[Server] Reject JSON-RPC batch requests - #424
Conversation
MCP no longer supports JSON-RPC batches: a POST body must be a single JSON-RPC message. MessageFactory currently accepts top-level arrays and hydrates each entry, so a batch is handled as a set of messages instead of being refused outright. Reject any top-level array as invalid input before any entry is hydrated, and drop the now-dead maxBatchSize cap and its constructor parameter. Update the affected unit tests and the transports docs to match.
chr-hertel
left a comment
chr-hertel
left a comment
There was a problem hiding this comment.
Hi @ez-lbz, thanks for bringing this up - this will simplify that part message handling quite a bit :)
| * @return array<MessageInterface|InvalidInputMessageException> | ||
| * | ||
| * @throws \JsonException When the input string is not valid JSON | ||
| */ | ||
| public function create(string $input): array |
There was a problem hiding this comment.
this can be simplified even further now:
| * @throws InvalidInputMessageException When the input data is not a valid message | |
| * @throws \JsonException When the input string is not valid JSON | |
| */ | |
| public function create(string $input): MessageInterface |
| $batch = $data; | ||
| } else { | ||
| $batch = [$data]; | ||
| return [new InvalidInputMessageException('JSON-RPC batch requests are not supported; send a single JSON-RPC message.')]; |
There was a problem hiding this comment.
| return [new InvalidInputMessageException('JSON-RPC batch requests are not supported; send a single JSON-RPC message.')]; | |
| return [new InvalidInputMessageException('JSON-RPC batch requests are not supported anymore since specification release 2025-06-18; send a single JSON-RPC message.')]; |
chr-hertel
added
the
needs more work
|
Thanks for the review! Applied the suggestion to reference the spec release that removed batches in the error message (commit 752c430). The |
chr-hertel
added
breaking change
chr-hertel
added
the
needs confirmation
|
Putting this on hold for now - the spec version Anyhow, when we tackle this, we should go even one step further and change the method profile to |
2 participants
MCP no longer supports JSON-RPC batches: a POST body must be a single JSON-RPC message.
MessageFactorycurrently accepts top-level arrays and hydrates each entry, so a batch is processed as a set of messages instead of being refused outright.This change rejects any top-level array as invalid input before any entry is hydrated, returning a single
InvalidInputMessageException(the existing per-message error contract) instead of processing the batch. The now-deadmaxBatchSizecap, its constructor parameter, andDEFAULT_MAX_BATCH_SIZEare removed.Tests:
MessageFactoryTest: batch payloads (valid, mixed, and error-containing) are asserted to be rejected wholesale; obsoletemaxBatchSizetests removed.MalformedInputTest: a batch payload is asserted to be rejected without hydrating any entry.Server\ProtocolTest: batch input is asserted to produce a single Invalid Request error and to never hydrate batch entries.