fix(server): validate Content-Type by parsed media type instead of substring match (#2441)

packages/server/src/server/createMcpHandler.ts

@@ -41,6 +41,8 @@ import {
     CLIENT_CAPABILITIES_META_KEY,
     CLIENT_INFO_META_KEY,
     httpStatusForErrorCode,
+    isJsonContentType,
+    mediaTypeEssence,
     missingClientCapabilities,
     MissingRequiredClientCapabilityError,
     modernOnlyStrictRejection,
@@ -330,7 +332,7 @@ export function legacyStatelessFallback(factory: McpServerFactory, onerror?: (er
                 ...(options?.authInfo !== undefined && { authInfo: options.authInfo }),
                 ...(options?.parsedBody !== undefined && { parsedBody: options.parsedBody })
             });
-            if (response.body === null || !(response.headers.get('content-type') ?? '').includes('text/event-stream')) {
+            if (response.body === null || mediaTypeEssence(response.headers.get('content-type')) !== 'text/event-stream') {
                 // Non-streaming exchange (a buffered JSON body or a body-less
                 // ack): the response is complete, release the pair now.
                 teardown();
@@ -483,7 +485,11 @@ async function classifyEntryRequest(request: Request, providedParsedBody?: unkno
  * This is the entry's own classification step exported as a predicate — it
  * runs exactly the code `createMcpHandler` runs to make the routing decision,
  * not a re-implementation — so a hand-wired composition that branches on it
- * can never disagree with the entry. Use it to keep an existing legacy
+ * can never disagree with the entry. It is classification only: hand-wired
+ * compositions must validate Content-Type themselves (415 for POSTs whose
+ * media type is not `application/json`, via {@linkcode isJsonContentType})
+ * before dispatching either leg — routing the legacy leg into the SDK
+ * transports gets their built-in check, but a custom modern leg has none. Use it to keep an existing legacy
  * deployment (for example a sessionful streamable HTTP wiring) serving 2025
  * traffic next to a strict modern endpoint, now that the entry has no
  * handler-valued `legacy` option:
@@ -574,7 +580,10 @@ export async function isLegacyRequest(request: Request, parsedBody?: unknown): P
  * pattern. Power users composing transport-neutral routing can also use the
  * exported building blocks directly: {@linkcode classifyInboundRequest} for
  * the era decision and `PerRequestHTTPServerTransport` for single-exchange
- * serving.
+ * serving — such compositions must reject POSTs whose Content-Type media type
+ * is not `application/json` (415) before parsing the body, using
+ * {@linkcode isJsonContentType}; neither building block performs this
+ * validation itself.
  *
  * The entry performs no token verification: `authInfo` given to `fetch` is
  * passed through to handlers and the factory as-is and is never derived from
@@ -817,6 +826,18 @@ export function createMcpHandler(factory: McpServerFactory, options: CreateMcpHa
 
     async function handle(request: Request, requestOptions?: McpHandlerRequestOptions): Promise<Response> {
         const authInfo = requestOptions?.authInfo;
+
+        // Content-Type check, answered before the body is read (parsed media
+        // type — see isJsonContentType). Load-bearing for the modern leg,
+        // whose ladder does not inspect Content-Type; the legacy transport
+        // keeps its own check for hand-wired use, so via this entry a
+        // doubly-invalid request answers 415 here before the transport's 406
+        // Accept check would.
+        if (request.method.toUpperCase() === 'POST' && !isJsonContentType(request.headers.get('content-type'))) {
+            reportError(new Error('Unsupported Media Type: Content-Type must be application/json'));
+            return jsonRpcErrorResponse(415, -32_000, 'Unsupported Media Type: Content-Type must be application/json');
+        }
+
         const classified = await classifyEntryRequest(request, requestOptions?.parsedBody);
 
         if (classified.step === 'unreadable-body') {

packages/server/src/server/perRequestTransport.ts

@@ -32,6 +32,10 @@
  * `createMcpHandler`) inherit the spec's per-error HTTP mandate with it: a
  * terminal `MissingRequiredClientCapabilityError` (-32021) MUST answer 400,
  * which this transport applies whenever the response is still uncommitted.
+ * A custom entry must also reject POSTs whose Content-Type media type is not
+ * `application/json` (415) before parsing the body — use `isJsonContentType`
+ * from the package root; this transport never sees the HTTP headers, so it
+ * cannot perform that validation itself.
  */
 import type {
     AuthInfo,

packages/server/src/server/streamableHttp.ts

@@ -11,6 +11,7 @@ import type { AuthInfo, JSONRPCMessage, MessageExtraInfo, RequestId, Transport }
 import {
     DEFAULT_NEGOTIATED_PROTOCOL_VERSION,
     isInitializeRequest,
+    isJsonContentType,
     isJSONRPCErrorResponse,
     isJSONRPCRequest,
     isJSONRPCResultResponse,
@@ -680,6 +681,8 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
             // Validate the Accept header
             const acceptHeader = req.headers.get('accept');
             // The client MUST include an Accept header, listing both application/json and text/event-stream as supported content types.
+            // Accept is a comma-separated list, so a substring check is the intended semantics here (unlike Content-Type below).
+            // eslint-disable-next-line no-restricted-syntax
             if (!acceptHeader?.includes('application/json') || !acceptHeader.includes('text/event-stream')) {
                 this.onerror?.(new Error('Not Acceptable: Client must accept both application/json and text/event-stream'));
                 return this.createJsonErrorResponse(
@@ -689,8 +692,12 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
                 );
             }
 
+            // Parsed media type, never a substring match — see
+            // isJsonContentType. This check stays here for hand-wired
+            // transports; via createMcpHandler the entry's own check answers
+            // first.
             const ct = req.headers.get('content-type');
-            if (!ct || !ct.includes('application/json')) {
+            if (!isJsonContentType(ct)) {
                 this.onerror?.(new Error('Unsupported Media Type: Content-Type must be application/json'));
                 return this.createJsonErrorResponse(415, -32_000, 'Unsupported Media Type: Content-Type must be application/json');
             }

packages/server/test/server/contentTypeValidation.test.ts

@@ -0,0 +1,186 @@
+/**
+ * Content-Type validation at the HTTP entries — the parsed media type decides,
+ * never a substring search of the raw header.
+ *
+ * The shape pinned here: `Content-Type: text/plain; a=application/json`
+ * contains the substring `application/json`, but its media type is
+ * `text/plain` — every entry must answer it (and any other non-JSON media
+ * type) with 415 before the body is dispatched, while values whose media type
+ * is `application/json` keep working regardless of parameters or case.
+ */
+import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, PROTOCOL_VERSION_META_KEY } from '@modelcontextprotocol/core-internal';
+import { beforeEach, describe, expect, it } from 'vitest';
+import * as z from 'zod/v4';
+
+import { createMcpHandler } from '../../src/server/createMcpHandler';
+import { McpServer } from '../../src/server/mcp';
+import { WebStandardStreamableHTTPServerTransport } from '../../src/server/streamableHttp';
+
+const MODERN_REVISION = '2026-07-28';
+
+const executed: string[] = [];
+
+function factory(): McpServer {
+    const mcpServer = new McpServer({ name: 'ct-fixture', version: '1.0.0' });
+    mcpServer.registerTool('run', { description: 'records each dispatch', inputSchema: { cmd: z.string() } }, async ({ cmd }) => {
+        executed.push(cmd);
+        return { content: [{ type: 'text', text: `ran: ${cmd}` }] };
+    });
+    return mcpServer;
+}
+
+const LEGACY_CALL = {
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'tools/call',
+    params: { name: 'run', arguments: { cmd: 'hello' } }
+};
+
+const MODERN_CALL = {
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'tools/call',
+    params: {
+        name: 'run',
+        arguments: { cmd: 'hello' },
+        _meta: {
+            [PROTOCOL_VERSION_META_KEY]: MODERN_REVISION,
+            [CLIENT_INFO_META_KEY]: { name: 'ct-client', version: '1.0.0' },
+            [CLIENT_CAPABILITIES_META_KEY]: {}
+        }
+    }
+};
+
+function postRequest(body: unknown, headers: Record<string, string>): Request {
+    return new Request('http://127.0.0.1/mcp', {
+        method: 'POST',
+        headers: {
+            Accept: 'application/json, text/event-stream',
+            ...headers
+        },
+        body: JSON.stringify(body)
+    });
+}
+
+beforeEach(() => {
+    executed.length = 0;
+});
+
+describe('createMcpHandler Content-Type validation (default options, legacy stateless fallback active)', () => {
+    it('serves an application/json POST (control)', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(postRequest(LEGACY_CALL, { 'Content-Type': 'application/json' }));
+        expect(response.status).toBe(200);
+        expect(executed).toEqual(['hello']);
+    });
+
+    it('accepts application/json with parameters', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(postRequest(LEGACY_CALL, { 'Content-Type': 'application/json; charset=utf-8' }));
+        expect(response.status).toBe(200);
+        expect(executed).toEqual(['hello']);
+    });
+
+    it('rejects text/plain with 415', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(postRequest(LEGACY_CALL, { 'Content-Type': 'text/plain' }));
+        expect(response.status).toBe(415);
+        expect(executed).toEqual([]);
+    });
+
+    it('rejects a non-JSON media type whose parameters contain `application/json` and does not dispatch', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(postRequest(LEGACY_CALL, { 'Content-Type': 'text/plain; a=application/json' }));
+        expect(response.status).toBe(415);
+        const body = (await response.json()) as { error: { code: number; message: string } };
+        expect(body.error.code).toBe(-32_000);
+        expect(body.error.message).toContain('Content-Type must be application/json');
+        expect(executed).toEqual([]);
+    });
+
+    it('rejects a POST with no Content-Type header with 415', async () => {
+        const handler = createMcpHandler(factory);
+        // A string body makes Request auto-attach `text/plain;charset=UTF-8`;
+        // delete it so this actually exercises the absent-header branch.
+        const request = postRequest(LEGACY_CALL, {});
+        request.headers.delete('content-type');
+        expect(request.headers.get('content-type')).toBeNull();
+        const response = await handler.fetch(request);
+        expect(response.status).toBe(415);
+        expect(executed).toEqual([]);
+    });
+
+    it('accepts an unambiguous media type with a malformed parameter section (trailing semicolon)', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(postRequest(LEGACY_CALL, { 'Content-Type': 'application/json;' }));
+        expect(response.status).toBe(200);
+        expect(executed).toEqual(['hello']);
+    });
+
+    it('rejects joined duplicate Content-Type headers', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(postRequest(LEGACY_CALL, { 'Content-Type': 'application/json, application/json' }));
+        expect(response.status).toBe(415);
+        expect(executed).toEqual([]);
+    });
+
+    it('validates the modern leg too: enveloped request with a non-JSON media type is answered 415 before dispatch', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(
+            postRequest(MODERN_CALL, {
+                'Content-Type': 'text/plain; a=application/json',
+                'mcp-protocol-version': MODERN_REVISION,
+                'Mcp-Method': 'tools/call',
+                'Mcp-Name': 'run'
+            })
+        );
+        expect(response.status).toBe(415);
+        expect(executed).toEqual([]);
+    });
+
+    it('still serves the modern leg for application/json (control)', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(
+            postRequest(MODERN_CALL, {
+                'Content-Type': 'application/json',
+                'mcp-protocol-version': MODERN_REVISION,
+                'Mcp-Method': 'tools/call',
+                'Mcp-Name': 'run'
+            })
+        );
+        expect(response.status).toBe(200);
+        expect(executed).toEqual(['hello']);
+    });
+
+    it('does not apply the POST check to bodyless methods', async () => {
+        const handler = createMcpHandler(factory);
+        const response = await handler.fetch(new Request('http://127.0.0.1/mcp', { method: 'DELETE' }));
+        expect(response.status).not.toBe(415);
+    });
+});
+
+describe('WebStandardStreamableHTTPServerTransport Content-Type validation (direct wiring)', () => {
+    async function postToTransport(headers: Record<string, string>): Promise<Response> {
+        const server = factory();
+        const transport = new WebStandardStreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true
+        });
+        await server.connect(transport);
+        const response = await transport.handleRequest(postRequest(LEGACY_CALL, headers));
+        await server.close();
+        return response;
+    }
+
+    it('rejects a non-JSON media type whose parameters contain `application/json` and does not dispatch', async () => {
+        const response = await postToTransport({ 'Content-Type': 'text/plain; a=application/json' });
+        expect(response.status).toBe(415);
+        expect(executed).toEqual([]);
+    });
+
+    it('serves application/json (control)', async () => {
+        const response = await postToTransport({ 'Content-Type': 'application/json' });
+        expect(response.status).toBe(200);
+        expect(executed).toEqual(['hello']);
+    });
+});