Problem
The mock at src/scenarios/client/json-schema-ref-deref.ts presents an inconsistent protocol-version surface:
- Its hand-rolled
server/discover handler advertises supportedVersions: [DRAFT_PROTOCOL_VERSION] ("2026-07-28") — line 126.
- Every other JSON-RPC method is delegated to
StreamableHTTPServerTransport from the pinned @modelcontextprotocol/sdk@^1.29.0 — line 140. That SDK version tops out at 2025-11-25 and rejects 2026-07-28 at the HTTP layer.
A client that follows SEP-2575 (probe server/discover first, honor the negotiated version on subsequent requests) negotiates to 2026-07-28, then gets HTTP 400 Bad Request on tools/list. The check sep-2106-no-network-ref-deref never runs because the client never sees the tool schema.
Root cause
@modelcontextprotocol/sdk@1.29.0 (the latest published npm release, 2026-03-30) predates 2026-07-28. Its SUPPORTED_PROTOCOL_VERSIONS is ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05', '2024-10-07']. The scenario worked around the missing server/discover handler by hand-rolling it (same pattern as #347), but did not extend the workaround to the version whitelist that the pinned transport enforces on every other method.
Problem
The mock at
src/scenarios/client/json-schema-ref-deref.tspresents an inconsistent protocol-version surface:server/discoverhandler advertisessupportedVersions: [DRAFT_PROTOCOL_VERSION]("2026-07-28") — line 126.StreamableHTTPServerTransportfrom the pinned@modelcontextprotocol/sdk@^1.29.0— line 140. That SDK version tops out at2025-11-25and rejects2026-07-28at the HTTP layer.A client that follows SEP-2575 (probe
server/discoverfirst, honor the negotiated version on subsequent requests) negotiates to2026-07-28, then getsHTTP 400 Bad Requestontools/list. The checksep-2106-no-network-ref-derefnever runs because the client never sees the tool schema.Root cause
@modelcontextprotocol/sdk@1.29.0(the latest published npm release, 2026-03-30) predates2026-07-28. ItsSUPPORTED_PROTOCOL_VERSIONSis['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05', '2024-10-07']. The scenario worked around the missingserver/discoverhandler by hand-rolling it (same pattern as #347), but did not extend the workaround to the version whitelist that the pinned transport enforces on every other method.