Fetching from the wire…
Public story · 2026-09-12 · high
The fix marks the third time in one review that a 200 status hid a real error underneath it.
Why now: The bug surfaced in the September 12 review as the third same-day case of a 200 status masking a failure.
rust-sdk's HTTP transport returned status 200 on requests that had failed. The function that maps errors to status codes, jsonrpc_http_status, sends three failure types (unsupported protocol version, missing client capability, invalid params) to a 400 response. ErrorCode::HEADER_MISMATCH fell through to the default 200 instead.
A server handler that returns Err(ErrorData::header_mismatch(...)) still writes a correct JSON-RPC error body with code -32020. The transport wraps that error in a success status anyway. Any client that checks the HTTP status before parsing the body reads the request as fine when it wasn't.
The fix is proposed in PR #1259, which adds HEADER_MISMATCH to the same 400 branch as the other three error types.
This is the third case in one day's review where a 200 status carried a failure inside it. Status code as truth isn't a safe assumption anywhere in this stack right now.
Each link below shares sources, entities, or timing with this story.
The July 28 MCP specification revision replaced session-based transport with "stateless, self-contained requests" and per-request capability negotiation. The old dance was initialize, receive an Mcp-Session-Id, then call your tool. Two round trips minimum, plus server-side sta...
AWS's writeup details real protocol maturity: one gateway can advertise multiple protocol versions simultaneously so clients negotiate per-request rather than at handshake, session pinning is gone entirely, routing and throttling happen on Mcp-Method/Mcp-Name headers at the HT...
It carries subtype, errors, api_error_status, terminal_reason and session_id, so callers can stop string-matching on failure text. The release also widens the MCP dependency to >=1.23.0,<3.0.0 and serves in-process SDK MCP servers over mcp's own in-memory transport instead of...
v0.5.0 split the Claude skill into a code-free HTTP client plus a stdlib server.py service with /health, /inspect, /clean, /capabilities, a generated OpenAPI 3.0.3 spec and GHCR Docker images on every v* tag. GitHub The portable lesson is in the fixes: rewrite calls now defaul...
The 2026-07-28 Model Context Protocol spec published today, and it removes two things every MCP server currently depends on: the initialize/initialized handshake and the Mcp-Session-Id header. Both are gone. Not deprecated. Gone from the core. (Model Context Protocol Blog) Wha...
JSON payloads are rejected past 1000 levels of nesting before the parser recurses, both SSE readers cap per-event bytes through a new MaxEventSize, stdio caps a single JSON-RPC frame via StdioTransport.MaxLineLength, and OAuth dynamic client registration responses are capped a...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.