Reject malformed per-request clientCapabilities with 400 InvalidParams

ValidateRequiredPerRequestMeta only null-checked _meta clientCapabilities, so a present-but-wrong-shape value passed the HTTP validation and later failed during deserialization as a generic -32603 internal error on a 200 response. Require it to be a JSON object so both missing and malformed values are rejected up front with -32602 and HTTP 400 as SEP-2575 requires.

Author: tarekgh

src/ModelContextProtocol.AspNetCore/StreamableHttpHandler.cs

@@ -709,9 +709,11 @@ internal static Task RunSessionAsync(HttpContext httpContext, McpServer session,
     /// <summary>
     /// Validates that a request riding a per-request-metadata protocol revision carries the required
     /// <c>_meta</c> fields beyond the protocol version (which <see cref="ValidateProtocolVersionEnvelope"/>
-    /// already checked): <c>io.modelcontextprotocol/clientCapabilities</c>. Performed at the HTTP layer
-    /// so the rejection can use 400 Bad Request as SEP-2575 requires. <c>clientInfo</c> is optional,
-    /// so its absence is not rejected.
+    /// already checked): <c>io.modelcontextprotocol/clientCapabilities</c>, which must be present and a
+    /// JSON object. Performed at the HTTP layer so the rejection can use 400 Bad Request as SEP-2575
+    /// requires; a malformed (non-object) value would otherwise fail later during deserialization as a
+    /// generic internal error on a 200 response. <c>clientInfo</c> is optional, so its absence is not
+    /// rejected.
     /// </summary>
     private static bool ValidateRequiredPerRequestMeta(
         HttpContext context,
@@ -723,12 +725,12 @@ private static bool ValidateRequiredPerRequestMeta(
             McpProtocolVersions.RequiresPerRequestMetadata(protocolVersionHeader) &&
             (requestParams is not JsonObject paramsObj ||
              paramsObj["_meta"] is not JsonObject metaObj ||
-             metaObj[MetaKeys.ClientCapabilities] is null))
+             metaObj[MetaKeys.ClientCapabilities] is not JsonObject))
         {
             errorDetail = new JsonRpcErrorDetail
             {
                 Code = (int)McpErrorCode.InvalidParams,
-                Message = $"Requests using protocol version '{protocolVersionHeader}' must include '_meta/{MetaKeys.ClientCapabilities}'.",
+                Message = $"Requests using protocol version '{protocolVersionHeader}' must include '_meta/{MetaKeys.ClientCapabilities}' as a JSON object.",
             };
             return false;
         }

tests/ModelContextProtocol.AspNetCore.Tests/RawHttpConformanceTests.cs

@@ -413,6 +413,56 @@ public async Task GetEndpoint_NotMapped_UnderDefaultStatelessConfiguration_Retur
         Assert.Equal(HttpStatusCode.MethodNotAllowed, response.StatusCode);
     }
 
+    [Fact]
+    public async Task July2026Post_MissingClientCapabilities_Returns400_WithInvalidParams()
+    {
+        await StartAsync();
+
+        var body =
+            @"{""jsonrpc"":""2.0"",""id"":20,""method"":""server/discover"",""params"":{""_meta"":{" +
+            @"""io.modelcontextprotocol/protocolVersion"":""" + McpProtocolVersions.July2026ProtocolVersion + @"""}}}";
+
+        using var request = new HttpRequestMessage(HttpMethod.Post, "") { Content = JsonContent(body) };
+        request.Headers.Add(ProtocolVersionHeader, McpProtocolVersions.July2026ProtocolVersion);
+        request.Headers.Add("Mcp-Method", "server/discover");
+        using var response = await HttpClient.SendAsync(request, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        var json = await ReadJsonResponseAsync(response, TestContext.Current.CancellationToken);
+        Assert.Equal(20, json["id"]!.GetValue<long>());
+        Assert.Equal((int)McpErrorCode.InvalidParams, json["error"]!["code"]!.GetValue<int>());
+        Assert.Contains(MetaKeys.ClientCapabilities, json["error"]!["message"]!.GetValue<string>(), StringComparison.Ordinal);
+    }
+
+    [Theory]
+    [InlineData("5")]
+    [InlineData("\"caps\"")]
+    [InlineData("[]")]
+    [InlineData("true")]
+    public async Task July2026Post_MalformedClientCapabilities_Returns400_WithInvalidParams(string clientCapabilitiesJson)
+    {
+        await StartAsync();
+
+        var body =
+            @"{""jsonrpc"":""2.0"",""id"":21,""method"":""server/discover"",""params"":{""_meta"":{" +
+            @"""io.modelcontextprotocol/protocolVersion"":""" + McpProtocolVersions.July2026ProtocolVersion + @"""," +
+            @"""io.modelcontextprotocol/clientInfo"":{""name"":""raw"",""version"":""1.0""}," +
+            @"""io.modelcontextprotocol/clientCapabilities"":" + clientCapabilitiesJson + "}}}";
+
+        using var request = new HttpRequestMessage(HttpMethod.Post, "") { Content = JsonContent(body) };
+        request.Headers.Add(ProtocolVersionHeader, McpProtocolVersions.July2026ProtocolVersion);
+        request.Headers.Add("Mcp-Method", "server/discover");
+        using var response = await HttpClient.SendAsync(request, TestContext.Current.CancellationToken);
+
+        // A present-but-wrong-shape clientCapabilities must be rejected up front with -32602 / 400,
+        // not surface later as a generic internal error on a 200 response.
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        var json = await ReadJsonResponseAsync(response, TestContext.Current.CancellationToken);
+        Assert.Equal(21, json["id"]!.GetValue<long>());
+        Assert.Equal((int)McpErrorCode.InvalidParams, json["error"]!["code"]!.GetValue<int>());
+        Assert.Contains(MetaKeys.ClientCapabilities, json["error"]!["message"]!.GetValue<string>(), StringComparison.Ordinal);
+    }
+
     [McpServerToolType]
     private sealed class CapabilityTools
     {