The current Streamable HTTP specification says x-mcp-header integer values must be within the JavaScript safe-integer range.
In an exact-byte server probe, a tools/call with an annotated integer argument of 9007199254740992 and no matching Mcp-Param-* header returns success and invokes the handler. The server cannot produce a canonical primitive header representation and skips parity validation instead of rejecting the request.
Expected behavior: reject before handler invocation.
We can provide a minimized reproduction and exact package/version matrix.
The current Streamable HTTP specification says
x-mcp-headerinteger values must be within the JavaScript safe-integer range.In an exact-byte server probe, a
tools/callwith an annotated integer argument of9007199254740992and no matchingMcp-Param-*header returns success and invokes the handler. The server cannot produce a canonical primitive header representation and skips parity validation instead of rejecting the request.Expected behavior: reject before handler invocation.
We can provide a minimized reproduction and exact package/version matrix.