MCP clients requesting protocol 2025-11-25 are negotiated down to 2025-06-18, where invalid tool arguments return a JSON-RPC error that some clients show without the validation details.
Offer the supported 2025-11-25 adapter alongside 2025-06-18. Newer clients receive the validation message as an isError tool result; clients requesting 2025-06-18 keep its existing -32602 response. The first offered version also becomes the fallback for unsupported initialize versions. Tool definitions, handlers, authentication, and access controls are unchanged.
Based on the original fix by @mfazekas in #18490. This replaces the approach in #18098; 2026-07-28 server/discover support in #16067 remains outside scope.
This is a focused fix to the pinned MCP protocol list, using the newer adapter already shipped by Effect while retaining the legacy adapter. Maintainer takeover and publication were explicitly authorized in this campaign; the takeover notice records ownership. That authorization does not approve landing. Macroscope's Needs Human Approval verdict, represented by the NEUTRAL Approvability check on the previous head, remains a human landing gate. It has not been waived or satisfied by the takeover or the independent code reviews.
The reviewed head b3e239b2ad preserves the contributor's commits and merges main at 62144bf0f8. Recorded checks on that head:
McpHttpServer.test.ts HTTP tests passed.No UI change or screenshots are required. No live Claude client session was run during this takeover. These are local verification results; GitHub CI and configured reviews must be checked for the published head before landing. Historical checks on the previous head do not certify this head.
Taken over with Claude Opus 5.5 (tests and review), Claude Fable 5.1 (implementation), and GPT-6.1 Sol (review) through T3 Code; publication coordinated with GPT-6.1 Sol in the Codex harness.
Added 1 commit
Verdict: Needs Human Approval
Macroscope's review found this PR requires human approval — The MCP transport now enables 2025-11-25 by default, changing protocol negotiation and the user-visible handling of invalid tool arguments while preserving the legacy version. The focused regression test covers both paths, but the default production behavior change requires human review.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review. 🎉
70d79cb0-ccda-4001-8379-98b726f87909Reviewing files that changed from the base of the PR and between e688034b5f5505f92fcf1d78ba853c9c0107f9f1 and 723d58724ca8067b13af8ad8e585b31f2058ffb8.
apps/server/src/mcp/McpHttpServer.test.tsapps/server/src/mcp/McpHttpServer.tsIncluded review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.
The HTTP MCP transport now advertises protocol versions 2025-11-25 and 2025-06-18. A test checks the invalid-argument response for each version.
MCP protocol compatibility
| Layer / File(s) | Summary |
|---|---|
Protocol support and invalid-argument responses apps/server/src/mcp/McpHttpServer.ts, apps/server/src/mcp/McpHttpServer.test.ts | The transport advertises both protocol versions. The test checks for an error-marked tool result with an invalid-parameters message for 2025-11-25, and JSON-RPC error code -32602 for 2025-06-18. |
Priority: ➖ Normal
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Suggested reviewers: juliusmarminge
723d5The transport retains the older protocol and supports the newer version’s validation-message response. No actionable merge-blocking risk is established; normal checks remain appropriate.
Security architecture risk: 🔵 Low · up to 723d5
The newer protocol preserves legacy support and uses the existing authentication and tool-access controls. No introduced security weakness was identified. Compatibility for clients requesting other protocol versions remains unverified.
Retained concerns No architecture-level concerns identified.
Security Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
| Check name | Status | Explanation |
|---|---|---|
| Linked Issues check | Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | Passed | Check skipped because no linked issues were found for this pull request. |
| Title check | Passed | The title clearly and concisely describes the main change: negotiating MCP protocol version 2025-11-25 so clients receive invalid-argument errors with validation details. |
| Description check | Passed | The description covers the problem, change, scope and approval context, verification results, limitations, and tooling used. It explains the behavior for both supported protocol versions and identifie… |
Explanation
The description covers the problem, change, scope and approval context, verification results, limitations, and tooling used. It explains the behavior for both supported protocol versions and identifies the outstanding requirement to check GitHub CI and configured reviews before landing.
Comment @coderabbitai help to get the list of available commands.
Taking over this one. I’ll reduce the tests to the useful coverage, update the implementation against current main, and verify it before publishing the changes.
Added 4 commits
Taking over this one
