-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: None
-
Security Level: Public (Issues that anyone on the internet can see)
-
None
-
Not Needed
-
MCP Developers
In HTTP mode, a POST to /mcp naming server/discover without the per-request _meta protocol-version envelope is classified as 2025-era traffic and answered by the sessionful legacy handler — HTTP 400 with -32004 "invalid request" when no session id is present, or HTTP 200 with -32601 "Method not found" inside a live legacy session — even though the endpoint does implement server/discover on its modern (2026-07-28) path. Neither answer is a recognized modern JSON-RPC error, so under the 2026-07-28 Streamable HTTP backward-compatibility rules a dual-era client reads it as "not a modern server" and falls back to initialize rather than retrying with the envelope; the endpoint should instead answer such requests through the modern handler, whose validation ladder returns HTTP 400 with -32022 UnsupportedProtocolVersion listing the versions it serves.