Fix: streamable-http server: a supplied Mcp-Method contradicting an initialize body is silently accepted - #1275
Open
SIDDARTHAREDDY8 wants to merge 2 commits into
Conversation
github-actions
Bot
added
T-core
The two multiline assert!(validate_standard_headers(...)) calls fit within max_width=100, so nightly cargo fmt collapses them to single lines. Fixes the Code Formatting check on CI.
Author
|
Fixed the Code Formatting check failure: ran nightly |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1271.
Implemented the fix for modelcontextprotocol/rust-sdk issue #1271 in crates/rmcp/src/transport/streamable_http_server/tower.rs. In validate_standard_headers, the InitializeRequest arm no longer returns Ok(()) blindly: a supplied Mcp-Method header is now checked against the body method (initialize), tolerating absence but rejecting contradiction with a header_mismatch JSON-RPC error (HTTP 400), mirroring the existing validate_header_matches_init_body pattern used for MCP-Protocol-Version. Added HEADER_MCP_METHOD to the http_header imports, updated the function docstring, and added 3 unit tests in a new standard_header_init_tests module: header-contradicting (rejected), header-absent (accepted), header-matching (accepted). Pushed to SIDDARTHAREDDY8/rust-sdk branch oss-bhai-2026-09-15 (commit 508d989) against upstream base main, matching the repo CONTRIBUTING-required base. No Rust toolchain in this environment, so tests were not executed locally and must run in CI. PR-body note for the publisher: this change was developed with AI assistance; disclose that honestly (e.g. an Assisted-by trailer or PR-body statement) since maintainers here actively check AI-use disclosure.
Assisted-by: AI agent (Bhai), reviewed by maintainer of the contributing account.
Tests could not be run in this environment: No Rust toolchain exists in this environment, so cargo test could not be run; the 3 new unit tests must run in CI. Static verification was done instead (API signatures confirmed against upstream source, HEADER_MCP_METHOD import confirmed, brace/paren balance checked, pushed fork blob re-fetched and confirmed to contain the new initialize arm and all 3 tests).