Fix #275: Reject uninitialized session requests with INVALID_REQUEST - #1069
Open
tanujkapoor-cmd wants to merge 1 commit into
Open
Fix #275: Reject uninitialized session requests with INVALID_REQUEST#1069tanujkapoor-cmd wants to merge 1 commit into
tanujkapoor-cmd wants to merge 1 commit into
Conversation
Copy link
Copy Markdown
Sorry, something went wrong.
…ith INVALID_REQUEST
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #275 by immediately rejecting requests sent before the session is fully initialized.
Motivation and Context
Right now, if a client accidentally sends a request (or notification) before completing the notifications/initialized handshake, the server just silently hangs. This happens because McpServerSession routes it to exchangeSink.asMono(), which waits forever since the sink only emits when the init notification arrives.
This PR fixes that silent failure by returning a proper JSON-RPC -32600 (INVALID_REQUEST) error instead. This gives client devs immediate feedback if they mess up the handshake order. I also added a quick logger.warn so server admins can see these rejections.
How Has This Been Tested?
I tested this locally by running the build and verifying the state machine logic in McpServerSession. Since this just intercepts the request before it hits the sink, it's a very straightforward guard clause.
Breaking Changes
No breaking changes. It just replaces an indefinite hang with a fast-fail error response.
Types of changes
Checklist
Additional context
I made sure to append the method name to the error message string to make it slightly easier to debug on the client side. Also double-checked the MCP spec to ensure rejecting pre-init messages with INVALID_REQUEST is fully compliant.