Repository navigation
test: pin authenticated GET/DELETE on /mcp returning 405 #991
Description
Follow-up from the protocol-version docs audit: the sessionless /mcp serving posture means GET and DELETE return 405 after authentication (rmcp 3.1.2 tower.rs serves POST-only when legacy_session_mode = false with no event store), and the docs now state this — but no first-party test in this repo pins it. The guarantee currently rests on the vendored SDK's dispatch arm alone; an rmcp upgrade that starts serving GET (SSE streams) or DELETE (session teardown) by default would change the wire surface silently.
Add a small case to crates/aisix-mcp/tests/protocol_generations.rs (or the proxy suite for the authenticated path): authenticated GET /mcp and DELETE /mcp → 405, unauthenticated → 401 first.
🤖 Generated with Claude Code
Activity
coderabbitai commentedon Aug 19, 2026
🔗 Related PRs
#853 - feat(config): request_body_limit_bytes defaults to 0 = no cap; uniform 413 surface [merged]
#859 - feat(mcp): OAuth 2.1 resource-server discovery surface for /mcp [merged]
#980 - feat(mcp): upgrade rmcp 1.8.0 → 3.1.2 — serve MCP 2026-07-28, pin MRTR/cache/version defaults [merged]
#981 - feat(mcp): per-server protocol_version for modern-only (2026-07-28) upstreams + conformance CI gate [merged]
#990 - docs(readme): MCP gateway protocol-generation support in the feature list [open]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!