SEP-2243: ServerRejectsMissingMethodHeader contradicts TypeScript SDK behavior

[caomengxuan666]

Description

The http-header-validation scenario's ServerRejectsMissingMethodHeader test sends a POST request without Mcp-Method header and expects the server to reject it with HTTP 400 + JSON-RPC error code -32001.

However, all other conformance scenarios (tools-list, tools-call-*, resources-*, prompts-*, etc.) use connectToServer() which creates a TypeScript SDK StreamableHTTPClientTransport — and this client does not send Mcp-Method headers.

This means:

• If a server implements SEP-2243 correctly (rejects missing Mcp-Method), all SDK-backed scenarios fail (32+ failures)
• If a server makes Mcp-Method optional (to be compatible with the TypeScript SDK), the ServerRejectsMissingMethodHeader test fails

The conformance suite is self-contradictory: it tests a MUST requirement that the reference client implementation doesn't satisfy.

Expected behavior

Either:

1. The TypeScript SDK should send Mcp-Method (and Mcp-Name) headers per SEP-2243, OR
2. The ServerRejectsMissingMethodHeader test should be downgraded from FAILURE to WARNING, since the reference client itself doesn't comply

Current C++ SDK result

With Mcp-Method optional (matching TypeScript SDK behavior): 108 passed, 1 failed
With Mcp-Method required (matching SEP-2243 spec): 64 passed, 32 failed

Related

• TypeScript SDK issue: fix: Send required Mcp-Method/Mcp-Name headers per SEP-2243 typescript-sdk#2176

[caomengxuan666]

Cross-linking: the root cause is in the TypeScript SDK — typescript-sdk#2176.

As a data point, the C++ SDK (cxxmcp) sends Mcp-Method and Mcp-Name headers on all POST requests per SEP-2243. With Mcp-Method optional (matching current TypeScript SDK behavior), our server scores 108/1 on --suite all. The single remaining failure is this test case. If the TypeScript SDK adds the headers, the contradiction resolves and servers can safely enforce the MUST requirement.

[caomengxuan666]

Adding C++ SDK evidence from cxxmcp:

• SDK repo: https://github.com/caomengxuan666/cxxmcp
• Conformance/examples repo: https://github.com/caomengxuan666/cxxmcp-examples
• SDK evidence doc: https://github.com/caomengxuan666/cxxmcp/blob/master/docs/conformance_evidence.md
• Full run notes: https://github.com/caomengxuan666/cxxmcp-examples/blob/main/CONFORMANCE_STATUS.md
• SDK commit: caomengxuan666/cxxmcp@6beb3f0
• Examples/conformance commit: caomengxuan666/cxxmcp-examples@a90a97c

Current local modelcontextprotocol/conformance --suite all result for the C++ server is 108 passed / 1 failed.

The only remaining server failure is http-header-validation / ServerRejectsMissingMethodHeader. The C++ client transport sends Mcp-Method, but strict server-side enforcement currently breaks the TypeScript SDK v1.29.0 conformance client because StreamableHTTPClientTransport does not send Mcp-Method.

So the strict missing-header test currently conflicts with the runner's TS client dependency. If a server enforces the SEP-2243 Mcp-Method MUST literally, the broader TS-client-driven server suite fails; if it remains compatible with the current TS SDK client, this single strict header test fails.

[mikekistler]

IMHO, option #2

2. The ServerRejectsMissingMethodHeader test should be downgraded from FAILURE to WARNING, since the reference client itself doesn't comply

Is the WRONG fix / expected behavior. The conformance tests should flag every non-compliance to a spec "MUST" as a FAILURE.

[caomengxuan666]

Agreed. Option #1 is the right fix — the TypeScript SDK should send Mcp-Method / Mcp-Name headers per SEP-2243. Lowering the test severity would just mask a real spec violation. The C++ SDK (cxxmcp) already sends these headers correctly, so the reference client should do the same.