When a prompt argument has a completion provider, the values it offers represent the intended set of valid inputs. Currently the server does not validate that a client-supplied value is a member of that set before substituting it into the prompt template. ### What to fix For arguments backed by a completion provider, validate that the client-supplied value appears in `PromptArgumentCompletionProviderInterface::getCompletions()` before composing the prompt. Reject non-matching values as invalid parameters. ## What this is not Arguments without completion providers accept arbitrary text by design — this is intentional for free-form inputs. No permission gate is needed for that case. The concern that free-text arguments enable prompt injection does not hold: in the standard MCP flow the composed prompt is returned to the calling client, which already controls what it sends to its LLM. There is no injection attack surface at the server level. ### Scope Validation only. No new permissions, no changes to authorization flow.