modelcontextprotocol / modelcontextprotocol/typescript-sdk
Streamable HTTP server accepts unsafe integer in x-mcp-header field when mirrored header is absent
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.4k
- Forks
- 2.2k
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 4
Description
The current Streamable HTTP specification says x-mcp-header integer values must be within the JavaScript safe-integer range.
In an exact-byte server probe, a tools/call with an annotated integer argument of 9007199254740992 and no matching Mcp-Param-* header returns success and invokes the handler. The server cannot produce a canonical primitive header representation and skips parity validation instead of rejecting the request.
Expected behavior: reject before handler invocation.
We can provide a minimized reproduction and exact package/version matrix.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the exact-byte Streamable HTTP probe described in the issue, using the unsafe integer and omitting the matching Mcp-Param-* header. Trace x-mcp-header validation through the server request path; done means the request is rejected before the handler is invoked.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100