Repository navigation
Conversation
The released 2026-07-28 Streamable HTTP text (Server Validation) says servers rejecting a request for a header validation failure "MUST return HTTP status 400 Bad Request and MUST include a JSON-RPC error response" with -32020 (HeaderMismatch); the second MUST was a SHOULD before modelcontextprotocol/modelcontextprotocol#2863. sep-2243-server-reject-error-code still graded the standard-header cases as WARNING, so a server answering 400 with any other code passed http-header-validation outright, since the server runner does not count warnings. Every rejection now reports FAILURE without -32020, so the severity option on createRejectionChecks has no remaining WARNING caller and is removed.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #553.
The standard-header cases in
http-header-validationgrade the-32020error code as a SHOULD (errorCodeSeverity: 'WARNING'). The released 2026-07-28 Server Validation text makes it a MUST, for standard and custom headers alike:That second MUST was a SHOULD until modelcontextprotocol/modelcontextprotocol#2863. The scenario description already says MUST; only the grading lagged. Because the server runner doesn't count warnings, a server that rejects correctly but with a different code passes outright:
With every caller now wanting FAILURE, the
errorCodeSeverityoption oncreateRejectionChecksis removed rather than left with a single value.sep-2243.yamlis updated to match.Tests: two cases in
negative.test.tsrun the scenario against an inline server that validates the headers correctly. Rejecting with-32020, every check passes. Rejecting with-32600, the five status checks pass and the five error-code checks fail; that case fails on main.npm run check,npm run buildandnpm test(643) pass. The scenario is still pending for the everything-server, which doesn't do SEP-2243 validation yet, so CI results for the reference server don't change.AI disclosure per AI_POLICY.md: the investigation, code and tests were done primarily with Claude Code. The numbers above are from local runs.