but that mode MUST be disabled by default and SHOULD enforce a host allowlist, or at minimum reject loopback, link-local and private network addresses, and apply timeouts, size limits and logging. The concern is server-side request forgery and tracking: an untrusted server could steer the client's validator into internal networks. Relying on HTTPS misses the point, since TLS protects the transport but says nothing about whether the client should be contacting that host at all. A same-domain exception has no basis in the specification and would still be an automatic fetch. Ignoring the reference and treating that subschema as permissive is explicitly discouraged: schemas that fail to validate because of an unresolved external $ref SHOULD be rejected rather than silently treated as permissive. Exam caveat: this rule applies to both inputSchema and outputSchema validation, and the tools page reminds clients to follow it. Operational check: confirm the validator's remote-reference resolution is disabled by default and that a schema with an unresolved network $ref is rejected.