Streamable HTTP server accepts mismatched `MCP-Protocol-Version` header and body `protocolVersion` on `initialize`

[cclabadmin]

Describe the Bug

When the initial initialize request carries a MCP-Protocol-Version HTTP header that disagrees with initialize.params.protocolVersion in the JSON-RPC body, the server accepts the request without error. The negotiated protocol version follows the JSON-RPC body rather than the MCP-Protocol-Version request header.

The current MCP 2025-11-25 specification does not explicitly require the server to check body/header consistency on initialize, so this is filed as an implementation observation rather than a strict spec-violation claim.

• Environment
  • Reproduced with stable releasev1.6.0 (f5f20154)
  • Also reproduced with a main snapshot from 2026-05-16 (1253d17a)
  • Transport: Streamable HTTP server (stateful and stateless profile)

To reproduce

1. Start a Go SDK Streamable HTTP server.
2. Send an initialize request where the body protocolVersion is 2025-11-25 but the MCP-Protocol-Version header is 2025-03-26 (or vice versa).
3. Observe that the server returns HTTP 200 with a normal initialize result.
4. Check the negotiated protocol version in the response.

Expected behavior

Option A: the server rejects the mismatch before negotiation, for example with HTTP 400 or a JSON-RPC Invalid Request error.

Option B: the spec clarifies which field is authoritative, and the SDK documents that behavior and covers it with a regression test.

Logs

Both mismatch directions were accepted:

body=2025-11-25 header=2025-03-26 -> HTTP 200, negotiated version follows body (2025-11-25)
body=2025-03-26 header=2025-11-25 -> HTTP 200, negotiated version follows body (2025-03-26)

After initialization, later responses used the body-negotiated version in the MCP-Protocol-Version header, not the original mismatched header value.

With a Streamable HTTP server running, set ENDPOINT to the server endpoint and send an initial initialize request whose HTTP header and JSON-RPC body disagree:

ENDPOINT=http://127.0.0.1:8080/mcp

curl -i -sS --http1.1 -X POST "$ENDPOINT" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-03-26' \
  --data '{"jsonrpc":"2.0","id":"init-conflict-1","method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"version-conflict-repro","version":"0.1.0"}}}'

Then repeat the same request with the values reversed: body 2025-03-26, header 2025-11-25.

Additional context

• Related: SEP-2575 introduces a related future-state requirement that, for HTTP requests, the MCP-Protocol-Version header match _meta["io.modelcontextprotocol/protocolVersion"].

[jshaofa-ui]

modelcontextprotocol/go-sdk #963 — Streamable HTTP Protocol Version Mismatch (Go)

Issue

URL: #963
Title: Streamable HTTP server accepts mismatched MCP-Protocol-Version header and body protocolVersion on initialize
Severity: Medium — protocol consistency violation
Affects: All Go SDK Streamable HTTP server implementations

Root Cause Analysis

Identical to the TypeScript SDK issue (#2108). The Go SDK's Streamable HTTP server:

1. Reads MCP-Protocol-Version from HTTP header
2. Reads protocolVersion from JSON-RPC body
3. Only uses the body value for negotiation, ignoring the header
4. Accepts requests where header and body disagree
   The bug is likely in the Streamable HTTP transport handler:

// Likely location: streamablehttp/server.go or similar
func (s *Server) handleInitialize(w http.ResponseWriter, r *http.Request, req *JSONRPCRequest) {
    headerVersion := r.Header.Get("MCP-Protocol-Version")
    bodyVersion := req.Params.ProtocolVersion
    
    // Bug: only uses bodyVersion, ignores headerVersion
    s.negotiatedVersion = bodyVersion
    // ...
}

Proposed Fix

// streamablehttp/server.go
func (s *Server) handleInitialize(w http.ResponseWriter, r *http.Request, req *JSONRPCRequest) {
    headerVersion := r.Header.Get("MCP-Protocol-Version")
    bodyVersion := ""
    if req.Params != nil {
        bodyVersion = req.Params.ProtocolVersion
    }
    
    // Validate consistency
    if headerVersion != "" && bodyVersion != "" && headerVersion != bodyVersion {
        s.writeJSONRPCError(w, req.ID, -32600,
            fmt.Sprintf("MCP-Protocol-Version header %q does not match body protocolVersion %q. Both must agree.",
                headerVersion, bodyVersion))
        return
    }
    
    // Use body version (or header as fallback)
    negotiatedVersion := bodyVersion
    if negotiatedVersion == "" {
        negotiatedVersion = headerVersion
    }
    
    // Continue with normal initialization
    s.doInitialize(w, r, req, negotiatedVersion)
}

type ServerOption func(*Server)

// WithRelaxedVersionCheck allows version mismatches with a warning.
// Deprecated: Use strict version checking for security.
func WithRelaxedVersionCheck() ServerOption {
    return func(s *Server) {
        s.relaxedVersionCheck = true
    }
}

func (s *Server) handleInitialize(w http.ResponseWriter, r *http.Request, req *JSONRPCRequest) {
    // ...
    if headerVersion != "" && bodyVersion != "" && headerVersion != bodyVersion {
        if s.relaxedVersionCheck {
            log.Printf("WARNING: Protocol version mismatch: header=%s body=%s, using body",
                headerVersion, bodyVersion)
        } else {
            s.writeJSONRPCError(w, req.ID, -32600, ...)
            return
        }
    }
    // ...
}

Testing

func TestProtocolVersionMismatch(t *testing.T) {
    server := NewServer(WithRelaxedVersionCheck(false)) // strict mode
    
    // Test: mismatched versions should be rejected
    req := httptest.NewRequest("POST", "/mcp", bytes.NewReader([]byte(`{
        "jsonrpc": "2.0",
        "id": 1,
        "method": "initialize",
        "params": {"protocolVersion": "2025-11-25"}
    }`)))
    req.Header.Set("MCP-Protocol-Version", "2025-03-26")
    req.Header.Set("Content-Type", "application/json")
    
    w := httptest.NewRecorder()
    server.ServeHTTP(w, req)
    
    if w.Code != 400 {
        t.Errorf("expected 400, got %d", w.Code)
    }
    
    var resp JSONRPCResponse
    json.Unmarshal(w.Body.Bytes(), &resp)
    if resp.Error == nil {
        t.Error("expected error response")
    }
    if !strings.Contains(resp.Error.Message, "Protocol version mismatch") {
        t.Errorf("expected mismatch error, got: %s", resp.Error.Message)
    }
}

func TestProtocolVersionMatch(t *testing.T) {
    server := NewServer()
    
    req := httptest.NewRequest("POST", "/mcp", bytes.NewReader([]byte(`{
        "jsonrpc": "2.0",
        "id": 1,
        "method": "initialize",
        "params": {"protocolVersion": "2025-11-25"}
    }`)))
    req.Header.Set("MCP-Protocol-Version", "2025-11-25")
    req.Header.Set("Content-Type", "application/json")
    
    w := httptest.NewRecorder()
    server.ServeHTTP(w, req)
    
    if w.Code != 200 {
        t.Errorf("expected 200, got %d", w.Code)
    }
}

Cross-SDK Coordination

This fix should be coordinated with the TypeScript SDK fix (#2108) to ensure consistent behavior across all MCP SDK implementations. The error code (-32600) and message format should match.