Mcp-Param-* projection is enforced regardless of negotiated protocol version, breaking 2025-11-25 clients since v1.12.0
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start with the HTTP-layer projection validation and the per-session protocol version negotiated during initialize, then trace how tools/call parameters are handled. Compare the behavior described in PR #3167 with the 2025-11-25 and 2026-07-28 cases. Done means older sessions use ordinary parameters without header validation while newer sessions retain projected-header validation.
由索引模型根據 Issue 內容生成。
描述
Summary
Since the v1.12.0 rollout (2026-09-03), repo-scoped tools on the hosted remote server
(https://api.githubcopilot.com/mcp/...) reject calls from clients that negotiated 2025-11-25:
Negotiated protocol version: 2025-11-25
HTTP 400: header mismatch: missing Mcp-Param-owner header for parameter "owner" (code -32020)
HTTP 400: header mismatch: missing Mcp-Param-repo header for parameter "repo" (code -32020)
Mcp-Param-* projection is a 2026-07-28 feature. A client that negotiated 2025-11-25 sends owner
and repo in the tools/call params, as that version specifies, and has no mechanism to emit projected
headers. Enforcing the header check against such a session makes -32020 reachable on a protocol
version where it should not exist.
The underlying issue: the check is not version-scoped
Version negotiation during initialize exists so that one deployment can serve clients across protocol
versions, applying each version's semantics per session. A version-correct implementation would branch:
| Negotiated version | owner / repo read from |
Header validation |
|---|---|---|
| 2026-07-28 | projected Mcp-Param-* headers |
applies |
| 2025-11-25 | tools/call params |
must not apply |
PR #3167 states the projection mechanism is
"not gated on protocol version negotiation" — consistent with validation living in the HTTP layer,
which sits outside per-session version state and so cannot see what was negotiated. The result is that
2026-07-28 semantics are applied to every session regardless of what the client agreed to.
This makes adopting any server ≥ v1.12.0 conditional on the client adopting 2026-07-28, which inverts
the compatibility guarantee that negotiation is meant to provide.
Impact
A previously working integration broke with no client-side change, in a minor release. Clients pinned to
2025-11-25 cannot call any repo-scoped tool, and there is no client-side remedy — emitting projected
headers is not something a 2025-11-25 client can do. Our only options are pinning a pre-v1.12.0
self-hosted build or writing a proxy that converts arguments into headers.
Steps to reproduce
- Connect to
https://api.githubcopilot.com/mcp/x/all/readonlywith a client supporting only MCP 2025-11-25. - Confirm the negotiated version is
2025-11-25. - Call any repo-scoped tool (e.g.
get_file_contents) withownerandrepoas ordinary arguments. - Server returns HTTP 400 /
-32020header mismatch.
Expected
On a session negotiated at 2025-11-25, owner/repo are read from the tools/call arguments and the
call succeeds. Projected-header validation applies only to sessions negotiated at 2026-07-28 or later.
Actual
-32020 header mismatch on every repo-scoped tool call, irrespective of negotiated version.
Version information
- Last working: v1.11.0 (2026-08-25) — no projection present;
owner/repoaccepted as arguments. - First broken: the v1.12.0 rollout (2026-09-03).
- #3147 is CORS-only and not implicated;
#3167 allowlists the projections in preflight
and describes the ungated behaviour. - Comparable failure mode under the previous SDK:
mark3labs/mcp-go#986.
Questions
- Can projected-header validation be gated on the negotiated protocol version, so 2025-11-25 sessions
fall back to reading the parameters fromtools/call? - In the interim, is there a supported opt-out — a request header or endpoint path — to disable
parameter projection for clients still on 2025-11-25?
- 主要語言
- Go
- 星號
- 33.1k
- 分支
- 5k
- 平均合併
- 2 天 3 小時
- 30 天內合併 PR
- 18
環境準備
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
github/github-mcp-server 的其他 Issue
-
bug
難度 2/5 1-3 小時 新手友好度 84/100
github/github-mcp-server#3235 · 1 則留言 ·
維護者通常 1 天內回覆
-
enhancement
難度 1/5 1 小時以內 新手友好度 88/100
github/github-mcp-server#3042 · 2 則留言 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 72/100
github/github-mcp-server#3032 · 1 個 reaction ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 74/100
github/github-mcp-server#2803 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 76/100
github/github-mcp-server#2740 ·
維護者通常 1 天內回覆
查看 github/github-mcp-server 的全部 Issue
相似的 Issue
-
enhancement
難度 2/5 1-3 小時 新手友好度 75/100
volodya-lombrozo/aidy#333 ·
-
難度 2/5 1-3 小時 新手友好度 85/100
rossoctl/context-guru#314 ·
維護者通常 1 天內回覆
-
難度 1/5 1 小時以內 新手友好度 86/100
OwO-Network/DLX#236 · 1 則留言 · 1 個 reaction ·
-
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 84/100