René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Streamable HTTP server accepts mismatched `MCP-Protocol-Version` header and body `protocolVersion` on `initialize`","articleBody":"### Initial Checks\n\n- [x] I confirm that I'm using the latest version of MCP Python SDK\n- [x] I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue\n\n### Description\n\nWhen the initial Streamable HTTP `initialize` request carries a `MCP-Protocol-Version` HTTP header that disagrees with `initialize.params.protocolVersion` in the JSON-RPC body, the Python SDK server accepts the request without error.\n\nIn both mismatch directions, the server returned HTTP 200 with a normal `initialize` result. The negotiated protocol version followed the JSON-RPC body rather than the `MCP-Protocol-Version` request header:\n\n```text\nbody=2025-11-25 header=2025-03-26 -\u003e HTTP 200, negotiated version follows body (2025-11-25)\nbody=2025-03-26 header=2025-11-25 -\u003e HTTP 200, negotiated version follows body (2025-03-26)\n```\n\nAfter initialization, subsequent responses used the body-negotiated version in the `MCP-Protocol-Version` header, not the original mismatched header value.\n\nThe current MCP `2025-11-25` specification does not explicitly require the server to check body/header consistency on `initialize`, so this is filed as an implementation observation rather than a strict spec-violation claim.\n\nExpected behavior would be one of these:\n\n- The server rejects the mismatch before negotiation, for example with HTTP 400 or a JSON-RPC Invalid Request error.\n- The spec clarifies which field is authoritative, and the Python SDK documents that behavior and covers it with a regression test.\n\nRelated context: SEP-2575 introduces a related requirement that, for HTTP requests, the `MCP-Protocol-Version` header match `_meta[\"io.modelcontextprotocol/protocolVersion\"]`.\n\n### Example Code\n\n```Python\n'''\nWith a Python SDK Streamable HTTP server running, set `ENDPOINT` to the server endpoint.\n\nThen send an initial `initialize` request whose HTTP header and JSON-RPC body disagree:\n'''\n\nENDPOINT=http://127.0.0.1:8080/mcp\n\ncurl -i -sS --http1.1 -X POST \"$ENDPOINT\" \\\n  -H 'Content-Type: application/json' \\\n  -H 'Accept: application/json, text/event-stream' \\\n  -H 'MCP-Protocol-Version: 2025-03-26' \\\n  --data '{\"jsonrpc\":\"2.0\",\"id\":\"init-conflict-1\",\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{},\"clientInfo\":{\"name\":\"version-conflict-repro\",\"version\":\"0.1.0\"}}}'\n\n'''\nThen repeat with the values reversed: body `2025-03-26`, header `2025-11-25`.\n\nObserved result in both stateful and stateless Streamable HTTP profiles:\n\n'''\n\nHTTP/1.1 200 OK\n\n{\"jsonrpc\":\"2.0\",\"id\":\"init-conflict-1\",\"result\":{\"protocolVersion\":\"\u003cbody protocolVersion\u003e\", ...}}\n```\n\n### Python \u0026 MCP Python SDK\n\n```Text\n- Python used for reproduction: `3.12.3`\n- Python SDK stable release: `v1.27.1` (`77431ebe`)\n- Also reproduced with pinned `main` snapshot from 2026-05-11: `161834d4`\n- SDK `pyproject.toml` declares `requires-python = \"\u003e=3.10\"`\n- Transport: Streamable HTTP server, stateful and stateless profiles\n```","author":{"url":"https://github.com/cclabadmin","@type":"Person","name":"cclabadmin"},"datePublished":"2026-05-16T10:05:03.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/2618/python-sdk/issues/2618"}