auditlogs_by_account_id returns "Expected object, received array"

[jonasb]

Client Information

• LLM Client: Claude Code CLI
• Client Config: .mcp.json with the following server configuration:

{
  "cloudflare-audit-logs": {
    "type": "http",
    "url": "https://auditlogs.mcp.cloudflare.com/mcp"
  }
}

• Using MCP Remote?: No
• MCP Server: https://auditlogs.mcp.cloudflare.com/mcp
• Prompt: "Can you check the audit logs and see if anything has occurred the last day"

Describe the bug

The auditlogs_by_account_id tool returns a validation error when querying audit logs. The MCP server's schema expects resource.response to be an object, but the Cloudflare Audit
Logs API returns an array for certain audit log entries, causing a complete failure to return any data.

Error logs:
Error reading audit logs: [
{
"code": "invalid_type",
"expected": "object",
"received": "array",
"path": ["result", 7, "resource", "response"],
"message": "Expected object, received array"
},
{
"code": "invalid_type",
"expected": "object",
"received": "array",
"path": ["result", 8, "resource", "response"],
"message": "Expected object, received array"
},
// ... repeated for result indices 9-17
]

To Reproduce

Steps to reproduce the behavior:

1. Connect to MCP Server https://auditlogs.mcp.cloudflare.com/mcp
2. Call tool auditlogs_by_account_id with parameters:
   {
   "since": "2026-01-05T00:00:00.000Z",
   "before": "2026-01-06T23:59:59.999Z",
   "limit": 100,
   "direction": "desc"
   }
3. Observe validation errors for multiple entries where resource.response is an array instead of an object

Expected behavior

The MCP server should successfully parse and return audit log entries regardless of whether resource.response is an object or array. The schema should be flexible enough to
handle both types, or the server should gracefully handle type mismatches and return partial results.

Additional context

• The error affects multiple consecutive entries (indices 7-17 in the test case)
• The underlying API call appears to succeed (HTTP 200), but response parsing fails
• This suggests certain types of audit events have different response structures
• The tool is currently completely unusable as the validation error prevents ANY audit log data from being returned
• Tested with @modelcontextprotocol/sdk version 1.25.1
• Date range queried: 24-hour period (2026-01-05 to 2026-01-06)