mcp: rejected request IDs receive no JSON-RPC error envelope
Maintainers usually reply within 1 day
@skosovsky is already working on this.
Since Oct 12, 2026.
Assessment
- Difficulty
- 4/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 68/100
Research direction
Start with the StreamableHTTPHandler and IO/stdio request decoding and read paths; the issue does not name specific files or tests. Reproduce the invalid-ID request on both transports, then inspect how each handles decoder rejection and frames errors. Done means both return an Invalid Request (-32600) envelope with id null, HTTP uses 400 and application/json, IO/stdio continues to the following valid request, and the rejected request is not dispatched.
Written by the indexing model from the issue text.
Description
Problem
A syntactically valid, single JSON-RPC request with an ID rejected by the decoder does not receive a JSON-RPC error response:
{"jsonrpc":"2.0","id":true,"method":"ping"}
On upstream main d1a225e:
- Streamable HTTP returns HTTP 400 with a
text/plainbody beginningmalformed payload, rather than a JSON-RPC error envelope. - The IO/stdio transport returns
parse error: invalid ID type boolfromRead, writes no response, and does not deliver the subsequent valid request in that read call. The connection read loop treats this as a terminal read error.
The same behavior occurs for object and array IDs. These cases reproduce independently of the pending numeric-ID precision fixes.
Expected behavior
For a single request whose ID cannot be accepted, return a JSON-RPC Invalid Request error (-32600) with an explicit id: null. Over HTTP, use HTTP 400 and application/json. Over IO/stdio, write the error and continue reading subsequent valid messages. Do not dispatch the rejected request.
The response ID requirement comes from https://www.jsonrpc.org/specification#response_object. This report concerns structurally invalid IDs, not a new numeric range policy.
Reproduction
HTTP: POST the above body to a StreamableHTTPHandler with Content-Type application/json and Accept application/json, text/event-stream.
IO/stdio: feed the above JSON followed by a newline and {"jsonrpc":"2.0","id":7,"method":"ping"}. The current transport returns an error without writing a JSON-RPC response.
Regression tests reproduce both failures on the unmodified base. Repeating the invalid frame 1000 times before a valid request tests iterative recovery.
Related work and scope
- #1209 / #1210 concern syntactically malformed JSON and decoder resynchronization. Here JSON decoding succeeds, so that recovery machinery is unnecessary.
- #976 concerns other malformed request envelopes.
- #1375 / #1253 address exact numeric identity parsing. Once a numeric ID is rejected by those decoders, it needs the same error framing. This change can be reviewed independently and does not redefine numeric acceptance.
Legacy batch handling, invalid response handling, absent/null request IDs, and malformed JSON recovery are outside this narrowly scoped fix.
- Dominant language
- Go
- Stars
- 5.2k
- Forks
- 583
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 55
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/go-sdk
-
Session-lifecycle bookkeeping logs at info, spamming multiple log lines per request on stateless streamable HTTPPossibly taken @anneheartrecord claimed this 51 days ago. OpenP3
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
modelcontextprotocol/go-sdk#1204 · 1 reaction ·
Maintainers usually reply within 1 day
-
Expose generic `SendNotification` on `ServerSession` for custom protocol extensionsPossibly taken @ajuijas claimed this 217 days ago. Openneeds investigation
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
modelcontextprotocol/go-sdk#745 · 13 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
mcp: a property with an array "type" (any pointer field from jsonschema.For) disables x-mcp-header handling for the whole toolPossibly taken @jay23606 claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 50/100
modelcontextprotocol/go-sdk#1406 · 1 comment ·
Maintainers usually reply within 1 day
-
jsonrpc: decimal and exponent integer IDs still lose precision after #1401Possibly taken @skosovsky claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 25/100
modelcontextprotocol/go-sdk#1404 · 2 comments ·
Maintainers usually reply within 1 day
-
auth: Authorize fails against a 2025-03-26 server whose URL has a query stringPossibly taken @nahapetyan-serob claimed this 4 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 40/100
modelcontextprotocol/go-sdk#1347 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in modelcontextprotocol/go-sdk
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
ViewData can pair the in-flight proposal with the prepared flag of another proposalPossibly taken @HagarMeir claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
hyperledger/SmartBFT#710 ·
Maintainers usually reply within 1 day
-
agent-butler-finding chore
Difficulty 1/5 Under an hour Newbie friendliness 90/100
jordansmall/spindrift#5575 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
open-telemetry/opentelemetry-go-compile-instrumentation#1512 ·
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
OpenPrinting/go-mfp#124 ·
Maintainers usually reply within 1 day