Skip to content

fix(server): answer a non-Request body with INVALID_REQUEST, not INVALID_PARAMS - #3558

Closed
siye566 wants to merge 1 commit into
modelcontextprotocol:mainfrom
siye566:fix/invalid-request-code-for-non-request-body
Closed

siye566 wants to merge 1 commit into
modelcontextprotocol:mainfrom
siye566:fix/invalid-request-code-for-non-request-body

Conversation

@siye566

@siye566 siye566 commented Sep 22, 2026

Copy link
Copy Markdown

Fixes #3557

Motivation and Context

A POST body that parsed as JSON but was not a JSON-RPC message was answered with -32602 (INVALID_PARAMS). There are no params to be invalid in that case, so JSON-RPC 2.0 reserves -32600 (INVALID_REQUEST) for it; -32602 misreports the failure to the client. This is the first of the two shapes in #3557.

The second shape (an unknown method answered with INVALID_PARAMS instead of METHOD_NOT_FOUND) no longer reproduces on main: request parsing moved from shared/session.py's receive loop to shared/jsonrpc_dispatcher.py, and server/runner.py answers an unknown method with METHOD_NOT_FOUND, so no change was needed there.

A batch body (a JSON array) keeps INVALID_PARAMS: the hosting conformance test test_malformed_and_batched_bodies_return_400 pins that code for unsupported batch bodies, and #3557's case is the non-Request object body.

How Has This Been Tested?

  • New test test_non_request_body_is_invalid_request (tests/shared/test_streamable_http.py): a {"foo": "bar"} body returns 400 with -32600; a batch array still returns 400 with -32602.
  • Full suite: uv run --frozen pytest → 5961 passed, 16 skipped, 1 xfailed, 0 failed.
  • ruff check / ruff format --check clean; pyright unchanged (34 pre-existing Windows-only diagnostics, same as unpatched main).

Breaking Changes

Clients keying on -32602 for a non-Request body will now see -32600, which is what the spec requires. The HTTP status and the message text are unchanged.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)

Checklist

  • I am assigned to the linked issue (or it is labeled help wanted, or I'm a maintainer) — not assigned yet
  • I have disclosed any AI assistance and can explain the change in my own words

AI disclosure: the diff was written with the ZCode agent; I reproduced the -32602 response with a test before the change, ran the full suite and linters locally, and verified the batch-body behavior the existing conformance test pins.

…LID_PARAMS

A POST body that parsed as JSON but was not a JSON-RPC message was
answered with -32602 (INVALID_PARAMS). There are no params to be invalid
in that case, so JSON-RPC 2.0 reserves -32600 (INVALID_REQUEST) for it;
-32602 misreports the failure to the client. This is the first of the two
shapes in modelcontextprotocol#3557.

The second shape (an unknown method answered with INVALID_PARAMS) no
longer reproduces on main: request parsing moved from
shared/session.py's receive loop to shared/jsonrpc_dispatcher.py, and
server/runner.py answers an unknown method with METHOD_NOT_FOUND.

A batch body (a JSON array) keeps INVALID_PARAMS, pinned by the hosting
conformance test for unsupported batch bodies; modelcontextprotocol#3557's case is the
non-Request object body.

Fixes modelcontextprotocol#3557
@github-actions github-actions Bot added the missing-issue-link Auto-closed: PR needs a linked issue assigned to its author (see CONTRIBUTING.md) label Sep 22, 2026
@github-actions

Copy link
Copy Markdown
Contributor

This PR has been closed automatically. This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue, and you aren't currently assigned to #3557.

If a maintainer assigns you to #3557, this PR reopens on its own and there's nothing more you need to do here. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. What does help is engaging on the issue itself by confirming the repro, explaining why it matters for your use case, or describing the approach you'd take.

You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned, and realistically most auto-closed PRs stay closed. There's no need to open a new PR either way.

CONTRIBUTING.md has the full reasoning, but in short:

  • We're a small team with very little capacity to review community PRs right now.
  • Many recent PRs are AI-generated with little human review, and reviewing one carefully still costs a maintainer as much time as it ever did. A well-described issue is usually more useful to us than the code.

Maintainers: reopen, remove missing-issue-link, or add bypass-issue-check to override.

@github-actions github-actions Bot closed this Sep 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

missing-issue-link Auto-closed: PR needs a linked issue assigned to its author (see CONTRIBUTING.md)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Malformed requests get -32602 where JSON-RPC 2.0 requires -32600 (non-Request body) and -32601 (unknown method)

1 participant