Part of #5743 (Workstream B: 2025-11-25 compliance).
Gap
The proxies accept any MCP-Protocol-Version header value — isSupportedMCPVersion unconditionally returns true (pkg/transport/proxy/streamable/utils.go) — and no component validates versions anywhere. The spec says invalid/unsupported versions should get 400. Version-agnostic transparency is a defensible design stance for a proxy, but today it's undocumented and unconditional.
Proposed work
- Document the version-agnostic stance in
docs/arch/ (why the proxy forwards rather than enforces).
- Add an opt-in strict mode that validates
MCP-Protocol-Version per spec (400 on invalid/unsupported, assume 2025-03-26 when absent) for operators who want enforcement at the boundary.
- This becomes more relevant with 2026-07-28 dual-protocol operation, where behavior legitimately differs by version.
Priority: Low.
Part of #5743 (Workstream B: 2025-11-25 compliance).
Gap
The proxies accept any
MCP-Protocol-Versionheader value —isSupportedMCPVersionunconditionally returns true (pkg/transport/proxy/streamable/utils.go) — and no component validates versions anywhere. The spec says invalid/unsupported versions should get 400. Version-agnostic transparency is a defensible design stance for a proxy, but today it's undocumented and unconditional.Proposed work
docs/arch/(why the proxy forwards rather than enforces).MCP-Protocol-Versionper spec (400 on invalid/unsupported, assume 2025-03-26 when absent) for operators who want enforcement at the boundary.Priority: Low.