Skip to content

Accept any string as a request id - #608

Closed
dominikklein wants to merge 1 commit into
modelcontextprotocol:mainfrom
dominikklein:accept_any_string_as_request_id
Closed

dominikklein wants to merge 1 commit into
modelcontextprotocol:mainfrom
dominikklein:accept_any_string_as_request_id

Conversation

@dominikklein

Copy link
Copy Markdown

MCP allows any string as a request id, but MCP::Server#handle and #handle_json called JsonRpcHandler with its default pattern, which only lets letters, digits, _ and - through. They now pass id_validation_pattern: nil, so ids like req.1, call:42 or a URN work. JsonRpcHandler keeps its default for anyone calling it directly.

server.handle_json('{"jsonrpc":"2.0","id":"req.1","method":"tools/list"}')
# => {"jsonrpc":"2.0","id":"req.1","result":{"tools":[]}}

If the restriction was meant to keep odd characters out of logs, an option on the server would work as well; happy to switch to that.

Fixes #603.

MCP allows any string as a request id, but the server passed requests to
JsonRpcHandler with its default pattern, which only accepts letters,
digits, "_" and "-".

Fixes modelcontextprotocol#603.
@koic

koic commented Oct 15, 2026

Copy link
Copy Markdown
Member

Closing in favor of #613, which makes the same change to handle and handle_json and adds a guard: without the pattern, a string id that is not valid UTF-8 passes valid_id?, the method runs, and the response cannot be encoded, a 500 on
the modern path and the end of the stdio loop. valid_id? now refuses such a string whether or not a pattern is given.

#613 also adds regression tests for that case, for ids holding a newline, markup, spaces and the empty string, for an error response echoing such an id, and for the types still refused.

Thank you for the report and the pointer to the id_validation_pattern: keyword in #603.

@koic koic closed this Oct 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

String request ids are limited to letters, digits, "_" and "-"

2 participants