json_schema_to_type silently returns Any for allOf and oneOf schemas

[strawgate]

Description

json_schema_to_type() handles anyOf schemas but has no handling for allOf or oneOf. Both silently resolve to typing.Any, effectively disabling all validation.

allOf is the standard way to compose schemas in OpenAPI 3.x and JSON Schema 2020-12 (schema intersection/inheritance). oneOf is used for discriminated unions. Both are extremely common in real-world specs.

Reproduction

from fastmcp.utilities.json_schema_type import json_schema_to_type

# allOf — standard OpenAPI schema composition
schema = {
    "allOf": [
        {"type": "object", "properties": {"name": {"type": "string"}}, "required": ["name"]},
        {"type": "object", "properties": {"age": {"type": "integer"}}},
    ]
}
T = json_schema_to_type(schema)
print(T)  # typing.Any — no validation at all!

# oneOf — discriminated union
schema2 = {
    "oneOf": [
        {"type": "string"},
        {"type": "integer"},
    ]
}
T2 = json_schema_to_type(schema2)
print(T2)  # typing.Any

Expected behavior

• allOf should merge sub-schemas and produce a type with all properties
• oneOf should produce a Union type

Impact

The client's result.data for any tool whose output schema uses allOf or oneOf gets no type validation — any shape of data is silently accepted.

[marvin-context-protocol]

Claude finished @strawgate's task in 5m 4s —— View job

---

Triage: allOf and oneOf support in json_schema_to_type

• Read source implementation of json_schema_to_type
• Read existing tests
• Verify the reported behavior
• Investigate how anyOf is handled for reference
• Search for related issues/PRs
• Provide recommendation and action plan

Recommendation

The bug report is accurate. _schema_to_type() in src/fastmcp/utilities/json_schema_type.py:374-464 handles anyOf (line 408) but has no handling for allOf or oneOf. Both silently fall through to return Any at line 446. The fix is straightforward — add handling for both keywords in _schema_to_type().

Findings

Root cause: In _schema_to_type(), the code checks for anyOf at line 408 and produces a Union type. When a schema has allOf or oneOf instead, none of the earlier checks match ($ref, const, enum, anyOf), and execution reaches line 444:

schema_type = schema.get("type")
if not schema_type:
    return Any  # <-- allOf and oneOf schemas typically have no top-level "type"

oneOf handling: Semantically means "exactly one of" (discriminated union). From a Python type perspective this is equivalent to Union, same as anyOf. The existing anyOf logic (lines 408–442) can be reused directly.

allOf handling: Semantically means "all of" (intersection/composition). The most common patterns are:

1. Object composition — allOf: [{properties: {a: ...}}, {properties: {b: ...}}] — merge properties into a single dataclass
2. Schema + constraints — allOf: [{type: string}, {minLength: 1}] — merge into a single schema
3. $ref composition — allOf: [{$ref: "..."}, {properties: {...}}] — resolve ref, merge
4. Single item — allOf: [{...}] — use the single sub-schema directly

The OpenAPI layer already has allOf merging logic in _combine_schemas(), but it operates at the HTTP route level and is not reusable here.

Existing test coverage: The tests/utilities/json_schema_type/ directory has no tests for allOf or oneOf. The anyOf tests exist implicitly through the union type tests.

Detailed Action Plan

1. Add oneOf handling in _schema_to_type()

Add a check for oneOf immediately after the anyOf block (after line 442). The implementation is identical to anyOf — produce a Union from the sub-schemas. To avoid code duplication, extract the shared logic into a helper:

File: src/fastmcp/utilities/json_schema_type.py

# After the anyOf block (line 442), add:
if "oneOf" in schema:
    # oneOf = discriminated union, same Python representation as anyOf
    types: list[type | Any] = []
    for subschema in schema["oneOf"]:
        if (
            subschema.get("type") == "object"
            and not subschema.get("properties")
            and subschema.get("additionalProperties")
        ):
            additional_props = subschema["additionalProperties"]
            if additional_props is True:
                types.append(dict[str, Any])
            else:
                value_type = _schema_to_type(additional_props, schemas)
                types.append(dict[str, value_type])
        else:
            types.append(_schema_to_type(subschema, schemas))

    has_null = type(None) in types
    types = [t for t in types if t is not type(None)]

    if len(types) == 0:
        return type(None)
    elif len(types) == 1:
        if has_null:
            return types[0] | None
        else:
            return types[0]
    else:
        if has_null:
            return Union[(*types, type(None))]
        else:
            return Union[tuple(types)]

Alternatively (and preferably), extract a _resolve_union_types(subschemas, schemas) helper that both anyOf and oneOf call, reducing duplication.

2. Add allOf handling in _schema_to_type()

Add a check for allOf before oneOf. The approach: merge all sub-schemas into a single schema dict, then process the merged result.

if "allOf" in schema:
    # Merge all sub-schemas into one
    merged: dict[str, Any] = {}
    merged_properties: dict[str, Any] = {}
    merged_required: list[str] = []

    for subschema in schema["allOf"]:
        if isinstance(subschema, bool):
            if subschema is False:
                return _UnsatisfiableType
            continue
        # Resolve $ref
        if "$ref" in subschema:
            subschema = dict(_resolve_ref(subschema["$ref"], schemas))
        else:
            subschema = dict(subschema)
        
        # Merge properties
        if "properties" in subschema:
            merged_properties.update(subschema.pop("properties"))
        if "required" in subschema:
            merged_required.extend(subschema.pop("required"))
        # Merge remaining keys (type, constraints, etc.)
        merged.update(subschema)

    if merged_properties:
        merged["properties"] = merged_properties
    if merged_required:
        # Deduplicate while preserving order
        seen = set()
        merged["required"] = [x for x in merged_required if not (x in seen or seen.add(x))]
    
    # If the merged result looks like an object, set the type
    if merged.get("properties") and "type" not in merged:
        merged["type"] = "object"

    return _schema_to_type(merged, schemas)

3. Handle allOf at the top level in json_schema_to_type()

The entry point json_schema_to_type() checks schema.get("type") == "object" first. An allOf schema without a top-level type will reach _schema_to_type() via line 234, so the fix in step 2 handles it. However, consider whether a top-level allOf that merges to an object should also support the name parameter — this can be deferred.

4. Add tests

File: tests/utilities/json_schema_type/test_unions.py (or a new test_composition.py)

Test cases to add:

• oneOf with primitive types → Union[str, int]
• oneOf with object types → Union of dataclasses
• oneOf with null → optional type
• allOf merging two object schemas → single dataclass with all properties
• allOf with required lists merged correctly
• allOf with a single sub-schema → pass-through
• allOf with $ref sub-schemas
• allOf with non-object constraints (e.g., allOf: [{type: string}, {minLength: 1}])
• Validation: allOf-produced type validates correct data and rejects incorrect data
• Validation: oneOf-produced type validates correct data and rejects incorrect data

5. Run tests

uv run pytest tests/utilities/json_schema_type/ -n auto
uv run prek run --all-files

Related Files

Repository	File	Relevance	Sections
PrefectHQ/fastmcp	json_schema_type.py	Core file to modify — _schema_to_type() needs allOf/oneOf handling	374-464
PrefectHQ/fastmcp	test_unions.py	Existing union tests — add oneOf tests here or in a sibling file
PrefectHQ/fastmcp	test_json_schema_type.py	Core type conversion tests
PrefectHQ/fastmcp	schemas.py	Existing allOf merging logic in the OpenAPI layer — good reference for merge approach	269-292
PrefectHQ/fastmcp	test_allof_requestbody.py	Tests for the OpenAPI-level allOf merging — good reference for test patterns

---

Marvin Context Protocol | Type /marvin to interact further

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.