From 400c96c3a37f1a51760e28c3a75cd8213cad9d7f Mon Sep 17 00:00:00 2001
From: kuangmi-bit <kuangmi@deeparchi.com.cn>
Date: Fri, 3 Jul 2026 08:36:32 +0800
Subject: [PATCH] fix(mcp): guard nil initializeParams on new-protocol
 notifications
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a JSON-RPC notification (id: null) carries new-protocol _meta
(protocolVersion >= 2026-07-28), validateRequestMeta returns
usesNewProtocol=true with initializeParams=nil — notifications
do not carry client identity per SEP-2575.

The per-request protocol version check at server.go:1816 then
dereferenced initializeParams without a nil guard, causing a panic.

Fix: add validatedMeta.initializeParams != nil guard before accessing
.ProtocolVersion. Notifications skip the version check entirely
(same guard pattern already used at line 1846 for init state).

Adds regression test: notification with new-protocol _meta must not
panic and must return without error.

Fixes #1043
Fixes #1046
---
 mcp/server.go      |  1 +
 mcp/server_test.go | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/mcp/server.go b/mcp/server.go
index 21b5a722..0ec4d616 100644
--- a/mcp/server.go
+++ b/mcp/server.go
@@ -1813,6 +1813,7 @@ func (ss *ServerSession) handle(ctx context.Context, req *jsonrpc.Request) (any,
 	}
 
 	if validatedMeta.usesNewProtocol &&
+		validatedMeta.initializeParams != nil &&
 		!slices.Contains(supportedProtocolVersions, validatedMeta.initializeParams.ProtocolVersion) {
 		data, _ := json.Marshal(UnsupportedProtocolVersionData{
 			Supported: supportedProtocolVersions,
diff --git a/mcp/server_test.go b/mcp/server_test.go
index fc9db1f5..bfc666ad 100644
--- a/mcp/server_test.go
+++ b/mcp/server_test.go
@@ -1451,3 +1451,27 @@ func TestServerSessionHandle_RejectsRemovedMethodsOnNewProtocol(t *testing.T) {
 		})
 	}
 }
+
+// TestServerSessionHandle_NewProtocolNotificationWithoutParams verifies that
+// a notification carrying new-protocol _meta (id: null) does not panic when
+// the server dereferences initializeParams, which is nil for notifications.
+// Fixes https://github.com/modelcontextprotocol/go-sdk/issues/1043 and #1046.
+func TestServerSessionHandle_NewProtocolNotificationWithoutParams(t *testing.T) {
+	ss := &ServerSession{server: NewServer(testImpl, nil)}
+	req := &jsonrpc.Request{
+		Method: notificationCancelled,
+		Params: mustMarshal(map[string]any{
+			"_meta": map[string]any{
+				MetaKeyProtocolVersion: protocolVersion20260728,
+			},
+			"requestId": "r1",
+		}),
+	}
+	// A notification with new-protocol _meta must not panic.
+	// The expected behavior is that it returns without error
+	// (notifications are fire-and-forget).
+	_, err := ss.handle(context.Background(), req)
+	if err != nil {
+		t.Fatalf("notification with new-protocol _meta: unexpected error: %v", err)
+	}
+}