MCP's empty-string cursor: the null check that hides most of a tool catalog

Two responses reach a C# client looking almost the same. One has no `nextCursor` field at all, which a nullable DTO renders as `null` and which means traversal is finished. The other carries `nextCursor` as the empty string, which means issue another request with the cursor set to `""` ^[5][7]. `string.IsNullOrEmpty` gives the same answer to both ^[7]. Nothing downstream looks wrong: the call succeeded, page one deserialized, the list is not empty, and no error mentions the pages that were never asked for ^[8].

The fixture in the writeup is three deterministic pages of one tool each. The first request omits the cursor, page one hands back `""`, page two hands back `opaque:/+==`, and page three omits the field entirely ^[9]. The falsy loop collects `catalog.search` and returns ^[10], which is one tool out of three, so two thirds of that catalog is invisible while the transport reports success ^[1].

The second cursor's punctuation is there on purpose: a client that decodes, trims, normalizes or reconstructs the token is breaking the same contract in a different place ^[16], and an unrecognized cursor is supposed to come back as `-32602`, the specification's recommended Invalid params response ^[17]. That is the loud variant. Someone gets paged for it. The empty-string variant produces no signal at all.

A nullable string models the field correctly, since absence maps to `null` while `""` stays non-null ^[13]. The distinction usually dies above the loop rather than inside it. A custom converter, a DTO mapper, or a convenience helper such as `NullIfEmpty` can flatten `""` to `null` before any pagination code runs ^[14]. So a reviewer can read a correct loop and still ship the truncation. The related trap is explicit JSON `null`, which sits outside the 2026-07-28 cursor schema, and which the author argues a strict mapper should reject rather than quietly treat as a terminator ^[15].

The corrected loop returns only when `NextCursor` is `null`, forwards both `""` and `opaque:/+==` without altering the string, and adds cancellation plus a page cap described as an application guard rather than anything inferred from the cursor ^[19]. The test discipline matters more than the loop shape: the author prefers assertions on the sequence of cursor values a client requested, because a final item count proves nothing when the server owns page size ^[11]. The sample runs eight checks with no MCP server, no credential, no model call, no clock and no random input ^[18], which is the property that makes it a regression test instead of an occasional red build. As a footnote on reading the excerpt literally, the JSON in the post is a pagination fragment; a conforming message still needs its JSON-RPC envelope and the `_meta` that every 2026-07-28 request requires, none of which changes the termination rule ^[20].