stacklok / toolhive / 29983767686

69%

Build Type

push

github

Committed by web-flow

Commit Message

Wire MCP 2026-07-28 revision classification into vMCP (#5913)

* Validate Mcp-Method/Mcp-Name headers against MCP body

vMCP's stateless decode seam needs to reject Modern (2026-07-28)
requests whose Mcp-Method/Mcp-Name headers contradict the parsed
JSON-RPC body, per the draft spec's Server Validation rules. Add
ValidateHeaderConsistency alongside the existing ClassifyRevision,
reusing the -32020 HeaderMismatch code and decoding the draft spec's
base64 sentinel wrapper for Mcp-Name before comparing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Add vMCP decode-seam classification middleware

Introduce classificationMiddleware to reject malformed Modern
(2026-07-28) requests at the vMCP decode seam using the existing
ClassifyRevision/ValidateHeaderConsistency helpers, ahead of wiring
it into the server's middleware chain. Not yet composed into
server.go: Legacy traffic is unaffected until that follow-up step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Wire classification middleware into vMCP handler chain

Compose classificationMiddleware between MCP-parsing and telemetry so
malformed Modern (2026-07-28) requests are rejected before dispatch,
while Legacy traffic and well-formed Modern requests fall through
unchanged. Add an end-to-end test through the real handler chain
covering the wiring itself, complementing the unit-level table added
alongside the middleware.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Run telemetry before classification in vMCP chain

Classification previously wrapped telemetry, so a rejected Modern
request short-circuited before telemetry ever ran, silently dropping
request/error metrics and traces for exactly the requests worth
observing. Reorder so telemetry wraps classification instead: it
still sees the parsed MCP context and now also records the outcome
of rejected requests.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Enforce Mcp-Method/Mcp-Name presence on Mod... (continued)

Coverage Stats

72 of 76 new or added lines in 3 files covered. (94.74%)

10 existing lines in 4 files now uncovered.

76864 of 111303 relevant lines covered (69.06%)

74.41 hits per line