All issues

mcp: the negotiated protocol version is recorded on one path of four, so stdio accepts batches a SEP-2575 session forbids

#1272

· jmrplens opened

on Sep 15, 2026

mcp: three methods are served on a legacy session before the initialize handshake

#1271

· jmrplens opened

on Sep 15, 2026

mcp: a resource update cannot be delivered to one session, and the caller's context never reaches the sending middleware

#1265

· jmrplens opened

on Sep 13, 2026

proposal: mcp: expose the JSON-RPC request id to receiving middleware and handlers

#1264

· jmrplens opened

on Sep 13, 2026

mcp: a server cannot send the notifications/cancelled that 2026-07-28 requires when it tears down a subscriptions/listen stream

#1263

· jmrplens opened

on Sep 13, 2026

mcp: an SSE response keeps http.Server.WriteTimeout armed, so a long-lived stream dies before its first notification

#1262

· jmrplens opened

on Sep 13, 2026

A cancelled request is still answered

#1259

· jmrplens opened

on Sep 13, 2026

mcp: the declared protocol version, not the negotiated one, decides what a session is served

#1258

· jmrplens opened

on Sep 13, 2026

Index: nine findings from one audit of a large MCP server against the specification

#1257

· jmrplens opened

on Sep 13, 2026

stdio: a JSON-RPC batch holding a notification is never answered, or breaks the connection

#1256

· daFish opened

on Sep 13, 2026

Streamable HTTP: an x-mcp-header in a non-reachable schema position (items, oneOf, $ref, ...) is silently accepted instead of rejected

#1250

· arpankernel opened

on Sep 9, 2026

proposal: auth: support SEP-2350 request-time scope challenges

#1248

· panyam opened

on Sep 7, 2026