1823aae891Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com> Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2.2 KiB
| @modelcontextprotocol/core-internal | @modelcontextprotocol/client |
|---|---|
| minor | minor |
SEP-2243 Mcp-Param-* client-side mirroring (protocol revision 2026-07-28). On a 2026-07-28 connection over Streamable HTTP, Client.callTool() now mirrors tool arguments designated with x-mcp-header in the tool's inputSchema into Mcp-Param-{Name} HTTP headers (with the spec's =?base64?…?= sentinel encoding for values that are not safe plain-ASCII field values), and on a non-stdio modern connection Client.listTools() (and the client's internal tools/list cache) exclude tool definitions whose x-mcp-header declarations violate the spec's constraints, logging a warning naming the tool and the reason. The legacy-era callTool and listTools paths are unchanged at the wire level. Browser environments skip mirroring (dynamically named headers cannot be statically allow-listed for credentialed CORS); a conforming SEP-2243 server will reject a tools/call whose body carries a non-null value for an x-mcp-header parameter when the matching header is absent, so calling such a tool with that argument from a browser is a known limitation. New CallToolRequestOptions.toolDefinition lets callers supply the tool definition directly so mirroring and output-schema validation can run without a prior tools/list. TransportSendOptions.headers is added (additive, optional) for per-request HTTP headers; the Streamable HTTP transport skips reserved standard/auth header names (authorization, mcp-protocol-version, mcp-method, mcp-name, mcp-session-id, content-type); transports that share a single channel (stdio, in-memory) ignore it.
The Streamable HTTP transport now emits the Mcp-Name standard header on every modern-enveloped request (params.name for tools/call/prompts/get, params.uri for resources/read), sentinel-encoded.
Behavior change (modern era only): on a modern-enveloped request the Streamable HTTP transport now surfaces an HTTP 400 whose body is a well-formed JSON-RPC error response addressed to the pending request id in-band as a ProtocolError (instead of SdkHttpError), so the HEADER_MISMATCH recovery retry can fire. Legacy-era exchanges are unchanged.