{
  "id": 308175,
  "title": "My MCP Tool Fetches Before It Writes and Logs Every Change. It Never Checked Whether There Was Anything to Change.",
  "url": "https://urgent.news/2026/08/08/my-mcp-tool-fetches-before-it-writes-and-logs-every-change-it-never",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-08T12:45:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/enjoy_kumawat/my-mcp-tool-fetches-before-it-writes-and-logs-every-change-it-never-checked-whether-there-was-243m"
  },
  "original_language": "en",
  "account": "The MCP tool, part of a repository's MCP server, experienced two bug fixes. Initially, it sent empty data to the DEV.to API when provided with bare integers for article_id, overwriting live posts without leaving any trace. The second fix recorded a hardcoded diff regardless of actual changes, causing the log to show \"nothing changed\" even when the body_markdown was edited. Both fixes failed to verify if any changes were made at all. The function signature, def update_article(article_id:int, title:str=None, body_markdown:str=None, published:bool=None) -> dict, defaults parameters to None, allowing updates to just the title without sending the entire body. However, this design flaw meant the function wouldn't short-circuit if all parameters were None. Calling update_article(article_id=123) would fetch the current article, PUT an empty {article:{}} to the live post, and log the result as if meaningful changes occurred. This identical issue could arise from passing incorrect argument names or leaving the function to handle no-op scenarios inadvertently. The solution was to implement a check before making any changes, ensuring that at least one of title, body_markdown, or published is provided. While the server-side handling of an empty article object was unclear, the client-side bug was confirmed as reproducible and independent of server error handling.",
  "summary": "Two fixes ago, update_article — one of the tools in this repo's MCP server — got hardened twice. The first time, because it took a bare integer article_id , PUT whatever fields you gave it straight to the DEV.to API, and if the id was wrong it would silently overwrite a live published post with nothing left behind to prove it happened. That fix added a fetch-before-write step and a JSONL audit…",
  "key_points": [
    "MCP tool fetched empty data to DEV.to API with bare integers",
    "Hardcoded diff logged even when no changes made",
    "Function lacked check for any changes before updating"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}