Merge pull request #352 from koic/document_initialize_protocol_version_authority

Document `initialize` body `protocolVersion` is authoritative on Streamable HTTP

lib/mcp/server/transports/streamable_http_transport.rb

@@ -342,6 +342,9 @@ module MCP
           body = parse_request_body(body_string)
           return body if parse_error_tuple?(body)
 
+          # The `MCP-Protocol-Version` header is only meaningful after negotiation, so on `initialize`
+          # the JSON-RPC body `params.protocolVersion` is authoritative and the header (if any) is ignored.
+          # This matches the TypeScript and Python SDKs.
           unless initialize_request?(body)
             return missing_session_id_response if !@stateless && !session_id
 

test/mcp/server/transports/streamable_http_transport_test.rb

@@ -1400,6 +1400,58 @@ module MCP
           assert_equal 200, response[0]
         end
 
+        test "POST initialize request negotiates body protocolVersion when header is an older supported version" do
+          older_version = "2025-06-18"
+          assert_includes Configuration::SUPPORTED_STABLE_PROTOCOL_VERSIONS, older_version
+          refute_equal Configuration::LATEST_STABLE_PROTOCOL_VERSION, older_version
+
+          request = create_rack_request(
+            "POST",
+            "/",
+            {
+              "CONTENT_TYPE" => "application/json",
+              "HTTP_MCP_PROTOCOL_VERSION" => older_version,
+            },
+            {
+              jsonrpc: "2.0",
+              method: "initialize",
+              id: "init",
+              params: { protocolVersion: Configuration::LATEST_STABLE_PROTOCOL_VERSION },
+            }.to_json,
+          )
+
+          response = @transport.handle_request(request)
+          assert_equal 200, response[0]
+          body = JSON.parse(response[2][0])
+          assert_equal Configuration::LATEST_STABLE_PROTOCOL_VERSION, body["result"]["protocolVersion"]
+        end
+
+        test "POST initialize request negotiates body protocolVersion when header is a newer supported version" do
+          older_version = "2025-06-18"
+          assert_includes Configuration::SUPPORTED_STABLE_PROTOCOL_VERSIONS, older_version
+          refute_equal Configuration::LATEST_STABLE_PROTOCOL_VERSION, older_version
+
+          request = create_rack_request(
+            "POST",
+            "/",
+            {
+              "CONTENT_TYPE" => "application/json",
+              "HTTP_MCP_PROTOCOL_VERSION" => Configuration::LATEST_STABLE_PROTOCOL_VERSION,
+            },
+            {
+              jsonrpc: "2.0",
+              method: "initialize",
+              id: "init",
+              params: { protocolVersion: older_version },
+            }.to_json,
+          )
+
+          response = @transport.handle_request(request)
+          assert_equal 200, response[0]
+          body = JSON.parse(response[2][0])
+          assert_equal older_version, body["result"]["protocolVersion"]
+        end
+
         test "POST request with unsupported MCP-Protocol-Version returns 400" do
           init_request = create_rack_request(
             "POST",