Server logs a fabricated 'initialize' (with synthesized rmcp/3.8.0 peer identity) for no-initialize SEP-2567 requests, ignoring clientInfo from _meta

未关闭
  • 哪里不对？
#1,425 2 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 3 天内回复

@jamadeo 已经在做这个了。

开始于 2026年11月3日。

评估

这个 Issue 还没有评估数据。

描述

bug P2 ready for work T-service T-transport

Summary

On rmcp 3.8.0, a streamable-HTTP server emits a Service initialized as server peer_info=Some(InitializeRequestParams { ... }) INFO log line for every no-initialize (SEP-2567, protocol 2026-07-28) request, as though an initialize handshake had occurred. The logged peer identity is a synthesized Implementation { name: "rmcp", version: "3.8.0" }, and a clientInfo explicitly provided in the request's _meta (io.modelcontextprotocol/clientInfo) is ignored — never surfaced in the log.

This makes server-side logs actively misleading for client-behavior analysis: a sessionless 2.0 client appears in logs as a legacy initialize handshake from an rmcp client.

Environment

  • rmcp 3.8.0, server role, transport-streamable-http-server (StreamableHttpService + LocalSessionManager::default(), axum nest_service("/mcp", ...))
  • Client: any no-initialize 2.0 caller (curl below; also observed with a real third-party client identifying as zcode/0.17.1)

Reproduction

  1. Start any streamable-HTTP server built on rmcp 3.8 (e.g. the counter example) and note its stderr/journal.
  2. Send a no-initialize request (no initialize ever sent):
curl -sS -X POST http://127.0.0.1:8000/mcp \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' -H 'Mcp-Method: tools/list' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{"_meta":{
    "io.modelcontextprotocol/protocolVersion":"2026-07-28",
    "io.modelcontextprotocol/clientInfo":{"name":"distinctive-probe-XYZ","version":"9.9.9"},
    "io.modelcontextprotocol/clientCapabilities":{}}}}'
  1. The request succeeds (HTTP 200, tool list returned), and the server logs:
INFO serve_inner: rmcp::service: Service initialized as server peer_info=Some(InitializeRequestParams {
  meta: None,
  protocol_version: ProtocolVersion("2026-07-28"),
  capabilities: ClientCapabilities { ... all None ... },
  client_info: Implementation { name: "rmcp", title: None, version: "3.8.0", ... }
})

Two discrepancies vs. what actually happened on the wire:

  • No initialize request was ever sent; the log fabricates one.
  • The client identified itself as distinctive-probe-XYZ/9.9.9 in _meta; the log shows rmcp/3.8.0.

Real-world impact

We spent three rounds of diagnosis mis-attributing a third-party client's behavior because its sessionless 2.0 requests were logged as initialize handshakes from "rmcp 3.8.0". This included incorrectly concluding the client used a legacy handshake and had a clientInfo of rmcp/3.8.0 (wire capture later disproved both). Details and retraction: zai-org/feedback#1372.

Suggested direction

  • For no-initialize requests, log something that reflects the actual lifecycle (e.g. stateless request served), not Service initialized ... InitializeRequestParams.
  • Surface io.modelcontextprotocol/clientInfo from _meta when present, so per-request identities are observable; if absent, make the synthesized default obviously synthetic (or omit identity from the log).

Happy to provide full tcpdump captures or a minimal repro project if useful.

主要语言
Rust
星标
4.1k
派生
694
平均合并
4 天 16 小时
30 天内合并 PR
43

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

modelcontextprotocol/rust-sdk 的其他 Issue

查看 modelcontextprotocol/rust-sdk 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。