Skip to content

fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311

Merged
felixweinberger merged 2 commits into
v2-2026-07-28from
fweinberger/align-rejection-codes
Jun 16, 2026
Merged

fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from
fweinberger/align-rejection-codes

Conversation

@felixweinberger

@felixweinbergerfelixweinberger commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Align the 2026-07-28 serving path's rejection codes with the conformance suite

Motivation and Context

The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests
with a provisional -32004 while the upstream error-code assignment for them was still being
discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are
in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance
fixture serves the 2026 path.

What changed

  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    (invalid params) naming the missing key(s), instead of the provisional -32004. Still
    HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    (unreleased) 2026 serving path.

If the open spec discussion about these error assignments
(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a
published conformance release carries the new assignment — the cell sheet and the
expected-failures baseline are the re-derivation points.

How Has This Been Tested?

  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    the full e2e matrix pass.

Breaking Changes

None for released behavior — the affected rejection paths exist only on the unreleased
2026-07-28 serving path.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature
  • Breaking change
  • Documentation update

Additional context

The conformance fixture arming (separate PR) is what makes these cells observable to the suite;
that PR's expected-failures refresh removes the server-stateless baseline entry once both are
in.

@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger requested a review from a team as a code ownerJune 16, 2026 16:25
@changeset-bot

changeset-botBot commented Jun 16, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 52e126a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Jun 16, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a

@felixweinberger
felixweinberger merged commit 3e97603 into v2-2026-07-28Jun 16, 2026
14 checks passed
@felixweinberger
felixweinberger deleted the fweinberger/align-rejection-codes branch June 16, 2026 17:14
felixweinberger added a commit that referenced this pull request Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields by felixweinberger · Pull Request #2311 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311
Merged
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Jun 16, 2026
Merged
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 16, 2026

Copy link


Copy Markdown

Contributor
Align the 2026-07-28 serving path's rejection codes with the conformance suite
Motivation and Context
The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests

with a provisional -32004 while the upstream error-code assignment for them was still being

discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are

in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance

fixture serves the 2026 path.
What changed
  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    
the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    
(invalid params) naming the missing key(s), instead of the provisional -32004. Still
    
HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    
supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    
behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    
servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    
values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    
(unreleased) 2026 serving path.
If the open spec discussion about these error assignments

(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a

published conformance release carries the new assignment — the cell sheet and the

expected-failures baseline are the re-derivation points.
How Has This Been Tested?
  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    
42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    
passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    
flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    
today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    
the full e2e matrix pass.
Breaking Changes
None for released behavior — the affected rejection paths exist only on the unreleased

2026-07-28 serving path.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature
  •  Breaking change
  •  Documentation update
Additional context
The conformance fixture arming (separate PR) is what makes these cells observable to the suite;

that PR's expected-failures refresh removes the server-stateless baseline entry once both are

in.
@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 16, 2026 16:25
@changeset-bot
changeset-botBot
commented
Jun 16, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 52e126a
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 16, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a
@felixweinberger
felixweinberger
merged commit 3e97603
into
v2-2026-07-28Jun 16, 2026

14 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/align-rejection-codes

branch
June 16, 2026 17:14
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields by felixweinberger · Pull Request #2311 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311
Merged
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Jun 16, 2026
Merged
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 16, 2026

Copy link


Copy Markdown

Contributor
Align the 2026-07-28 serving path's rejection codes with the conformance suite
Motivation and Context
The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests

with a provisional -32004 while the upstream error-code assignment for them was still being

discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are

in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance

fixture serves the 2026 path.
What changed
  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    
the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    
(invalid params) naming the missing key(s), instead of the provisional -32004. Still
    
HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    
supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    
behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    
servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    
values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    
(unreleased) 2026 serving path.
If the open spec discussion about these error assignments

(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a

published conformance release carries the new assignment — the cell sheet and the

expected-failures baseline are the re-derivation points.
How Has This Been Tested?
  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    
42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    
passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    
flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    
today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    
the full e2e matrix pass.
Breaking Changes
None for released behavior — the affected rejection paths exist only on the unreleased

2026-07-28 serving path.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature
  •  Breaking change
  •  Documentation update
Additional context
The conformance fixture arming (separate PR) is what makes these cells observable to the suite;

that PR's expected-failures refresh removes the server-stateless baseline entry once both are

in.
@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 16, 2026 16:25
@changeset-bot
changeset-botBot
commented
Jun 16, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 52e126a
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 16, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a
@felixweinberger
felixweinberger
merged commit 3e97603
into
v2-2026-07-28Jun 16, 2026

14 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/align-rejection-codes

branch
June 16, 2026 17:14
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields by felixweinberger · Pull Request #2311 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311
Merged
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Jun 16, 2026
Merged
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 16, 2026

Copy link


Copy Markdown

Contributor
Align the 2026-07-28 serving path's rejection codes with the conformance suite
Motivation and Context
The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests

with a provisional -32004 while the upstream error-code assignment for them was still being

discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are

in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance

fixture serves the 2026 path.
What changed
  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    
the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    
(invalid params) naming the missing key(s), instead of the provisional -32004. Still
    
HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    
supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    
behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    
servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    
values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    
(unreleased) 2026 serving path.
If the open spec discussion about these error assignments

(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a

published conformance release carries the new assignment — the cell sheet and the

expected-failures baseline are the re-derivation points.
How Has This Been Tested?
  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    
42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    
passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    
flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    
today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    
the full e2e matrix pass.
Breaking Changes
None for released behavior — the affected rejection paths exist only on the unreleased

2026-07-28 serving path.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature
  •  Breaking change
  •  Documentation update
Additional context
The conformance fixture arming (separate PR) is what makes these cells observable to the suite;

that PR's expected-failures refresh removes the server-stateless baseline entry once both are

in.
@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 16, 2026 16:25
@changeset-bot
changeset-botBot
commented
Jun 16, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 52e126a
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 16, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a
@felixweinberger
felixweinberger
merged commit 3e97603
into
v2-2026-07-28Jun 16, 2026

14 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/align-rejection-codes

branch
June 16, 2026 17:14
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields by felixweinberger · Pull Request #2311 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311
Merged
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Jun 16, 2026
Merged
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 16, 2026

Copy link


Copy Markdown

Contributor
Align the 2026-07-28 serving path's rejection codes with the conformance suite
Motivation and Context
The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests

with a provisional -32004 while the upstream error-code assignment for them was still being

discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are

in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance

fixture serves the 2026 path.
What changed
  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    
the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    
(invalid params) naming the missing key(s), instead of the provisional -32004. Still
    
HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    
supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    
behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    
servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    
values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    
(unreleased) 2026 serving path.
If the open spec discussion about these error assignments

(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a

published conformance release carries the new assignment — the cell sheet and the

expected-failures baseline are the re-derivation points.
How Has This Been Tested?
  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    
42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    
passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    
flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    
today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    
the full e2e matrix pass.
Breaking Changes
None for released behavior — the affected rejection paths exist only on the unreleased

2026-07-28 serving path.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature
  •  Breaking change
  •  Documentation update
Additional context
The conformance fixture arming (separate PR) is what makes these cells observable to the suite;

that PR's expected-failures refresh removes the server-stateless baseline entry once both are

in.
@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 16, 2026 16:25
@changeset-bot
changeset-botBot
commented
Jun 16, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 52e126a
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 16, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a
@felixweinberger
felixweinberger
merged commit 3e97603
into
v2-2026-07-28Jun 16, 2026

14 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/align-rejection-codes

branch
June 16, 2026 17:14
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields by felixweinberger · Pull Request #2311 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311
Merged
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Jun 16, 2026
Merged
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 16, 2026

Copy link


Copy Markdown

Contributor
Align the 2026-07-28 serving path's rejection codes with the conformance suite
Motivation and Context
The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests

with a provisional -32004 while the upstream error-code assignment for them was still being

discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are

in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance

fixture serves the 2026 path.
What changed
  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    
the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    
(invalid params) naming the missing key(s), instead of the provisional -32004. Still
    
HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    
supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    
behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    
servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    
values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    
(unreleased) 2026 serving path.
If the open spec discussion about these error assignments

(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a

published conformance release carries the new assignment — the cell sheet and the

expected-failures baseline are the re-derivation points.
How Has This Been Tested?
  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    
42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    
passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    
flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    
today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    
the full e2e matrix pass.
Breaking Changes
None for released behavior — the affected rejection paths exist only on the unreleased

2026-07-28 serving path.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature
  •  Breaking change
  •  Documentation update
Additional context
The conformance fixture arming (separate PR) is what makes these cells observable to the suite;

that PR's expected-failures refresh removes the server-stateless baseline entry once both are

in.
@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 16, 2026 16:25
@changeset-bot
changeset-botBot
commented
Jun 16, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 52e126a
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 16, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a
@felixweinberger
felixweinberger
merged commit 3e97603
into
v2-2026-07-28Jun 16, 2026

14 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/align-rejection-codes

branch
June 16, 2026 17:14
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields by felixweinberger · Pull Request #2311 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311
Merged
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Jun 16, 2026
Merged
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 16, 2026

Copy link


Copy Markdown

Contributor
Align the 2026-07-28 serving path's rejection codes with the conformance suite
Motivation and Context
The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests

with a provisional -32004 while the upstream error-code assignment for them was still being

discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are

in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance

fixture serves the 2026 path.
What changed
  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    
the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    
(invalid params) naming the missing key(s), instead of the provisional -32004. Still
    
HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    
supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    
behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    
servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    
values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    
(unreleased) 2026 serving path.
If the open spec discussion about these error assignments

(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a

published conformance release carries the new assignment — the cell sheet and the

expected-failures baseline are the re-derivation points.
How Has This Been Tested?
  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    
42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    
passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    
flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    
today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    
the full e2e matrix pass.
Breaking Changes
None for released behavior — the affected rejection paths exist only on the unreleased

2026-07-28 serving path.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature
  •  Breaking change
  •  Documentation update
Additional context
The conformance fixture arming (separate PR) is what makes these cells observable to the suite;

that PR's expected-failures refresh removes the server-stateless baseline entry once both are

in.
@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 16, 2026 16:25
@changeset-bot
changeset-botBot
commented
Jun 16, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 52e126a
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 16, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a
@felixweinberger
felixweinberger
merged commit 3e97603
into
v2-2026-07-28Jun 16, 2026

14 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/align-rejection-codes

branch
June 16, 2026 17:14
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields by felixweinberger · Pull Request #2311 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields - #2311
Merged
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Jun 16, 2026
Merged
fix(core): pin the modern-path rejection codes for header mismatches and missing envelope fields#2311
felixweinberger merged 2 commits into
v2-2026-07-28from 
fweinberger/align-rejection-codes
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jun 16, 2026

Copy link


Copy Markdown

Contributor
Align the 2026-07-28 serving path's rejection codes with the conformance suite
Motivation and Context
The new per-request (2026-07-28) HTTP serving path rejected two classes of invalid requests

with a provisional -32004 while the upstream error-code assignment for them was still being

discussed. The published conformance suite (0.2.0-alpha.3) and the current draft spec text are

in agreement, so this change pins the codes to what they assert and lets the remaining
server-stateless / http-header-validation error-code checks pass once the conformance

fixture serves the 2026 path.
What changed
  • A header/body cross-check mismatch (MCP-Protocol-Version or Mcp-Method disagreeing with
    
the request body) is now rejected with -32001 (HeaderMismatch) instead of the provisional
    -32004. Still HTTP 400.
  • A request whose MCP-Protocol-Version header names 2026-07-28 but whose body is missing the
    _meta envelope (or its required protocol-version key) is now rejected with -32602
    
(invalid params) naming the missing key(s), instead of the provisional -32004. Still
    
HTTP 400.
  • Unchanged: the envelope-less rejection on a modern-only endpoint (-32004 with the
    
supported-versions list), initialize carrying a valid envelope (404/-32601), all 2025-era
    
behavior, and the client's version-negotiation probe handling (it keeps recognizing the codes
    
servers in the wild send today).
  • Tests: the validation-ladder cell sheet's previously parameterized rows are pinned to these
    
values; unit and entry tests assert the pinned codes; a changeset documents the change on the
    
(unreleased) 2026 serving path.
If the open spec discussion about these error assignments

(modelcontextprotocol/modelcontextprotocol#2907) resolves differently, we re-align when a

published conformance release carries the new assignment — the cell sheet and the

expected-failures baseline are the re-derivation points.
How Has This Been Tested?
  • Unit/entry tests for every changed cell (classifier, cell sheet, status matrix, createMcpHandler).
  • Conformance against the pinned 0.2.0-alpha.3 referee: the active (2025) server leg stays
    
42/0; with the conformance fixture serving the 2026 path (follow-up PR), server-stateless
    
passes fully — the missing-_meta, missing-protocolVersion, and header-mismatch checks all
    
flip — and the http-header-validation error-code checks pass for every cell the SDK rejects
    
today.
  • pnpm -r typecheck, lint:all, docs:check, the package suites, the integration suite, and
    
the full e2e matrix pass.
Breaking Changes
None for released behavior — the affected rejection paths exist only on the unreleased

2026-07-28 serving path.
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature
  •  Breaking change
  •  Documentation update
Additional context
The conformance fixture arming (separate PR) is what makes these cells observable to the suite;

that PR's expected-failures refresh removes the server-stateless baseline entry once both are

in.
@felixweinberger
fix(core): pin modern-path rejection codes to -32001/-32602
aca8da5
Header/body cross-check mismatches (MCP-Protocol-Version or Mcp-Method
disagreeing with the request body) are now rejected with -32001
(HeaderMismatch), and a request whose protocol-version header names a
modern revision but whose body is missing the _meta envelope (or its
required protocol-version key) is rejected with -32602 invalid params
naming the missing key(s). Both keep HTTP 400.
These cells previously emitted a provisional -32004 while the upstream
error-code assignment was still being discussed; the codes now match
what the published conformance suite (0.2.0-alpha.3) asserts. The
envelope-less rejection on a modern-only endpoint (-32004 with the
supported list), the 2025-era serving paths, and the client-side probe
handling are unchanged.
@felixweinberger
test(conformance): refresh the expected-failures notes for the pinned…
52e126a
… error codes
The header note no longer describes the -32001/-32602 cells as
parameterized pending an upstream decision, and the
http-header-validation entry now names the missing-header and Mcp-Name
validation gaps as what keeps it baselined.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJune 16, 2026 16:25
@changeset-bot
changeset-botBot
commented
Jun 16, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 52e126a
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 2 packages
NameType
@modelcontextprotocol/corePatch
@modelcontextprotocol/serverPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jun 16, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@2311

@modelcontextprotocol/codemod
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/codemod@2311

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@2311

@modelcontextprotocol/server-legacy
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-legacy@2311

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@2311

@modelcontextprotocol/fastify
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/fastify@2311

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@2311

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@2311

commit: 52e126a
@felixweinberger
felixweinberger
merged commit 3e97603
into
v2-2026-07-28Jun 16, 2026

14 checks passed

@felixweinberger
felixweinberger
deleted the

fweinberger/align-rejection-codes

branch
June 16, 2026 17:14
felixweinberger added a commit
that referenced
this pull request
Jun 24, 2026
@felixweinberger
fix(core): pin the modern-path rejection codes for header mismatches …
5e10345
…and missing envelope fields (#2311)
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@felixweinberger