You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The streamable HTTP spec requires the server to answer with 400 Bad Request when the client sends an unsupported MCP-Protocol-Version header, and to accept the request when the header is missing (falling back to the negotiated version). The Servlet-based providers never read this header.
This change validates the MCP-Protocol-Version header in doGet, doPost, and doDelete of HttpServletStreamableServerTransportProvider and in doPost of HttpServletStatelessServerTransport, rejecting unsupported versions with a 400 JSON error response consistent with the existing error style.
Tests cover the version-header matrix (supported version accepted, unsupported version rejected, missing header accepted) across both providers.
Heads-up on overlap: #1112 implements SEP-2243 end to end for the servlet transports, including the MCP-Protocol-Version validation this PR adds, following the ask in #990 to land the SEP as one piece. It exempts initialize and returns INVALID_REQUEST on an unsupported version. If you would rather carry the protocol-version part yourself, say so and I will drop that slice from #1112.
Thanks for the heads-up — understood. If #1112's SEP-2243 implementation covers the MCP-Protocol-Version validation for the servlet transports with equivalent rejection behavior, this PR is redundant and I'm happy to close it in favor of landing the SEP as one piece. If you'd rather keep a narrower stopgap until #1112 merges, the diff here is self-contained (servlet transport providers + tests only) — your call either way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The streamable HTTP spec requires the server to answer with 400 Bad Request when the client sends an unsupported MCP-Protocol-Version header, and to accept the request when the header is missing (falling back to the negotiated version). The Servlet-based providers never read this header.
This change validates the MCP-Protocol-Version header in doGet, doPost, and doDelete of
HttpServletStreamableServerTransportProviderand in doPost ofHttpServletStatelessServerTransport, rejecting unsupported versions with a 400 JSON error response consistent with the existing error style.Tests cover the version-header matrix (supported version accepted, unsupported version rejected, missing header accepted) across both providers.