Skip to content

fix: accept wildcard media types in Accept header per RFC 7231 - #2152

Merged
maxisbey merged 2 commits into
modelcontextprotocol:mainfrom
shivama205:fix/accept-header-wildcards
Mar 9, 2026
Merged

fix: accept wildcard media types in Accept header per RFC 7231#2152
maxisbey merged 2 commits into
modelcontextprotocol:mainfrom
shivama205:fix/accept-header-wildcards

Conversation

@shivama205

Copy link
Copy Markdown
Contributor

Summary

  • Fix _check_accept_headers to accept wildcard media types (*/*, application/*, text/*) in the Accept header, per RFC 7231, section 5.3.2
  • Strip quality value parameters (e.g. ;q=0.8) before matching media types
  • Add comprehensive tests for wildcard acceptance and rejection scenarios

Problem

The server rejected requests with wildcard Accept headers like */* or application/*, returning 406 Not Acceptable. This violated RFC 7231 and broke interoperability with HTTP clients that send Accept: */* by default (e.g. httpx, requests).

Closes#1641

Test plan

  • Wildcard */* accepted for both SSE and JSON-only modes
  • application/* + text/* accepted for SSE mode
  • application/* alone correctly rejected for SSE mode (doesn't cover text/event-stream)
  • Quality parameters (*/*;q=0.8) handled correctly
  • Truly missing Accept header still rejected
  • Incompatible types (text/html) still rejected
  • All 1134 existing tests pass
  • Linting, formatting, and type checks clean

@shivama205

Copy link
Copy Markdown
ContributorAuthor

Hi @Kludex@maxisbey — could you please review this when you get a chance? This fixes #1641 (wildcard Accept header support per RFC 7231). All CI checks are passing. Thanks!

@shivama205

Copy link
Copy Markdown
ContributorAuthor

@felixweinberger@maxisbey could you please review this when you get a chance? Thanks!

@shivama205
shivama205force-pushed the fix/accept-header-wildcards branch from b5d0136 to 6c49c5fCompareMarch 4, 2026 18:36
@shivama205

Copy link
Copy Markdown
ContributorAuthor

Bumping this — just rebased onto latest main (clean, no conflicts). This fixes a real interoperability bug: clients like httpx and requests send Accept: */* by default and currently get a 406 Not Acceptable. All CI is passing.

If anyone's on the MCP Discord, would really appreciate a ping to get eyes on this. Happy to make any changes to get it merged. 🙏

@maxisbeymaxisbey added bug Something isn't working P2 Moderate issues affecting some users, edge cases, potentially valuable feature improves spec compliance When a change improves ability of SDK users to comply with spec definition labels Mar 5, 2026

@maxisbeymaxisbey left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this — the approach is correct and the test coverage is great. Two small asks before merge (suggestions inline, should be one-click applies).

AI Disclaimer

Comment threadsrc/mcp/server/streamable_http.py Outdated
Comment threadtests/shared/test_streamable_http.py Outdated
Comment threadtests/shared/test_streamable_http.py Outdated
Comment threadtests/shared/test_streamable_http.py Outdated
Shivamand others added 2 commits March 7, 2026 03:12
The server rejected requests with wildcard Accept headers like `*/*`,
`application/*`, or `text/*`, returning 406 Not Acceptable. This violated
RFC 7231, section 5.3.2, which defines wildcard media ranges as valid.
Update `_check_accept_headers` to recognize `*/*` as matching all types,
`application/*` as matching `application/json`, and `text/*` as matching
`text/event-stream`. Also strip quality parameters before matching.
Github-Issue:modelcontextprotocol#1641
Reported-by:rh-fr
- Normalize media types to lowercase for case-insensitive matching per RFC 7231
- Use exact match instead of startswith to prevent over-matching
- Replace headers.update with headers.pop for cleaner Accept removal in tests
@shivama205
shivama205force-pushed the fix/accept-header-wildcards branch from d8bd3e4 to 8e2ec6fCompareMarch 6, 2026 21:44
@shivama205

Copy link
Copy Markdown
ContributorAuthor

Thanks for the thorough review @maxisbey! Applied all your suggestions:

  • Added .lower() for case-insensitive media type matching per RFC 7231
  • Switched from startswith to exact match to prevent over-matching (e.g. application/json-patch+json) — good eye on that one
  • Replaced headers.update({"Accept": None}) with headers.pop("Accept") at all three locations, much cleaner

@maxisbey
maxisbey merged commit 51c53f2 into modelcontextprotocol:mainMar 9, 2026
49 of 50 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugSomething isn't workingimproves spec complianceWhen a change improves ability of SDK users to comply with spec definitionP2Moderate issues affecting some users, edge cases, potentially valuable feature

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MCP Server won't work with wildcard in "Accept" header and therefore is non‑compliant with HTTP spec

2 participants

@shivama205@maxisbey