An unknown tool name can crash a LangGraph validation loop

A LangGraph report shows ValidationNode raising KeyError when an AI message names a tool outside its registered schemas. The node's stated purpose is to return validation content or error messages so the model can correct a bad call, but this lookup happens before the catch path. The issue also notes that ValidationNode is deprecated. For an agent workflow, the failure turns a recoverable model mistake into a run error.

Reproduce the boundary explicitly

Create one registered schema and send a call with an unknown name, as in the issue's minimal example. Record whether the node returns an error ToolMessage or raises, and pin the installed langgraph-prebuilt version. Include malformed arguments for a known tool as a control case. That distinction reveals whether the problem is name dispatch or general validation.

Keep tool access deterministic

Before executing or validating, compare the model's requested name against the allowed tool registry for that run. Unknown names should produce a bounded, user-safe error and a reprompt, never a fallback to a similarly named tool. Keep the allowlist and the model's advertised tools generated from the same source. ToolNode's reference describes the current prebuilt execution path; do not assume it is a drop-in replacement for a custom validation loop without testing message shapes.

Choose a migration path

Because the reported node is deprecated, assess a supported tool execution and validation design rather than depending on a future patch. Test an unknown name, missing required argument, forbidden action, and repeated invalid call. Stop after a small retry budget and surface a clear failure to the reviewer instead of looping indefinitely.

Adovo’s view

A model's tool name is untrusted input. An agent is reliable when bad input reaches a controlled decision, not a traceback. The registry must be the boundary that makes that decision.