Skip to content

fix(server): loosen Accept validation when enableJsonResponse is true#1952

Open
Zelys-DFKH wants to merge 1 commit intomodelcontextprotocol:mainfrom
Zelys-DFKH:fix/enable-json-response-accept-validation
Open

fix(server): loosen Accept validation when enableJsonResponse is true#1952
Zelys-DFKH wants to merge 1 commit intomodelcontextprotocol:mainfrom
Zelys-DFKH:fix/enable-json-response-accept-validation

Conversation

@Zelys-DFKH
Copy link
Copy Markdown

Summary

`WebStandardStreamableHTTPServerTransport` returns 406 when a client sends `Accept: application/json` (without `text/event-stream`) even when the transport is constructed with `enableJsonResponse: true`.

That's the wrong check. With `enableJsonResponse: true`, the server responds with a plain JSON body and never opens an SSE stream. Requiring the client to advertise `text/event-stream` is unnecessary: the media type isn't used, and it breaks clients that send a minimal `Accept: application/json` (a standard JSON-RPC default). The AdCP ecosystem currently works around this with an Express middleware that rewrites the header before the transport sees it.

`handlePostRequest` now reads `this._enableJsonResponse` when validating the Accept header:

  • `enableJsonResponse: true` → require only `application/json`
  • `enableJsonResponse: false` (default) → require both `application/json` and `text/event-stream`, same as before

This change doesn't touch the GET handler or the SSE response path. `NodeStreamableHTTPServerTransport` is covered as well since it delegates request handling to `WebStandardStreamableHTTPServerTransport`.

Test plan

  • `pnpm --filter @modelcontextprotocol/server test`: 57 tests pass (up from 55)
  • `pnpm --filter @modelcontextprotocol/server typecheck`: clean
  • New in `test/server/streamableHttp.test.ts` inside the existing `enableJsonResponse` describe block: a regression test confirms `Accept: application/json` alone now returns 200 (previously 406); a second test confirms `Accept: text/event-stream` alone still returns 406.

Fixes #1944

When enableJsonResponse is true, StreamableHTTPServerTransport responds
with a plain JSON body and never opens an SSE stream, so requiring
text/event-stream in the Accept header is incorrect. The check now only
requires application/json in that mode. Default SSE streaming mode is
unchanged: both media types are still required.

Fixes modelcontextprotocol#1944.
@Zelys-DFKH Zelys-DFKH requested a review from a team as a code owner April 23, 2026 18:55
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 23, 2026

🦋 Changeset detected

Latest commit: caee461

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages
Name Type
@modelcontextprotocol/server Patch
@modelcontextprotocol/express Patch
@modelcontextprotocol/fastify Patch
@modelcontextprotocol/hono Patch
@modelcontextprotocol/node Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Apr 23, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1952

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1952

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1952

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1952

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1952

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1952

commit: caee461

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

StreamableHTTPServerTransport rejects JSON-only Accept with 406 even when enableJsonResponse: true

1 participant