ProtocolVersionMiddleware implements MiddlewareInterface
Validates the `MCP-Protocol-Version` header against the SDK's supported set.
Per the MCP Streamable HTTP spec, after the initialize handshake clients
must echo the negotiated protocol version on every subsequent request via
the MCP-Protocol-Version header. Servers MUST reject unknown or malformed
values with 400 Bad Request.
When the header is absent the middleware passes the request through —
the initialize round-trip does not carry the header, and legacy clients
that omit it are tolerated.
Validation is against a fixed set, not against the version a particular session negotiated: PSR-15 middleware runs before the transport resolves the session.
Tags
Table of Contents
Interfaces
- MiddlewareInterface
Properties
- $responseFactory : ResponseFactoryInterface
- $streamFactory : StreamFactoryInterface
- $supported : array<int, ProtocolVersion>
- $supportedVersions : array<int, string>
Methods
- __construct() : mixed
- process() : ResponseInterface
Properties
$responseFactory
private
ResponseFactoryInterface
$responseFactory
$streamFactory
private
StreamFactoryInterface
$streamFactory
$supported read-only
private
array<int, ProtocolVersion>
$supported
$supportedVersions read-only
private
array<int, string>
$supportedVersions
Methods
__construct()
public
__construct([array<int, ProtocolVersion>|null $supportedVersions = null ][, ResponseFactoryInterface|null $responseFactory = null ][, StreamFactoryInterface|null $streamFactory = null ]) : mixed
Parameters
- $supportedVersions : array<int, ProtocolVersion>|null = null
-
Versions the server accepts. Defaults to ProtocolVersion::handshakeVersions(). StreamableHttpTransport::handshakeMiddleware() always uses that default: it runs only on traffic already classified as handshake-era, so this middleware never needs to know about modern revisions there.
- $responseFactory : ResponseFactoryInterface|null = null
-
PSR-17 response factory (auto-discovered if null)
- $streamFactory : StreamFactoryInterface|null = null
-
PSR-17 stream factory (auto-discovered if null)
process()
public
process(ServerRequestInterface $request, RequestHandlerInterface $handler) : ResponseInterface
Parameters
- $request : ServerRequestInterface
- $handler : RequestHandlerInterface