MCP endpoints accept JSON-RPC batch payloads

[shiju-nv]

Agent Diagnostic

• Reviewed the MCP and generic JSON-RPC policy implementation.
• Compared the parser behavior with the MCP 2025-11-25 Streamable HTTP transport.
• The shared parser accepts a nonempty JSON array as a JSON-RPC batch for both protocol: json-rpc and protocol: mcp.
• MCP Streamable HTTP does not permit batch arrays. An MCP POST body contains one JSON-RPC request, notification, or response.

Description

Actual behavior: An endpoint configured with protocol: mcp accepts a top-level JSON array, evaluates its members as a JSON-RPC batch, and may forward the batch to the upstream server.

Expected behavior: An MCP endpoint should reject a POST body whose top-level value is a JSON array. The request should not reach the upstream server. Valid single-message MCP requests, notifications, and responses should retain their existing behavior. Generic protocol: json-rpc batch behavior is outside the scope of this issue and should remain unchanged.

This distinction matters because JSON-RPC is a message format, while MCP adds its own transport contract on top of that format. A behavior allowed by generic JSON-RPC is not automatically allowed by MCP.

Reproduction Steps

1. Configure an HTTP endpoint with protocol: mcp and allow the ping method.
2. Send one HTTP POST whose JSON body is an array containing two valid JSON-RPC ping requests.
3. Observe that OpenShell forwards the batch to the upstream server.

Environment

• OS: Not host-specific
• Docker: Not driver-specific
• OpenShell: revision 5477e2f21d47616e536fb05375f09731be50c143
• Protocol reference: MCP revision 2025-11-25

Logs

Agent-First Checklist

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why