Skip to content

mcp: reject batches when no supported version allows them - #1514

Closed
emgeorrk wants to merge 1 commit into
modelcontextprotocol:mainfrom
emgeorrk:mcp-batch-without-version
Closed

emgeorrk wants to merge 1 commit into
modelcontextprotocol:mainfrom
emgeorrk:mcp-batch-without-version

Conversation

@emgeorrk

Copy link
Copy Markdown

Fixes #1513

A Streamable HTTP request without MCP-Protocol-Version is treated as 2025-03-26, so its JSON-RPC batch was accepted even when ServerOptions.SupportedProtocolVersions excluded every version before 2025-06-18. The same batch with an explicit MCP-Protocol-Version: 2025-03-26 header is rejected as an unsupported version.

servePOST now rejects such a batch with 400 when the server supports no version before 2025-06-18. Servers that still support 2025-03-26 or earlier, including the default configuration, keep accepting batches, and single messages without the header are unaffected.

Covered by the new table test TestStreamableServerBatchWithoutVersionHeader (stateful and stateless); gofmt, go vet, staticcheck and go test -race ./... pass.

I used Claude Code to help investigate this and write the patch; I reviewed the change and can explain it.

🤖 Generated with Claude Code

A request without MCP-Protocol-Version is treated as 2025-03-26, so
servePOST accepted its JSON-RPC batch even when
ServerOptions.SupportedProtocolVersions excluded every version before
2025-06-18, while the same batch with an explicit 2025-03-26 header was
rejected as an unsupported version.

Reject such batches with 400. Servers that still support 2025-03-26 or
earlier keep accepting them.

Fixes modelcontextprotocol#1513

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions github-actions Bot added the missing-issue-link Auto-closed: PR needs a linked issue assigned to its author (see CONTRIBUTING.md) label Nov 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

This PR has been closed automatically. This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue, and you aren't currently assigned to #1513.

You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned. There's no need to open a new PR either way.

Maintainers: reopen, remove missing-issue-link, or add bypass-issue-check to override.

@github-actions github-actions Bot closed this Nov 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

missing-issue-link Auto-closed: PR needs a linked issue assigned to its author (see CONTRIBUTING.md)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

mcp: batch without MCP-Protocol-Version is accepted when SupportedProtocolVersions excludes 2025-03-26

1 participant