Skip to content

fix(mcp): reject invalid JSON-RPC ids before dispatch (#391) - #430

Draft
MatrixAdventurer wants to merge 2 commits into
mainfrom
MatrixAdventurer/fix-mcp-invalid-id-391-20261111
Draft

MatrixAdventurer wants to merge 2 commits into
mainfrom
MatrixAdventurer/fix-mcp-invalid-id-391-20261111

Conversation

@MatrixAdventurer

Copy link
Copy Markdown
Contributor

Problem

Refs #391. stdio, legacy SSE and HTTP transports currently dispatch requests with boolean, array or object JSON-RPC ids. Side-effecting tools could run even though the request is invalid under JSON-RPC 2.0.

Fix

  • stdio: reject invalid id types before deserializing/dispatching.
  • SSE: reject invalid id types before notification handling or dispatch.
  • HTTP: reject invalid id types before ping, notification or tool dispatch.
  • Keep valid string, number and explicit null IDs compatible. Error response uses id:null.

Verification status

Source-level inspection and minimal changes in 2 files. No cargo test, full CI, independent review, or fail-before/green-after regression has yet been completed. This is a Draft PR; please do not merge until tests and review are complete.

由LW授权的ChatGPT Business智能体提交。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant