feat: implement MCP-Protocol-Version header requirement for HTTP transport by felixweinberger · Pull Request #898 · modelcontextprotocol/python-sdk

felixweinberger

felixweinberger

felixweinberger

ochafik

ihrpr

ihrpr previously approved these changes Jun 12, 2025

ihrpr

Add integration tests to verify the new spec requirement that HTTP
clients must include the negotiated MCP-Protocol-Version header in
all requests after initialization.

Tests verify:
1. Client includes MCP-Protocol-Version header after initialization
2. Server validates header presence and returns 400 for missing/invalid
3. Server accepts requests with valid negotiated version

These tests currently fail as the feature is not yet implemented.

Related to spec change: modelcontextprotocol/modelcontextprotocol#548
The client now tracks the negotiated protocol version from the server's
response headers, enabling version-aware communication between client
and server.
- Add MCP_PROTOCOL_VERSION_HEADER constant
- Add _validate_protocol_version method to check header presence and validity
- Validate protocol version for all non-initialization requests (POST, GET, DELETE)
- Return 400 Bad Request for missing or invalid protocol versions
- Update tests to include MCP-Protocol-Version header in requests
- Fix test_streamablehttp_client_resumption to pass protocol version when resuming

This implements the server-side validation required by the spec change
that mandates clients include the negotiated protocol version in all
subsequent HTTP requests after initialization.

Github-Issue: #548
- Add extract_protocol_version_from_sse helper function to reduce code duplication
- Replace repeated protocol version extraction logic in 5 test functions
- Fix line length issues in docstrings to comply with 88 char limit

This improves test maintainability by centralizing the SSE response parsing logic.
- Add _validate_request_headers method that combines session and protocol validation
- Replace repeated calls to _validate_session and _validate_protocol_version
- Improves code maintainability and extensibility for future header validations
- No functional changes, all tests passing

This refactoring makes it easier to add new header validations in the future
by having a single entry point for all non-initialization request validations.
This better reflects that the method prepares headers for outgoing HTTP
requests, not just updating them with context. The method adds both
session ID and protocol version headers as needed.
…ader

When the MCP-Protocol-Version header is not present in requests, the server
now assumes protocol version "2025-03-26" instead of returning an error.
This maintains backwards compatibility with older clients that don't send
the version header.

The server still validates and returns 400 Bad Request for invalid or
unsupported protocol versions when the header is explicitly provided.

This change addresses the backwards compatibility requirement from
modelcontextprotocol/modelcontextprotocol#668

- Modified _validate_protocol_version to assume "2025-03-26" when header is missing
- Updated tests to verify backwards compatibility behavior
- Added new test specifically for backwards compatibility scenario

@felixweinberger

- update test comment
- log warning if no protocol version is set
- nits

@felixweinberger

- Use InitializeResult type for parsing server init response
- Add explanatory comment for DEFAULT_NEGOTIATED_VERSION constant
- Include supported protocol versions in error response when version mismatch occurs

ihrpr

@ihrpr ihrpr deleted the fweinberger/require-version branch

June 12, 2025 17:01