Repository navigation
[Server] Reject JSON-RPC batch requests - #424
ez-lbz wants to merge 3 commits into
Conversation
Sorry, something went wrong.
MCP no longer supports JSON-RPC batches: a POST body must be a single JSON-RPC message. MessageFactory currently accepts top-level arrays and hydrates each entry, so a batch is handled as a set of messages instead of being refused outright. Reject any top-level array as invalid input before any entry is hydrated, and drop the now-dead maxBatchSize cap and its constructor parameter. Update the affected unit tests and the transports docs to match.
chr-hertel
left a comment
There was a problem hiding this comment.
Hi @ez-lbz, thanks for bringing this up - this will simplify that part message handling quite a bit :)
Sorry, something went wrong.
| * @return array<MessageInterface|InvalidInputMessageException> | ||
| * | ||
| * @throws \JsonException When the input string is not valid JSON | ||
| */ | ||
| public function create(string $input): array |
There was a problem hiding this comment.
this can be simplified even further now:
| * @throws InvalidInputMessageException When the input data is not a valid message | |
| * @throws \JsonException When the input string is not valid JSON | |
| */ | |
| public function create(string $input): MessageInterface |
Sorry, something went wrong.
| $batch = $data; | ||
| } else { | ||
| $batch = [$data]; | ||
| return [new InvalidInputMessageException('JSON-RPC batch requests are not supported; send a single JSON-RPC message.')]; |
There was a problem hiding this comment.
| return [new InvalidInputMessageException('JSON-RPC batch requests are not supported; send a single JSON-RPC message.')]; | |
| return [new InvalidInputMessageException('JSON-RPC batch requests are not supported anymore since specification release 2025-06-18; send a single JSON-RPC message.')]; |
Sorry, something went wrong.
|
Thanks for the review! Applied the suggestion to reference the spec release that removed batches in the error message (commit 752c430). The maxBatchSize parameter and cap were already removed as dead code in the original change. |
Sorry, something went wrong.
|
Putting this on hold for now - the spec version 2025-06-18 removed batch support but we currently still support that version. Will check back, in my understanding we only need to support the current and two older versions, but need to check back. Anyhow, when we tackle this, we should go even one step further and change the method profile to Mcp\JsonRpc\MessageFactory::create(string $input): MessageInterface |
Sorry, something went wrong.
This branch has not been deployed
Reviewers
Requested changes must be addressed to merge this pull request.
MCP no longer supports JSON-RPC batches: a POST body must be a single JSON-RPC message. MessageFactory currently accepts top-level arrays and hydrates each entry, so a batch is processed as a set of messages instead of being refused outright.
This change rejects any top-level array as invalid input before any entry is hydrated, returning a single InvalidInputMessageException (the existing per-message error contract) instead of processing the batch. The now-dead maxBatchSize cap, its constructor parameter, and DEFAULT_MAX_BATCH_SIZE are removed.
Tests: