fix(client): preserve Streamable HTTP request provenance by edenbuilds · Pull Request #2667 · modelcontextprotocol/typescript-sdk

edenbuilds · 2026-08-15T23:55:47Z

Summary

preserve the originating client request ID across a Streamable HTTP POST SSE response stream and resumed GET
expose it through the existing ctx.mcpReq.relatedRequestId client-handler context
preserve resumption callbacks, request abort, and stream-end settlement across resumed GETs
keep standalone GET messages and normal responses backward-compatible
add client documentation, regression tests, and a patch changeset

Verification

Regression proof: before the source change, the focused provenance assertion received no attributed server request.
Regression proof: removing resumed callback forwarding makes the direct resumption-token stream-end test fail with zero callback calls.
After the fixes: focused client suite passes 76/76.
@modelcontextprotocol/client typecheck passes.
ESLint, Prettier, and git diff --check pass.

…tprotocol#2659) Expose the originating client request ID when a server-initiated JSON-RPC request arrives on that request's SSE response stream. Fixes modelcontextprotocol#2659

changeset-bot · 2026-08-15T23:55:51Z

🦋 Changeset detected

Latest commit: 913689e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-15T23:56:58Z

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2667

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2667

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2667

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2667

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2667

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2667

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2667

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2667

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2667

commit: 913689e

Refresh the PR base after upstream's cancellation request ID 0 fix while preserving the Streamable HTTP provenance change.

edenbuilds · 2026-08-16T14:14:25Z

Refreshed this branch onto the current upstream/main without rewriting history (d363e64). The diff against upstream remains limited to the Streamable HTTP provenance fix, its regression test, and the changeset. All 14 reported CI checks are green; ready for maintainer review.

Merge the latest upstream MCP protocol-version validation change without altering the four-file stream provenance diff.

edenbuilds · 2026-08-17T07:05:57Z

Refreshed the branch onto the latest upstream main in non-rewriting merge commit d0f8ca2b; the diff against current upstream remains limited to the existing four provenance files, and the expected six-package changeset is still detected. GitHub CI has restarted on the refreshed head. The local focused test remains blocked by this clone’s unresolved @modelcontextprotocol/core-internal package entry; no source changes were made in the refresh.

The send(..., { resumptionToken }) path built its _startOrAuthSse options without relatedRequestId, so a server-initiated request replayed on a resumed stream arrived unattributed -- the long-running-call case the original fix was aimed at. Add negative tests pinning that the standalone GET stream and the response terminating a POST stream stay unattributed.

KKonstantinov · 2026-08-17T07:21:45Z

@claude review

claude · 2026-08-17T07:30:44Z

            const hasRequests = messages.some(msg => 'method' in msg && 'id' in msg && msg.id !== undefined);
+            const relatedRequestId = messages.length === 1 && isJSONRPCRequest(messages[0]) ? messages[0].id : undefined;


🟡 [quality] nit: the new relatedRequestId derivation introduces a second, divergent "is this a request" predicate (isJSONRPCRequest) directly beneath the existing hand-rolled hasRequests check ('method' in msg && 'id' in msg && msg.id !== undefined); both should derive from one messages.filter(isJSONRPCRequest) pass.

Extended reasoning...

Concrete cost: two adjacent lines now encode the same concept with different semantics — hasRequests accepts a message lacking jsonrpc: '2.0' while isJSONRPCRequest rejects it — so a maintainer must reason about and keep in sync two request-detection definitions, and a payload that satisfies one but not the other silently opens the SSE-handling branch with relatedRequestId undefined. Simpler form: const requests = messages.filter(isJSONRPCRequest); const hasRequests = requests.length > 0; const relatedRequestId = messages.length === 1 && requests.length === 1 ? requests[0].id : undefined; — one predicate, same behavior for well-formed traffic.

Verification: nit — the factual claim is true. At packages/client/src/client/streamableHttp.ts:1141-1142 the diff adds const relatedRequestId = messages.length === 1 && isJSONRPCRequest(messages[0]) ? messages[0].id : undefined; directly beneath the pre-existing hand-rolled predicate const hasRequests = messages.some(msg => 'method' in msg && 'id' in msg && msg.id !== undefined);. The two predicates do dive

Merge the latest upstream changes without rewriting the maintainer follow-up already on the pull request branch.

edenbuilds · 2026-08-18T05:58:35Z

Refreshed the PR after the maintainer follow-up 5d42a7f4.

d237edae is a non-rewriting merge of current upstream main (3e90449f); the diff against upstream remains limited to the existing provenance changes, regression tests, and changeset. Local client verification now passes: focused tests 73/73, typecheck, ESLint, and Prettier. GitHub CI is rerunning on the refreshed head.

Surface relatedRequestId in client handler context and preserve the resumption token, callbacks, and stream-end lifecycle across resumed GETs. Keep request classification on one JSON-RPC predicate. Add regression coverage for handler visibility, token preservation, and resumption callback delivery.

Refresh the PR onto the latest upstream changes without rewriting its existing commits.

edenbuilds · 2026-08-23T21:42:22Z

Addressed the open Claude findings and pushed e7c7e36.

surfaced relatedRequestId in ctx.mcpReq for client request handlers
preserved the initial Last-Event-ID across reconnects
carried resumption-token and stream-end callbacks through resumed GETs
unified request classification on isJSONRPCRequest

Verification: each new regression assertion failed on the pre-fix source, then the focused set passed 5/5; core-internal and client typechecks, client lint, and git diff --check pass. The branch is refreshed onto current upstream/main without rewriting history. GitHub Actions is rerunning on the new head.

fix(client): preserve Streamable HTTP request provenance (modelcontex…

d1584c4

…tprotocol#2659) Expose the originating client request ID when a server-initiated JSON-RPC request arrives on that request's SSE response stream. Fixes modelcontextprotocol#2659

edenbuilds requested a review from a team as a code owner August 15, 2026 23:55

Merge upstream/main into codex/fix-stream-provenance-2659

d363e64

Refresh the PR base after upstream's cancellation request ID 0 fix while preserving the Streamable HTTP provenance change.

chore(client): refresh stream provenance branch onto upstream main

d0f8ca2

Merge the latest upstream MCP protocol-version validation change without altering the four-file stream provenance diff.

claude Bot reviewed Aug 17, 2026

View reviewed changes

chore(client): refresh provenance branch onto upstream main

d237eda

Merge the latest upstream changes without rewriting the maintainer follow-up already on the pull request branch.

claude Bot added the v2 Ideas, requests and plans for v2 of the SDK which will incorporate major changes and fixes label Aug 18, 2026

edenbuilds added 2 commits August 24, 2026 02:39

Merge upstream/main into the Streamable HTTP provenance fix

e7c7e36

Refresh the PR onto the latest upstream changes without rewriting its existing commits.

test(client): document and cover resumed stream provenance

913689e

Navigation Menu

Uh oh!

fix(client): preserve Streamable HTTP request provenance - #2667

fix(client): preserve Streamable HTTP request provenance#2667
edenbuilds wants to merge 8 commits into
modelcontextprotocol:mainfrom
edenbuilds:codex/fix-stream-provenance-2659

edenbuilds commented Aug 15, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 15, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Aug 15, 2026 •

edited

Loading

Uh oh!

edenbuilds commented Aug 16, 2026

Uh oh!

edenbuilds commented Aug 17, 2026

Uh oh!

KKonstantinov commented Aug 17, 2026

Uh oh!

Uh oh!

Uh oh!

claude Bot Aug 17, 2026

Uh oh!

Uh oh!

edenbuilds commented Aug 18, 2026

Uh oh!

edenbuilds commented Aug 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		const hasRequests = messages.some(msg => 'method' in msg && 'id' in msg && msg.id !== undefined);
		const relatedRequestId = messages.length === 1 && isJSONRPCRequest(messages[0]) ? messages[0].id : undefined;

Uh oh!

Conversation

edenbuilds commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Uh oh!

changeset-bot Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

edenbuilds commented Aug 16, 2026

Uh oh!

edenbuilds commented Aug 17, 2026

Uh oh!

KKonstantinov commented Aug 17, 2026

Uh oh!

Uh oh!

Uh oh!

claude Bot Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

edenbuilds commented Aug 18, 2026

Uh oh!

edenbuilds commented Aug 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

edenbuilds commented Aug 15, 2026 •

edited

Loading

changeset-bot Bot commented Aug 15, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 15, 2026 •

edited

Loading