Skip to content

Relax MCP Accept-header negotiation and update tests; ensure lockfile sync #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Trailgenic wants to merge 2 commits into from
Closed

Relax MCP Accept-header negotiation and update tests; ensure lockfile sync #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d03bf5c
Relax MCP Accept negotiation
Trailgenic Jul 14, 2026
f0a3829
Align MCP Accept header handling
Trailgenic Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions app/mcp/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ export const runtime = 'nodejs'
const DEFAULT_ALLOWED_ORIGINS = ['https://ellaentity.ai', 'https://www.ellaentity.ai', 'https://mcp.ellaentity.ai']
const ALLOW_METHODS = 'POST, OPTIONS'
const ALLOW_HEADERS = 'Content-Type, Accept, Mcp-Session-Id, MCP-Protocol-Version'
const REQUIRED_ACCEPT_TYPES = ['application/json', 'text/event-stream'] as const
const ACCEPTED_RESPONSE_TYPES = ['application/json', 'text/event-stream'] as const

function allowedOrigins() {
return process.env.MCP_ALLOWED_ORIGINS?.split(',').map((origin) => origin.trim()).filter(Boolean) ?? DEFAULT_ALLOWED_ORIGINS
Expand Down Expand Up @@ -62,14 +62,18 @@ function hasJsonContentType(request: Request) {
return request.headers.get('content-type')?.toLowerCase().includes('application/json') ?? false
}

function hasRequiredAcceptTypes(request: Request) {
const accept = request.headers.get('accept')?.toLowerCase()
function hasCompatibleAcceptType(request: Request) {
const accept = request.headers.get('accept')

if (!accept) {
return false
if (!accept?.trim()) {
return true
}

return REQUIRED_ACCEPT_TYPES.every((type) => accept.includes(type))
const acceptedTypes = accept.toLowerCase().split(',').map((type) => type.trim())

return acceptedTypes.some(
(type) => type === '*/*' || ACCEPTED_RESPONSE_TYPES.some((acceptedType) => type.startsWith(acceptedType)),
)
}

export function OPTIONS(request: Request) {
Expand Down Expand Up @@ -108,8 +112,8 @@ export async function POST(request: Request) {
return jsonRpcError(request, 415, -32600, 'Content-Type must be application/json')
}

if (!hasRequiredAcceptTypes(request)) {
return jsonRpcError(request, 406, -32600, 'Accept must include application/json and text/event-stream')
if (!hasCompatibleAcceptType(request)) {
return jsonRpcError(request, 406, -32600, 'Accept must include application/json, text/event-stream, or */*')
}

try {
Expand Down
7 changes: 4 additions & 3 deletions tests/mcp.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,9 +64,10 @@ test('GET and OPTIONS implement method and CORS behavior', async () => {
test('POST validates content negotiation and origins', async () => {
const body = { jsonrpc: '2.0', id: 1, method: 'ping', params: {} }

assert.equal((await POST(request('POST', body, { accept: '' }))).status, 406)
assert.equal((await POST(request('POST', body, { accept: 'application/json' }))).status, 406)
assert.equal((await POST(request('POST', body, { accept: 'text/event-stream' }))).status, 406)
assert.notEqual((await POST(request('POST', body, { accept: '' }))).status, 406)
assert.notEqual((await POST(request('POST', body, { accept: 'application/json' }))).status, 406)
assert.notEqual((await POST(request('POST', body, { accept: 'text/event-stream' }))).status, 406)
assert.notEqual((await POST(request('POST', body, { accept: '*/*' }))).status, 406)
assert.equal((await POST(request('POST', body, { accept: 'text/plain' }))).status, 406)
assert.equal((await POST(request('POST', body, { 'content-type': 'text/plain' }))).status, 415)
assert.equal((await POST(request('POST', body, { origin: 'https://evil.example' }))).status, 403)
Expand Down
Loading