examples: SDK-transport servers cannot speak draft protocol versions — extract everything-server's pre-transport handling into a shared helper #568

Gap

The CLI defaults a scenario to DRAFT_PROTOCOL_VERSION when the scenario declares introducedIn: DRAFT_PROTOCOL_VERSION (src/runner/server.ts), and probes draft-version servers with server/discover. The released @modelcontextprotocol/sdk (1.32.1 at time of writing) rejects any protocol version it does not recognize with an HTTP 400 before the request reaches a handler, and no released SDK recognizes 2026-07-28.

everything-server.ts handles this correctly: it reads the MCP-Protocol-Version header itself, validates it, and answers server/discover before the SDK transport sees the request. But that logic is inlined, and three other SDK-transport example servers have no pre-transport version handling at all:

• examples/servers/typescript/invalid-tool-names.ts
• examples/servers/typescript/no-dns-rebinding-protection.ts
• examples/servers/typescript/sep-2106-stripped-schema.ts

Nothing on main triggers this today — those three pair only with scenarios introduced at 2025-11-25 or earlier. But the failure mode is silent and total when it does trigger: conformance#529's new example servers hit exactly this (the compliant server passed 2 of 26 checks at the default version; analysis in #529 (comment)), and any future draft-introduced scenario paired with one of the three servers above fails the same way. Unit tests do not catch it because testContext() defaults to LATEST_SPEC_VERSION, which exercises the initialize path rather than the CLI-default server/discover path.

Proposal

1. Extract everything-server's pre-transport version handling (header validation plus the server/discover answer) into a shared helper under examples/servers/typescript/helpers/, and use it in all SDK-transport example servers.
2. Add one unit test per SDK-transport example server at DRAFT_PROTOCOL_VERSION, so a server that cannot speak the draft wire fails CI instead of failing users.

Scope note: this is example-server infrastructure only. The SDK's rejection of unreleased versions is correct behavior, and #529 is fixing its own three servers in-PR; this issue covers the remaining three on main plus the shared helper so the class stays closed.

Generated with the aid of Claude (Fable 5).