modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

mcp: add MCPGPDEBUG for opt-in Content-Type check (#1012)

Browse source 
Copy of existing
[PR](https://github.com/modelcontextprotocol/go-sdk/pull/972) patching
1.6.0 version
This commit is contained in:
Guglielmo Colombo 2026-06-17 11:41:35 +02:00 • committed by GitHub
commit 71ffcb412a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 27 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/mcpgodebug.md
View file

@ -50,6 +50,15 @@ Options listed below were added and will be removed in the 1.9.0 version of the
restoring the previous behavior. The default behavior was changed so that
the client always attempts to surface the underlying JSON-RPC error.
### 1.6.1
Options listed below were added and will be removed in the 1.8.0 version of the SDK.
- `disablecontenttypecheck` added. If set to `1`, Content-Type validation on
HTTP POST requests will be disabled, allowing requests with non-JSON or missing
Content-Type headers. The default behavior is to validate that HTTP POST
requests have Content-Type: application/json.
### 1.6.0
Options listed below were added and will be removed in the 1.8.0 version of the SDK.

9
internal/docs/mcpgodebug.src.md
View file

@ -49,6 +49,15 @@ Options listed below were added and will be removed in the 1.9.0 version of the
restoring the previous behavior. The default behavior was changed so that
the client always attempts to surface the underlying JSON-RPC error.
### 1.6.1
Options listed below were added and will be removed in the 1.8.0 version of the SDK.
- `disablecontenttypecheck` added. If set to `1`, Content-Type validation on
HTTP POST requests will be disabled, allowing requests with non-JSON or missing
Content-Type headers. The default behavior is to validate that HTTP POST
requests have Content-Type: application/json.
### 1.6.0
Options listed below were added and will be removed in the 1.8.0 version of the SDK.

2
mcp/sse.go
View file

@ -202,7 +202,7 @@ func (h *SSEHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
}
// Validate 'Content-Type' header.
if req.Method == http.MethodPost {
if disablecontenttypecheck != "1" && req.Method == http.MethodPost {
mediaType, _, err := mime.ParseMediaType(req.Header.Get("Content-Type"))
if err != nil || mediaType != "application/json" {
http.Error(w, "Content-Type must be 'application/json'", http.StatusUnsupportedMediaType)

10
mcp/streamable.go
View file

@ -271,6 +271,12 @@ var allowsessionsinstateless = mcpgodebug.Value("allowsessionsinstateless")
// the client always attempts to surface the underlying JSON-RPC error.
var noprotocolerrorbody = mcpgodebug.Value("noprotocolerrorbody")
// disablecontenttypecheck is a compatibility parameter that allows to disable
// Content-Type validation on POST requests.
// See the documentation for the mcpgodebug package for instructions how to enable it.
// The option will be removed in the 1.8.0 version of the SDK.
var disablecontenttypecheck = mcpgodebug.Value("disablecontenttypecheck")
// writeJSONRPCError writes a JSON-RPC error response with the given HTTP
// status code, request ID (may be a zero ID for errors that occur before the
// request body has been parsed), and JSON-RPC error.
@ -342,7 +348,7 @@ func (h *StreamableHTTPHandler) serveStateless(w http.ResponseWriter, req *http.
return
}
if baseMediaType(req.Header.Get("Content-Type")) != "application/json" {
if disablecontenttypecheck != "1" && baseMediaType(req.Header.Get("Content-Type")) != "application/json" {
http.Error(w, "Content-Type must be 'application/json'", http.StatusUnsupportedMediaType)
return
}
@ -560,7 +566,7 @@ func (h *StreamableHTTPHandler) serveStatefulDELETE(w http.ResponseWriter, req *
// ID, a new session is created (this is the normal path for the first
// initialize request).
func (h *StreamableHTTPHandler) serveStatefulPOST(w http.ResponseWriter, req *http.Request) {
if baseMediaType(req.Header.Get("Content-Type")) != "application/json" {
if disablecontenttypecheck != "1" && baseMediaType(req.Header.Get("Content-Type")) != "application/json" {
http.Error(w, "Content-Type must be 'application/json'", http.StatusUnsupportedMediaType)
return
}