fix(oauth): send MCP-Protocol-Version on the executed authenticated r…

[ignaciojimenezr]

…eplay

The 2025-06-18 and 2025-11-25 debug OAuth machines previewed the MCP-Protocol-Version header on the post-token authenticated replay but omitted it from the request that actually went over the wire. The 2025-06-18 spec's Protocol Version Header section requires the header on all requests to the MCP server after initialization; 2026-07-28 already sent it on both. 2025-03-26 is deliberately untouched — that revision predates the header — and the new regression test locks in both the fix and the deliberate omission.

---

Summary by cubic

Fixes missing MCP-Protocol-Version header on the executed authenticated replay in OAuth debug flows. Aligns 2025-06-18 and 2025-11-25 machines with the spec and existing 2026-07-28 behavior.

• Bug Fixes
  • Add MCP-Protocol-Version to replay requests in debug-oauth-2025-06-18.ts and debug-oauth-2025-11-25.ts.
  • Keep 2025-03-26 machine unchanged (header predates that revision).
  • Add regression tests to assert header presence/absence per version and that the replay is authenticated.
  • Patch release for @mcpjam/sdk.

^{Written for commit 3a35062. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-09-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 60d5955a-d38e-409d-ab60-4d34cd3fb6dd

📥 Commits

Reviewing files that changed from the base of the PR and between 1d870d4 and 3a35062.

📒 Files selected for processing (4)

• .changeset/oauth-replay-protocol-version-header.md
• sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts
• sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts
• sdk/tests/oauth/hardening-shared-pass.test.ts

---

Walkthrough

OAuth authenticated MCP replay requests now include MCP-Protocol-Version for the 2025-06-18 and 2025-11-25 state machines. The 2025-03-26 state machine remains unchanged. Tests cover header behavior for all supported protocol versions and verify bearer-token authentication. A patch changeset documents the update.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts

Oops! Something went wrong! :(

ESLint: 8.57.1

YAMLException: Cannot read config file: /sdk/eslint.config.mjs
Error: end of the stream or a document separator is expected (10:20)

7 | ...tseslint.configs.recommended,
8 | prettier,
9 | {
10 | languageOptions: {
-------------------------^
11 | parserOptions: {
12 | project: ["./tsconfig.json", "./tests/tsco ...
at generateError (/node_modules/js-yaml/lib/loader.js:199:10)
at throwError (/node_modules/js-yaml/lib/loader.js:203:9)
at readDocument (/node_modules/js-yaml/lib/loader.js:1651:5)
at loadDocuments (/node_modules/js-yaml/lib/loader.js:1694:5)
at Object.load (/node_modules/js-yaml/lib/loader.js:1720:19)
at loadLegacyConfigFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2565:21)
at loadConfigFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2680:20)
at ConfigArrayFactory._loadConfigData (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2984:42)
at ConfigArrayFactory.loadFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2850:40)
at createCLIConfigArray (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:3660:35)

sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts

Oops! Something went wrong! :(

ESLint: 8.57.1

YAMLException: Cannot read config file: /sdk/eslint.config.mjs
Error: end of the stream or a document separator is expected (10:20)

7 | ...tseslint.configs.recommended,
8 | prettier,
9 | {
10 | languageOptions: {
-------------------------^
11 | parserOptions: {
12 | project: ["./tsconfig.json", "./tests/tsco ...
at generateError (/node_modules/js-yaml/lib/loader.js:199:10)
at throwError (/node_modules/js-yaml/lib/loader.js:203:9)
at readDocument (/node_modules/js-yaml/lib/loader.js:1651:5)
at loadDocuments (/node_modules/js-yaml/lib/loader.js:1694:5)
at Object.load (/node_modules/js-yaml/lib/loader.js:1720:19)
at loadLegacyConfigFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2565:21)
at loadConfigFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2680:20)
at ConfigArrayFactory._loadConfigData (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2984:42)
at ConfigArrayFactory.loadFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2850:40)
at createCLIConfigArray (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:3660:35)

sdk/tests/oauth/hardening-shared-pass.test.ts

Oops! Something went wrong! :(

ESLint: 8.57.1

YAMLException: Cannot read config file: /sdk/eslint.config.mjs
Error: end of the stream or a document separator is expected (10:20)

7 | ...tseslint.configs.recommended,
8 | prettier,
9 | {
10 | languageOptions: {
-------------------------^
11 | parserOptions: {
12 | project: ["./tsconfig.json", "./tests/tsco ...
at generateError (/node_modules/js-yaml/lib/loader.js:199:10)
at throwError (/node_modules/js-yaml/lib/loader.js:203:9)
at readDocument (/node_modules/js-yaml/lib/loader.js:1651:5)
at loadDocuments (/node_modules/js-yaml/lib/loader.js:1694:5)
at Object.load (/node_modules/js-yaml/lib/loader.js:1720:19)
at loadLegacyConfigFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2565:21)
at loadConfigFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2680:20)
at ConfigArrayFactory._loadConfigData (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2984:42)
at ConfigArrayFactory.loadFile (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2850:40)
at createCLIConfigArray (/soundcheck/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:3660:35)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Internal preview

Preview URL: https://mcp-inspector-pr-3657.up.railway.app
Deployed commit: a427e3d
PR head commit: 3a35062
Backend target: staging fallback.
Health: ✅ Convex reachable
Access is employee-only in non-production environments.

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}