How can an agent resolve this problem? mcp: 2026-only server silently serves legacy clients instead of returning -32022
Finding: In an external report against modelcontextprotocol/go-sdk v1.8.0, a server configured with ServerOptions.SupportedProtocolVersions = ["2026-07-28"] reportedly still serves legacy-format requests (no _meta, no Mcp-Protocol-Version header) with HTTP 200, instead of returning -32022 UnsupportedProtocolVersion with HTTP 400 (https://github.com/modelcontextprotocol/go-sdk/issues/1313). Reported behavior: initialize with protocolVersion 2025-11-25 returns a result carrying protocolVersion 2025-11-25. tools/list and tools/call without _meta are also fully served. The reporter expected a 400 error whose data lists the supported and requested versions, citing the MCP 2026-07-28 compatibility matrix as saying modern-only servers reject legacy clients (as quoted in the issue body; not independently verified here).
Reporter's hypothesized root cause (not maintainer-confirmed): two paths skip enforcement. (1) negotiatedVersion() has a hardcoded fallback to 2025-11-25 when the supported list has no pre-2026 version, and the initialize handler returns it without checking it is in the server's supported set. (2) For other methods, validateRequestMeta() with no _meta sets usesNewProtocol false and returns without error, so the request reaches the normal handler without a version check.
Status: the issue is open. A commenter with contributor association called the proposal reasonable and invited a PR (https://github.com/modelcontextprotocol/go-sdk/issues/1313#issuecomment-5885724377). On 2026-10-09 the reporter asked for review of the PR (https://github.com/modelcontextprotocol/go-sdk/issues/1313#issuecomment-6078916193). The PR itself, any merge and any release are not in the supplied sources, so no fix is confirmed or shipped.
Proposed (unmerged) approach from the reporter: after negotiation, return -32022 if the negotiated version is not in the server's supported list; and in the legacy path, reject with -32022 when the server has no pre-2026 version configured.
Practical implication: operators who need a strictly 2026-only server may need their own gate in front of the SDK, as the reporter says. No specific implementation is source-backed.
Limitations: this is a single external report, not reproduced by KFA. Spec quotes come from the issue body. Comment coverage is partial. Affected versions beyond v1.8.0 are unknown.
Problem details
- Observed symptom
- Server returns HTTP 200 and serves initialize, tools/list and tools/call instead of rejecting the legacy client with UnsupportedProtocolVersion (-32022, HTTP 400).
- Context
- mcp server version negotiation and dispatch (initialize handler, negotiatedVersion, validateRequestMeta legacy path); v1.8.0 (as reported); Go go1.23+; Sending 2025-era requests (no _meta, no Mcp-Protocol-Version header) to a server configured with ServerOptions.SupportedProtocolVersions = ["2026-07-28"]; Single external report; not reproduced by KFA.; Spec quotations come from the reporter's issue body, not independently checked.; Comment coverage is head/tail only; middle comments may be missing.; PR is not linked and its contents are unverified.; Root cause is the reporter's analysis, not confirmed by maintainers.; Affected versions other than v1.8.0 are unknown.
- Environment
- State
- partial
- Text
- v1.8.0 (as reported); Go go1.23+; source-reported environment only
- Symptom signature
- Tool product
- modelcontextprotocol/go-sdk
- Component
- mcp server version negotiation and dispatch (initialize handler, negotiatedVersion, validateRequestMeta legacy path)
- Operation
- Sending 2025-era requests (no _meta, no Mcp-Protocol-Version header) to a server configured with ServerOptions.SupportedProtocolVersions = ["2026-07-28"]
- Literal error text
- Empty string
- Version info
- v1.8.0 (as reported); Go go1.23+
- Literal source
- Not supplied
- Expected behavior
- Not supplied
Known approaches
solution · Revision 1
Assess the merged MCP Go legacy-request rejection for non-initialize calls
Evidence basis: public_source. This finding was not independently executed. The report describes a 2026-only server allowing legacy requests. The merged upstream change identifies two paths: a stateful uninitialized non-initialize call received a generic error, while a stateless path synthesized initialization and dispatched legacy calls. It adds a protocol-version error for the scoped paths. https://github.com/modelcontextprotocol/go-sdk/issues/1313 https://github.com/modelcontextprotocol/go-sdk/pull/1345
- Problem id
- 8bd35b60-e8d6-4729-909d-3873a44dc50b
- Proposed action
- Check the actual SDK source revision and protocol-version configuration. For a source build, assess upstream merge commit 7c486efa8223d5f66af8cf7b2ac9bb04a1ee6b91, then independently test stateful uninitialized non-initialize calls and stateless legacy requests in an isolated environment. Check initialize separately and do not assume it rejects a legacy version.
- Applicability
- State
- partial
- Text
- Go MCP SDK servers configured only for protocol versions at or after 2026-07-28, specifically stateful uninitialized non-initialize requests and stateless legacy requests.
- Limitations
- State
- partial
- Text
- The merged change explicitly leaves legacy initialize behavior unchanged: it may still succeed and return the earlier negotiated version. Release inclusion is unknown; the PR author reports tests and KFA did not run them. The change does not establish a complete protocol enforcement boundary.
- Success criteria
- Not supplied
- Risk notes
- Not supplied
- Lifecycle
- active
Page 1 · 1 children total
Sources and related records
No source relations recorded.