modelcontextprotocol/csharp-sdk
Watch
1
0
Fork
You've already forked csharp-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Reject mismatched initialize protocol versions (#1724)

Browse source 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Stephen Halter 2026-07-23 11:45:28 -07:00 • committed by GitHub
commit 9df7640172
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 39 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/ModelContextProtocol.AspNetCore/StreamableHttpHandler.cs
View file

@ -704,8 +704,8 @@ internal sealed class StreamableHttpHandler(
}
/// <summary>
/// Validates that HTTP requests using per-request metadata declare the same protocol version in both
/// the <c>MCP-Protocol-Version</c> header and body <c>_meta</c> envelope.
/// Validates that HTTP requests declare matching protocol versions in the
/// <c>MCP-Protocol-Version</c> header and the corresponding body field.
/// </summary>
private static bool ValidateProtocolVersionEnvelope(
HttpContext context,
@ -719,6 +719,18 @@ internal sealed class StreamableHttpHandler(
}
var protocolVersionHeader = context.Request.Headers[McpProtocolVersionHeaderName].ToString();
if (message is JsonRpcRequest { Method: RequestMethods.Initialize, Params: JsonObject initializeParams } &&
initializeParams["protocolVersion"] is JsonValue initializeProtocolVersionValue &&
initializeProtocolVersionValue.TryGetValue(out string? initializeProtocolVersion) &&
!string.IsNullOrEmpty(protocolVersionHeader) &&
!string.Equals(protocolVersionHeader, initializeProtocolVersion, StringComparison.Ordinal))
{
errorDetail = CreateHeaderMismatchError(
$"Bad Request: The {McpProtocolVersionHeaderName} header value '{protocolVersionHeader}' does not match body params.protocolVersion value '{initializeProtocolVersion}'.");
return false;
}
bool hasProtocolVersionMeta = TryGetProtocolVersionMeta(message, out var protocolVersionMeta);
if (!McpProtocolVersions.RequiresPerRequestMetadata(protocolVersionHeader) &&