feat: add backwards compatibility for missing MCP-Protocol-Version header

When the MCP-Protocol-Version header is not present in requests, the server
now assumes protocol version "2025-03-26" instead of returning an error.
This maintains backwards compatibility with older clients that don't send
the version header.

The server still validates and returns 400 Bad Request for invalid or
unsupported protocol versions when the header is explicitly provided.

This change addresses the backwards compatibility requirement from
modelcontextprotocol/modelcontextprotocol#668

- Modified _validate_protocol_version to assume "2025-03-26" when header is missing
- Updated tests to verify backwards compatibility behavior
- Added new test specifically for backwards compatibility scenario

Author: felixweinberger

src/mcp/server/streamable_http.py

@@ -696,14 +696,9 @@ async def _validate_protocol_version(self, request: Request, send: Send) -> bool
         # Get the protocol version from the request headers
         protocol_version = request.headers.get(MCP_PROTOCOL_VERSION_HEADER)
 
-        # If no protocol version provided, return error
+        # If no protocol version provided, assume version 2025-03-26
         if not protocol_version:
-            response = self._create_error_response(
-                "Bad Request: Missing MCP-Protocol-Version header",
-                HTTPStatus.BAD_REQUEST,
-            )
-            await response(request.scope, request.receive, send)
-            return False
+            protocol_version = "2025-03-26"
 
         # Check if the protocol version is supported
         if protocol_version not in SUPPORTED_PROTOCOL_VERSIONS:

tests/shared/test_streamable_http.py

@@ -1439,7 +1439,7 @@ async def test_client_includes_protocol_version_header_after_init(
 
 
 def test_server_validates_protocol_version_header(basic_server, basic_server_url):
-    """Test that server returns 400 Bad Request version header is missing or invalid."""
+    """Test that server returns 400 Bad Request version if header missing or invalid."""
     # First initialize a session to get a valid session ID
     init_response = requests.post(
         f"{basic_server_url}/mcp",
@@ -1452,22 +1452,6 @@ def test_server_validates_protocol_version_header(basic_server, basic_server_url
     assert init_response.status_code == 200
     session_id = init_response.headers.get(MCP_SESSION_ID_HEADER)
 
-    # Test request without MCP-Protocol-Version header (should fail)
-    response = requests.post(
-        f"{basic_server_url}/mcp",
-        headers={
-            "Accept": "application/json, text/event-stream",
-            "Content-Type": "application/json",
-            MCP_SESSION_ID_HEADER: session_id,
-        },
-        json={"jsonrpc": "2.0", "method": "tools/list", "id": "test-1"},
-    )
-    assert response.status_code == 400
-    assert (
-        MCP_PROTOCOL_VERSION_HEADER in response.text
-        or "protocol version" in response.text.lower()
-    )
-
     # Test request with invalid protocol version (should fail)
     response = requests.post(
         f"{basic_server_url}/mcp",
@@ -1516,3 +1500,34 @@ def test_server_validates_protocol_version_header(basic_server, basic_server_url
         json={"jsonrpc": "2.0", "method": "tools/list", "id": "test-4"},
     )
     assert response.status_code == 200
+
+
+def test_server_backwards_compatibility_no_protocol_version(
+    basic_server, basic_server_url
+):
+    """Test server accepts requests without protocol version header."""
+    # First initialize a session to get a valid session ID
+    init_response = requests.post(
+        f"{basic_server_url}/mcp",
+        headers={
+            "Accept": "application/json, text/event-stream",
+            "Content-Type": "application/json",
+        },
+        json=INIT_REQUEST,
+    )
+    assert init_response.status_code == 200
+    session_id = init_response.headers.get(MCP_SESSION_ID_HEADER)
+
+    # Test request without MCP-Protocol-Version header (backwards compatibility)
+    response = requests.post(
+        f"{basic_server_url}/mcp",
+        headers={
+            "Accept": "application/json, text/event-stream",
+            "Content-Type": "application/json",
+            MCP_SESSION_ID_HEADER: session_id,
+        },
+        json={"jsonrpc": "2.0", "method": "tools/list", "id": "test-backwards-compat"},
+        stream=True,
+    )
+    assert response.status_code == 200  # Should succeed for backwards compatibility
+    assert response.headers.get("Content-Type") == "text/event-stream"