modelcontextprotocol/ruby-sdk
Watch
1
0
Fork
You've already forked ruby-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require the Mcp-Method header on the modern path

Browse source 
## Motivation and Context

The modern Streamable HTTP path validated the SEP-2243 mirror headers only when present:
an absent `Mcp-Method` or `Mcp-Name` was silently tolerated. The 2026-07-28 specification
requires `Mcp-Method` on every request and `Mcp-Name` on `tools/call`, `resources/read`,
and `prompts/get`, and lists a missing required standard header among the validation failures
a server MUST reject; the TypeScript SDK enforces presence with `-32020` the same way.
Tolerating absence also defeats the headers' purpose silently: they exist so intermediaries
can route and inspect requests without parsing bodies.

A modern POST without `Mcp-Method`, or a name-bearing modern POST whose body carries
a target name without `Mcp-Name`, now answers HTTP 400 with `-32020` naming the missing header,
exactly like a mismatch. `Mcp-Name` stays unrequired when the body carries no target name,
matching the TypeScript SDK. The bundled `MCP::Client::HTTP` already sends both headers on
every modern request, so SDK-to-SDK traffic is unaffected.

## How Has This Been Tested?

New tests in `test/mcp/server/transports/streamable_http_transport_test.rb` cover
the missing `Mcp-Method` and missing `Mcp-Name` rejections, asserting the `-32020` code
and the header name in the message. The `modern_rack_request` helper now mirrors
a conforming client by deriving `Mcp-Method` from the body (with `method_header: nil` to omit it),
so the existing modern-path tests exercise the requirement on every request.

## Breaking Changes

None for conforming clients, which must already send these headers.
Hand-rolled modern clients that omitted them are now rejected with `-32020` instead of being served;
add the headers, or use the legacy lifecycle, to proceed.
This commit is contained in:
Koichi ITO 2026-08-08 03:06:55 +09:00
commit 5f3a131e1a
1 changed files with 73 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

38
lib/mcp/server/transports/streamable_http_transport.rb
View file

@ -593,23 +593,43 @@ module MCP
)
end
# `Mcp-Method` is required on every modern POST and `Mcp-Name` on the name-bearing methods:
# the spec lists a missing required standard header among the validation failures that MUST be rejected,
# and the TypeScript SDK enforces presence the same way. Absence cannot be treated as "nothing to compare":
# the headers exist so intermediaries can route without parsing bodies, and a client that omits them
# defeats that contract silently.
method_header = request.env["HTTP_MCP_METHOD"]
if method_header && method_header != body[:method]
if method_header.to_s.empty?
return header_mismatch_response(
"Mcp-Method header is required on the modern path",
body[:id],
)
end
if method_header != body[:method]
return header_mismatch_response(
"Mcp-Method header value '#{method_header}' does not match body value '#{body[:method]}'",
body[:id],
)
end
name_header = request.env["HTTP_MCP_NAME"]
if name_header && NAME_BEARING_METHODS.include?(body[:method])
if NAME_BEARING_METHODS.include?(body[:method])
body_name = params.is_a?(Hash) ? params[:name] || params[:uri] : nil
decoded_name = decode_header_value(name_header)
if body_name && decoded_name != body_name
return header_mismatch_response(
"Mcp-Name header value '#{decoded_name}' does not match body value '#{body_name}'",
body[:id],
)
name_header = request.env["HTTP_MCP_NAME"]
if body_name
if name_header.to_s.empty?
return header_mismatch_response(
"Mcp-Name header is required for `#{body[:method]}`",
body[:id],
)
end
decoded_name = decode_header_value(name_header)
if decoded_name != body_name
return header_mismatch_response(
"Mcp-Name header value '#{decoded_name}' does not match body value '#{body_name}'",
body[:id],
)
end
end
end