Relax Accept header requirement for JSON-only responses #1500
Conversation
When is_json_response_enabled is True, servers only return application/json responses and never use SSE. This change relaxes the Accept header validation to only require application/json in this mode, rather than requiring both application/json and text/event-stream. This makes it easier to test JSON-only MCP servers with tools like curl, which is useful when developing and debugging MCP servers. For servers with is_json_response_enabled=False (SSE mode), the existing requirement for both content types is maintained.
felixweinberger
added
enhancement
Add tests to verify that JSON-only servers properly reject requests with: - Missing Accept header (returns 406) - Incorrect Accept header like text/event-stream only (returns 406) These tests address the validation failure cases requested in the PR review to ensure proper error handling for JSON-only server configurations.
|
@felixweinberger sounds good, have added tests for those |
There was a problem hiding this comment.
This looks allowed by the spec, though indirectly: https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#sending-messages-to-the-server
The client MUST include an Accept header, listing both application/json and text/event-stream as supported content types.
So technically speaking we should never even get into a situation where this is actually a problem as clients should always support both. However, JSON only servers are clearly allowed by this:
If the input is a JSON-RPC request, the server MUST either return Content-Type: text/event-stream, to initiate an SSE stream, or Content-Type: application/json, to return one JSON object. The client MUST support both these cases.
So relaxing the server-side requirement makes sense to me, though the benefit seems unclear right now. I guess we save a few keystrokes on curl not having to type both types?
felixweinberger
removed
the
needs more work
Summary
This PR relaxes the Accept header validation for servers with
is_json_response_enabled=True. These servers only returnapplication/jsonresponses and never use SSE, so they should only requireapplication/jsonin the Accept header rather than requiring bothapplication/jsonandtext/event-stream.Changes
_handle_post_requestto conditionally validate the Accept header based on response mode_validate_accept_headermethod to reduce complexityBenefits
curl