fix(context): reject explicit null team user arguments

Preserve the legacy optional user type error before typed decoding, without changing omitted or empty user fallback.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

pkg/github/context_tools.go

@@ -1,7 +1,9 @@
 package github
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"time"
 
@@ -51,6 +53,17 @@ func contextToolValidationSchema(schema *jsonschema.Schema) *jsonschema.Schema {
 	return validationSchema
 }
 
+func normalizeGetTeamsInput(arguments json.RawMessage) (json.RawMessage, error) {
+	var fields map[string]json.RawMessage
+	if err := json.Unmarshal(arguments, &fields); err != nil {
+		return nil, err
+	}
+	if user, exists := fields["user"]; exists && bytes.Equal(bytes.TrimSpace(user), []byte("null")) {
+		return nil, &inventory.ToolInputError{Message: "parameter user is not of type string, is <nil>"}
+	}
+	return arguments, nil
+}
+
 // UserDetails contains additional fields about a GitHub user not already
 // present in MinimalUser. Used by get_me context tool but omitted from search_users.
 type UserDetails struct {
@@ -253,6 +266,7 @@ func GetTeams(t translations.TranslationHelperFunc) inventory.ServerTool {
 			}
 			return result, organizations, nil
 		},
+		normalizeGetTeamsInput,
 	)
 }
 

pkg/github/context_tools_test.go

@@ -677,6 +677,17 @@ func Test_GetTeams(t *testing.T) {
 			expectToolError:    false,
 			expectedTeamsCount: 2,
 		},
+		{
+			name: "empty user uses authenticated user",
+			makeDeps: func() ToolDependencies {
+				return BaseDeps{
+					Client:    mustNewGHClient(t, httpClientWithUser()),
+					GQLClient: gqlClientForTestuser(),
+				}
+			},
+			requestArgs:        map[string]any{"user": ""},
+			expectedTeamsCount: 2,
+		},
 		{
 			name: "no teams found",
 			makeDeps: func() ToolDependencies {
@@ -904,6 +915,54 @@ func Test_GetTeamMembers(t *testing.T) {
 	}
 }
 
+func Test_GetTeams_NullUserForDirectHandler(t *testing.T) {
+	t.Parallel()
+
+	clientCalls := 0
+	gqlClientCalls := 0
+	deps := stubDeps{
+		clientFn: func(context.Context) (*github.Client, error) {
+			clientCalls++
+			return nil, nil
+		},
+		gqlClientFn: func(context.Context) (*githubv4.Client, error) {
+			gqlClientCalls++
+			return nil, nil
+		},
+		obsv: stubExporters(),
+	}
+	serverTool := GetTeams(translations.NullTranslationHelper)
+	request := createMCPRequest(map[string]any{"user": nil})
+	result, err := serverTool.Handler(deps)(ContextWithDeps(context.Background(), deps), &request)
+
+	require.NoError(t, err)
+	require.True(t, result.IsError)
+	assert.Equal(t, "parameter user is not of type string, is <nil>", getErrorResult(t, result).Text)
+	assert.Nil(t, result.StructuredContent)
+	assert.Zero(t, clientCalls)
+	assert.Zero(t, gqlClientCalls)
+}
+
+func TestNormalizeGetTeamsInput(t *testing.T) {
+	t.Parallel()
+
+	for _, arguments := range []string{`{}`, `{"user":""}`, `{"user":"octocat"}`, `{"legacy_ignored_argument":true}`} {
+		t.Run(arguments, func(t *testing.T) {
+			normalized, err := normalizeGetTeamsInput(json.RawMessage(arguments))
+			require.NoError(t, err)
+			assert.Equal(t, arguments, string(normalized))
+		})
+	}
+	for _, arguments := range []string{`{"user":null}`, `{"user": null }`} {
+		t.Run(arguments, func(t *testing.T) {
+			_, err := normalizeGetTeamsInput(json.RawMessage(arguments))
+			var inputError *inventory.ToolInputError
+			require.ErrorAs(t, err, &inputError)
+			assert.Equal(t, "parameter user is not of type string, is <nil>", inputError.Message)
+		})
+	}
+}
+
 func Test_GetTeamMembers_RequiredIdentifiersForDirectHandler(t *testing.T) {
 	t.Parallel()