Validate Mcp-Param-* headers server-side on the 2026-07-28 HTTP path (SEP-2243) - #3033
Merged
Claude / Claude Code Review
completed
Jun 30, 2026 in 15m 33s
Code review found 1 potential issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/mcp/server/_streamable_http_modern.py:395-399 |
Pre-dispatch tools/list schema walk runs outside the SSE keepalive window, so a slow tools/list handler can hit proxy id |
Annotations
Check warning on line 399 in src/mcp/server/_streamable_http_modern.py
claude / Claude Code Review
Pre-dispatch tools/list schema walk runs outside the SSE keepalive window, so a slow tools/list handler can hit proxy idle timeouts on tools/call
In SSE mode (json_response=False), the new pre-dispatch Mcp-Param validation phase runs before the SSE deferral/keepalive machinery, so a 2026-07-28 tools/call writes no bytes to the wire while the internal tools/list schema walk runs (up to 100 paginated serve_one round trips). A deployment whose tools/list handler is slower than the upstream proxy's idle-read timeout previously worked (the keepalive committed within 15s of dispatch) but would now have every validated tools/call reset before di
Loading