Skip to content

Server allows duplicate initialize on same session #1422

@gijswalraven

Description

@gijswalraven

Description

When using ModelContextProtocol.AspNetCore (v1.1.0), sending a second initialize request on the same session (with the same mcp-session-id) succeeds instead of being rejected.

MCP Spec Reference

Per the MCP spec (2025-11-25), section Lifecycle & Initialization:

initialize MUST be the first interaction between client and server.

And the initialization sequence diagram shows a single initializeinitialized handshake per session. A second initialize on an already-initialized session should be rejected (either via HTTP error status or JSON-RPC error response).

Reproduction

// 1. Initialize session
var initResponse = await client.PostAsync("/mcp", initializeRequest);
var sessionId = initResponse.Headers.GetValues("mcp-session-id").First();

// 2. Send notifications/initialized
await client.PostAsync("/mcp", initializedNotification); // with mcp-session-id header

// 3. Send second initialize on same session
var secondInit = new HttpRequestMessage(HttpMethod.Post, "/mcp")
{
    Content = initializeRequest
};
secondInit.Headers.Add("mcp-session-id", sessionId);

var response = await client.SendAsync(secondInit);
// response.StatusCode is 200 OK — should be an error

Expected Behavior

The server should reject the second initialize request with either:

  • An HTTP error status (e.g., 400 Bad Request), or
  • A JSON-RPC error response (e.g., -32600 Invalid Request)

Environment

  • ModelContextProtocol.AspNetCore v1.1.0
  • .NET 9.0
  • MCP spec revision: 2025-11-25

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions