Validates tools/call arguments against the JSON Schema the server advertises.

Advertising a schema is not enforcing one. A server that returns "required" and "additionalProperties" => false in tools/list and then dispatches whatever arrives has published a contract it does not keep.

That gap is exploitable, and the exploit does not need a clever payload. If a host merges defaults into the argument map with atom keys while unrecognised string keys survive validation, the two never collide in the map and both reach whatever serialises the result -- where the caller's value can win. A client then supplies its own value for a field the host believed it controlled, and reads it back as though the host had set it.

So this module refuses rather than guesses, and the server enforces the same schema it advertised rather than a second one compiled in beside it.

This is a deliberately small subset of JSON Schema — the keywords the server actually uses. It is not a general validator, and it refuses rather than guesses.