[mcp] fix: reject bad-version notifications

[Wangmerlyn]

Summary

• reject explicit non-2.0 JSON-RPC versions before id-less notification silence
• return -32600 Invalid Request with id: null for bad-version notifications across direct handling, stdio, and HTTP /rpc
• update MCP/agent contract docs while preserving valid/omitted-version notification silence and legacy omitted-version direct calls

Verification

• RED: PYTHONPATH=src pytest tests/mcp/test_server.py::test_mcp_initialized_notification_with_bad_version_is_invalid_request tests/mcp/test_http_api.py::test_http_rpc_bad_version_notification_returns_invalid_request_envelope -q failed with direct None and HTTP 202
• RED: PYTHONPATH=src pytest tests/mcp/test_server.py::test_mcp_stdio_bad_version_notification_is_invalid_request_error -q failed with zero stdout lines under the old handler order
• GREEN: PYTHONPATH=src pytest tests/mcp/test_server.py::test_mcp_initialized_notification_with_bad_version_is_invalid_request tests/mcp/test_server.py::test_mcp_stdio_bad_version_notification_is_invalid_request_error tests/mcp/test_http_api.py::test_http_rpc_bad_version_notification_returns_invalid_request_envelope -q -> 3 passed
• PYTHONPATH=src pytest tests/mcp/test_server.py tests/mcp/test_http_api.py -q -> 300 passed
• PYTHONPATH=src pytest tests -q -> 1016 passed, 11 skipped
• mkdocs build --strict -> passed with known Material for MkDocs warning
• pre-commit run --all-files --show-diff-on-failure -> passed
• PYTHONPATH=src pytest tests/test_package_metadata.py -q -> 13 passed

Local Review

• local subagent review found no Critical, Important, or Minor issues
• reviewer also ran a focused compatibility set -> 5 passed

Summary by CodeRabbit

• Bug Fixes

  • Requests that include a jsonrpc version other than "2.0" now return a clear Invalid Request error instead of being silently ignored.
  • Id-less notification-style messages with an explicit invalid version now produce a JSON-RPC error response with id: null.

• Documentation

  • Clarified JSON-RPC and MCP guidance to better describe when notifications remain silent and when errors are returned.

• Tests

  • Added coverage for invalid-version notification handling over both HTTP and stdio.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f30a49de-64b3-4d14-935c-f46ef495fe7c

📥 Commits

Reviewing files that changed from the base of the PR and between 972ca5d and 0479c32.

📒 Files selected for processing (7)

• AGENTS.md
• docs/guides/mcp.md
• docs/plans/jsonrpc-invalid-id-null.md
• docs/plans/jsonrpc-request-version-validation.md
• src/keep_gpu/mcp/server.py
• tests/mcp/test_http_api.py
• tests/mcp/test_server.py

---

📝 Walkthrough

Walkthrough

The change reorders JSON-RPC request validation in _handle_request so that the jsonrpc version is checked immediately after confirming the method is present, before the notification no-response short-circuit. Id-less notifications/* messages with an invalid version now return a -32600 Invalid Request error instead of no response. Documentation and tests are updated accordingly.

Changes

JSON-RPC Version Validation Ordering

Layer / File(s)	Summary
Handler validation order src/keep_gpu/mcp/server.py	_handle_request now validates jsonrpc == "2.0" right after the method check and before the notification short-circuit, so invalid versions on id-less notifications produce an error instead of silence.
Test coverage tests/mcp/test_server.py, tests/mcp/test_http_api.py	Existing and new tests assert that notifications/initialized with jsonrpc: "1.0" returns an invalid-request envelope (id: null, code -32600) across in-process, HTTP, and stdio subprocess paths.
Docs and plans AGENTS.md, docs/guides/mcp.md, docs/plans/jsonrpc-invalid-id-null.md, docs/plans/jsonrpc-request-version-validation.md	Guidance and implementation plans reworded to specify that invalid jsonrpc versions return -32600 before notification-silence logic applies, including id-less notification cases, while valid/omitted-version id-less notifications remain silent.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Wangmerlyn/KeepGPU#86: Both PRs modify the _handle_request logic around how notifications/* messages are treated and whether a response envelope is emitted.
• Wangmerlyn/KeepGPU#120: Both PRs change _handle_request to enforce jsonrpc == "2.0" for explicitly versioned requests, returning -32600 Invalid Request, with matching doc/test updates.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: rejecting MCP notifications with invalid JSON-RPC versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/mcp-notification-version

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}