fix(server): parse Accept media types exactly

[SnowSky1]

Fixes #2480.

Summary

Streamable HTTP server Accept validation used raw substring checks, so values such as application/jsonx and text/event-stream-bogus incorrectly satisfied the required concrete media types. This affected both POST negotiation and GET SSE requests.

This change:

• adds an internal listsMediaType helper that parses the comma-separated Accept list and compares media-type essences case-insensitively;
• handles parameters and quoted parameter values without splitting on commas inside quoted strings;
• requires a positive RFC 9110 quality value, so a required media type with q=0 is not treated as supported;
• updates GET and POST Streamable HTTP validation to use exact media-type matching;
• adds regression coverage for substring false positives, valid case/parameter variants, quoted commas, zero/invalid quality values, wildcards, and missing headers;
• includes a patch changeset for the server and core-internal packages.

This follows the same parsed-media-type approach recently applied to Content-Type in #2441 / #2444, while keeping Accept-specific list parsing internal.

Testing

Validated after merging current main (70de0c8b):

• pnpm --filter @modelcontextprotocol/core-internal exec vitest run test/shared/mediaType.test.ts — 12 passing
• pnpm --filter @modelcontextprotocol/server exec vitest run test/server/streamableHttp.test.ts — 61 passing
• core-internal and server typechecks — clean
• core-internal and server lint/format checks — clean
• full workspace typecheck, lint, and formatting — clean
• pnpm build:all — clean

The remaining platform-local check:all docs step is covered by CI; TypeDoc rejects native Windows backslash entry-point globs before documentation generation.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1b4079e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/core-internal	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2481

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2481

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2481

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2481

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2481

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2481

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2481

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2481

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2481

commit: 1b4079e

[SnowSky1]

Rebased onto current main. Revalidated the touched packages: core-internal media-type tests 11/11 pass, server streamable HTTP tests 55/55 pass, and both package typechecks are clean. The repository pre-push hook also completed the full workspace build, lint, and typecheck successfully. CI is rerunning now.

[SnowSky1]

@felixweinberger, when you have a chance, could you review this? It complements #2441 by applying exact media-type parsing to Accept; the branch is rebased onto current main, mergeable, and all CI checks are green.

[SnowSky1]

Rebased again onto current main (head bf3bfcb). The branch is mergeable and no longer behind; all 14 checks are green, including build, examples E2E, Node 20/22/24 unit and E2E suites, Bun/Deno runtime tests, and client/server conformance.

@felixweinberger, when you have bandwidth, could you review this focused Accept media-type parsing fix?

[SnowSky1]

Merged current main (70de0c8b) into the branch; the PR is mergeable and no longer behind.

The latest head also respects RFC 9110 quality exclusions: a required media type with q=0 is not treated as supported, while positive quality values remain accepted.

All 14 checks are green at head 1b4079e6, including Node 20/22/24 unit and E2E suites, Bun/Deno runtime tests, client/server conformance, build, examples E2E, and continuous package publishing.

The focused current-head suites also pass locally: core-internal media-type tests 12/12 and server Streamable HTTP tests 61/61.

The corresponding v1.x backport is ready as draft #2738, with all applicable CI checks green.

@felixweinberger, this is the remaining Accept-header counterpart to the parsed Content-Type validation from #2441/#2444. Could you review when available?