modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #492 from koic/require_mcp_method_header_on_the_modern_path

Browse source 
Require the `Mcp-Method` header on the modern path
This commit is contained in:
Koichi ITO 2026-08-08 15:29:32 +09:00 • committed by GitHub
commit 2c3c3075b8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 73 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

38
lib/mcp/server/transports/streamable_http_transport.rb
View file

@ -634,23 +634,43 @@ module MCP
)
end
# `Mcp-Method` is required on every modern POST and `Mcp-Name` on the name-bearing methods:
# the spec lists a missing required standard header among the validation failures that MUST be rejected,
# and the TypeScript SDK enforces presence the same way. Absence cannot be treated as "nothing to compare":
# the headers exist so intermediaries can route without parsing bodies, and a client that omits them
# defeats that contract silently.
method_header = request.env["HTTP_MCP_METHOD"]
if method_header && method_header != body[:method]
if method_header.to_s.empty?
return header_mismatch_response(
"Mcp-Method header is required on the modern path",
body[:id],
)
end
if method_header != body[:method]
return header_mismatch_response(
"Mcp-Method header value '#{method_header}' does not match body value '#{body[:method]}'",
body[:id],
)
end
name_header = request.env["HTTP_MCP_NAME"]
if name_header && NAME_BEARING_METHODS.include?(body[:method])
if NAME_BEARING_METHODS.include?(body[:method])
body_name = params.is_a?(Hash) ? params[:name] || params[:uri] : nil
decoded_name = decode_header_value(name_header)
if body_name && decoded_name != body_name
return header_mismatch_response(
"Mcp-Name header value '#{decoded_name}' does not match body value '#{body_name}'",
body[:id],
)
name_header = request.env["HTTP_MCP_NAME"]
if body_name
if name_header.to_s.empty?
return header_mismatch_response(
"Mcp-Name header is required for `#{body[:method]}`",
body[:id],
)
end
decoded_name = decode_header_value(name_header)
if decoded_name != body_name
return header_mismatch_response(
"Mcp-Name header value '#{decoded_name}' does not match body value '#{body_name}'",
body[:id],
)
end
end
end