feat: speak MCP 2026-07-28 without breaking older peers - #105

src/auth/store.rs:130

• AuthStore::set_client can persist an issuer-keyed registration while leaving version at 0 if the store was constructed via AuthStore::default() (or otherwise not passed through migrate). On the next load_auth_store(), migrate will treat it as v0 and move clients into legacy_clients, effectively demoting issuer-keyed registrations. Setting version here makes the invariant self-contained and prevents accidental re-demotion.

    pub fn set_client(&mut self, issuer: &str, server_key: &str, reg: ClientRegistration) {
        self.legacy_clients.remove(server_key);
        self.clients.insert(issuer_key(issuer), reg);
    }

src/serve/http.rs:129

• check_routing_headers treats a present-but-non-UTF8 routing header as if it were absent (to_str().ok()), which contradicts the comment above about rejecting invalid header characters. This can let a gateway-route/meter claim go unvalidated in the one case where the header is malformed. Consider explicitly rejecting any present routing header whose value fails to_str().

fn check_routing_headers(headers: &HeaderMap, req: &JsonRpcRequest) -> Option<String> {
    let header = |name: &str| headers.get(name).and_then(|v| v.to_str().ok());

src/serve/http.rs:207

• check_protocol_version_header currently ignores an MCP-Protocol-Version header whose value can’t be decoded via HeaderValue::to_str() (it becomes None and the header is treated as absent). That makes malformed header bytes silently bypass the unsupported-version check and can lead to confusing legacy-vs-stateless behavior selection. It’s safer to treat a present-but-invalid header value as a -32020 HeaderMismatch (400).

    let declared = headers
        .get(crate::protocol::HEADER_MCP_PROTOCOL_VERSION)
        .and_then(|v| v.to_str().ok())?;
    if crate::protocol::is_version_supported(declared) {

src/serve/http.rs:126

• check_routing_headers treats a routing header whose value contains non-ASCII/invalid bytes as if the header were absent because it uses to_str().ok(). That means a malformed Mcp-Method / Mcp-Name can bypass mismatch validation entirely, even though the spec calls out invalid header characters as a rejectable condition. Consider treating non-decodable header values as an immediate mismatch instead of silently ignoring them.

This issue also appears on line 204 of the same file.

fn check_routing_headers(headers: &HeaderMap, req: &JsonRpcRequest) -> Option<String> {
    let header = |name: &str| headers.get(name).and_then(|v| v.to_str().ok());