FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix(server): parse Accept media types exactly by SnowSky1 · Pull Request #2481 · modelcontextprotocol/typescript-sdk · GitHub

/ typescript-sdk Public

fix(server): parse Accept media types exactly - #2481

Open
SnowSky1 wants to merge 3 commits into
modelcontextprotocol:mainfrom
SnowSky1:fix/accept-header-media-types
ConversationCommits (3)ChecksFiles changed
Open

fix(server): parse Accept media types exactly#2481
SnowSky1 wants to merge 3 commits into
modelcontextprotocol:mainfrom
SnowSky1:fix/accept-header-media-types

Conversation

SnowSky1 commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Fixes #2480.

Summary

Streamable HTTP server Accept validation used raw substring checks, so values such as application/jsonx and text/event-stream-bogus incorrectly satisfied the required concrete media types. This affected both POST negotiation and GET SSE requests.

This change:

  • adds an internal listsMediaType helper that parses the comma-separated Accept list and compares media-type essences case-insensitively;
  • handles parameters and quoted parameter values without splitting on commas inside quoted strings;
  • requires a positive RFC 9110 quality value, so a required media type with q=0 is not treated as supported;
  • updates GET and POST Streamable HTTP validation to use exact media-type matching;
  • adds regression coverage for substring false positives, valid case/parameter variants, quoted commas, zero/invalid quality values, wildcards, and missing headers;
  • includes a patch changeset for the server and core-internal packages.

This follows the same parsed-media-type approach recently applied to Content-Type in #2441 / #2444, while keeping Accept-specific list parsing internal.

Testing

Validated after merging current main (70de0c8b):

  • pnpm --filter @modelcontextprotocol/core-internal exec vitest run test/shared/mediaType.test.ts — 12 passing
  • pnpm --filter @modelcontextprotocol/server exec vitest run test/server/streamableHttp.test.ts — 61 passing
  • core-internal and server typechecks — clean
  • core-internal and server lint/format checks — clean
  • full workspace typecheck, lint, and formatting — clean
  • pnpm build:all — clean

The remaining platform-local check:all docs step is covered by CI; TypeDoc rejects native Windows backslash entry-point globs before documentation generation.

SnowSky1 requested a review from a team as a code owner July 13, 2026 02:15

changeset-bot Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 1b4079e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages
Name Type
@modelcontextprotocol/server Patch
@modelcontextprotocol/core-internal Patch
@modelcontextprotocol/core Patch
@modelcontextprotocol/client Patch
@modelcontextprotocol/server-legacy Patch
@modelcontextprotocol/codemod Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2481

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2481

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2481

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2481

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2481

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2481

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2481

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2481

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2481

commit: 1b4079e

SnowSky1 force-pushed the fix/accept-header-media-types branch from 9f897d9 to e3715bc Compare July 30, 2026 15:59

SnowSky1 commented Jul 30, 2026

Copy link
Copy Markdown
Author

Rebased onto current main. Revalidated the touched packages: core-internal media-type tests 11/11 pass, server streamable HTTP tests 55/55 pass, and both package typechecks are clean. The repository pre-push hook also completed the full workspace build, lint, and typecheck successfully. CI is rerunning now.

SnowSky1 commented Jul 30, 2026

Copy link
Copy Markdown
Author

@felixweinberger, when you have a chance, could you review this? It complements #2441 by applying exact media-type parsing to Accept; the branch is rebased onto current main, mergeable, and all CI checks are green.

claude Bot added the v2 Ideas, requests and plans for v2 of the SDK which will incorporate major changes and fixes label Aug 18, 2026
SnowSky1 force-pushed the fix/accept-header-media-types branch from e3715bc to 63fb4ad Compare August 19, 2026 07:24
fix(server): parse Accept media types exactly
bf3bfcb 
Reject Streamable HTTP requests whose Accept values only contain the required media types as substrings, while preserving case-insensitive and parameterized values. Adds GET/POST regression coverage. Fixes modelcontextprotocol#2480.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
SnowSky1 force-pushed the fix/accept-header-media-types branch from 63fb4ad to bf3bfcb Compare August 25, 2026 15:04

SnowSky1 commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Rebased again onto current main (head bf3bfcb). The branch is mergeable and no longer behind; all 14 checks are green, including build, examples E2E, Node 20/22/24 unit and E2E suites, Bun/Deno runtime tests, and client/server conformance.

@felixweinberger, when you have bandwidth, could you review this focused Accept media-type parsing fix?

SnowSky1 commented Aug 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Merged current main (70de0c8b) into the branch; the PR is mergeable and no longer behind.

The latest head also respects RFC 9110 quality exclusions: a required media type with q=0 is not treated as supported, while positive quality values remain accepted.

All 14 checks are green at head 1b4079e6, including Node 20/22/24 unit and E2E suites, Bun/Deno runtime tests, client/server conformance, build, examples E2E, and continuous package publishing.

The focused current-head suites also pass locally: core-internal media-type tests 12/12 and server Streamable HTTP tests 61/61.

The corresponding v1.x backport is ready as draft #2738, with all applicable CI checks green.

@felixweinberger, this is the remaining Accept-header counterpart to the parsed Content-Type validation from #2441/#2444. Could you review when available?

SnowSky1 mentioned this pull request Aug 29, 2026
Draft
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

v2 Ideas, requests and plans for v2 of the SDK which will incorporate major changes and fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Streamable HTTP server accepts invalid media types by Accept-header substring

1 participant

Back | FazBrowse Home | New Git URL