ruby-sdk/lib
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Koichi ITO 88d9bed69d Reject POST requests without session ID in stateful mode
Per the MCP specification (Streamable HTTP > Session Management):

> Servers that require a session ID SHOULD respond to requests without an `Mcp-Session-Id` header
> (other than initialization) with HTTP 400 Bad Request.

https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management

Previously, non-initialize POST requests without `Mcp-Session-Id` in stateful mode were processed
with HTTP 200 (for regular requests) or HTTP 202 (for notifications/responses).

This change adds an explicit check in `handle_post` to return HTTP 400 Bad Request when the session
ID is missing in stateful mode for all non-initialize requests, aligning with the specification.
2026-03-28 03:07:42 +09:00
..
mcp Reject POST requests without session ID in stateful mode 2026-03-28 03:07:42 +09:00
json_rpc_handler.rb Add logging support 2026-01-26 22:23:46 +09:00
mcp.rb Use autoload to defer loading of unused subsystems 2026-03-12 14:08:27 +09:00