Skip to content

fix: reject duplicate initialize requests#962

Merged
guglielmo-san merged 3 commits into
modelcontextprotocol:mainfrom
he-yufeng:fix/reject-duplicate-initialize
May 25, 2026
Merged

fix: reject duplicate initialize requests#962
guglielmo-san merged 3 commits into
modelcontextprotocol:mainfrom
he-yufeng:fix/reject-duplicate-initialize

Conversation

@he-yufeng
Copy link
Copy Markdown
Contributor

Summary

  • reject a second initialize request on an already initialized server session
  • keep the original ServerSession.InitializeParams() instead of replacing it with later client parameters
  • add a raw JSON-RPC regression test for the duplicate-initialize path

Fixes #961.

To verify

  • go test ./mcp -run TestServerRejectsDuplicateInitialize -count=1
  • go test ./mcp -count=1
  • go test ./...

@he-yufeng he-yufeng force-pushed the fix/reject-duplicate-initialize branch from 603d55c to f62a410 Compare May 15, 2026 20:39
Comment thread mcp/server.go Outdated
@he-yufeng he-yufeng force-pushed the fix/reject-duplicate-initialize branch from f62a410 to 64d6f95 Compare May 18, 2026 17:59
@he-yufeng
Copy link
Copy Markdown
Contributor Author

he-yufeng commented May 18, 2026

Thanks, that makes sense. I pushed 64d6f95 to align the duplicate initialize request with the duplicate notifications/initialized handling by returning the duplicate-message error directly instead of wrapping it as ErrInvalidRequest.

Validation run locally:

  • go test ./mcp -run TestServerRejectsDuplicateInitialize -count=1
  • go test ./mcp -count=1
  • go test ./... -count=1
  • git diff --check origin/main..HEAD

guglielmo-san
guglielmo-san previously approved these changes May 20, 2026
Comment thread mcp/server.go Outdated
if params == nil {
return nil, fmt.Errorf("%w: \"params\" must be be provided", jsonrpc2.ErrInvalidParams)
}
var duplicate bool
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you also change the name of the variable to wasInit, to keep it consistent with the initialized() ?

@guglielmo-san
Copy link
Copy Markdown
Contributor

@he-yufeng can you address the last comment to close the PR?

@guglielmo-san guglielmo-san enabled auto-merge (squash) May 25, 2026 13:11
@guglielmo-san guglielmo-san merged commit bed83e1 into modelcontextprotocol:main May 25, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Duplicate initialize with changed parameters can overwrite stored session initialization parameters

3 participants