Say that the tool schema lookup runs before middleware

Author: maxisbey

src/mcp/server/lowlevel/server.py

@@ -432,7 +432,8 @@ def __init__(
         """Returns a tool's input schema by name, or `None` when there is nothing to validate.
 
         When set, `Mcp-Param-*` header validation on the 2026-07-28 Streamable HTTP
-        path calls this instead of running the `tools/list` handler. If it raises,
+        path calls this instead of running the `tools/list` handler. It is called
+        before middleware runs, so it is not scoped to the caller. If it raises,
         the error is logged and the call is served unvalidated.
         """
         self._request_handlers: dict[str, HandlerEntry[LifespanResultT]] = {}

src/mcp/server/mcpserver/server.py

@@ -430,6 +430,7 @@ async def _handle_list_tools(
         return ListToolsResult(tools=await self.list_tools())
 
     def _tool_input_schema(self, name: str) -> dict[str, Any] | None:
+        """Called before middleware runs, so it also finds a tool that middleware hides from the caller."""
         tool = self._tool_manager.get_tool(name)
         return None if tool is None else tool.parameters