From 7fde7d34522f1ef9d48bf69866cea7d4ed10deff Mon Sep 17 00:00:00 2001 From: Guglielmo Colombo Date: Tue, 14 Jul 2026 12:13:40 +0200 Subject: [PATCH] mcp: reject calls to methodDiscover for `<20260728` requests (#1084) This PR adds a gate for requests towards methodDiscover if it is coming from a client that does not support the 20260728 protocol version --- mcp/server.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mcp/server.go b/mcp/server.go index 14adfad..3e6d95a 100644 --- a/mcp/server.go +++ b/mcp/server.go @@ -1883,6 +1883,12 @@ func (ss *ServerSession) handle(ctx context.Context, req *jsonrpc.Request) (any, // In case of methodDiscover call the state.initializeParams is populated // within the discover handle function to make sure the method is supported // when the user is probing a pre-2026-07-28 server. + if !validatedMeta.usesNewProtocol { + return nil, &jsonrpc.Error{ + Code: jsonrpc.CodeMethodNotFound, + Message: fmt.Sprintf("%q is only supported in protocol version >= %s", req.Method, protocolVersion20260728), + } + } default: if !initialized && !validatedMeta.usesNewProtocol { ss.server.opts.Logger.Error("method invalid during initialization", "method", req.Method)