fix(server): reject a modern POST that omits the required MCP-Protoco… - #2594
Open
KKonstantinov wants to merge 1 commit into
Open
fix(server): reject a modern POST that omits the required MCP-Protoco…#2594KKonstantinov wants to merge 1 commit into
KKonstantinov wants to merge 1 commit into
Claude / Claude Code Review
completed
Jul 31, 2026 in 15m 59s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | packages/core-internal/src/shared/inboundClassification.ts:324-337 |
Rationale and changeset overstate Mcp-Name as required on every modern POST |
Annotations
Check warning on line 337 in packages/core-internal/src/shared/inboundClassification.ts
claude / Claude Code Review
Rationale and changeset overstate Mcp-Name as required on every modern POST
The rewritten rationale for the standard-header-validation rung says "The spec requires all three on every modern POST", but Mcp-Name is required only for tools/call, prompts/get, and resources/read (per the SEP-2243 'Required For' column cited by MCP_NAME_HEADER_SOURCE in this same file) — and validateStandardRequestHeaders itself enforces Mcp-Name presence only for those three methods. The changeset (.changeset/require-mcp-protocol-version-header.md) repeats the same overstatement; consider ad
Loading