fix(server): allow application/json-only Accept in JSON response mode (closes #1944)

`StreamableHTTPServerTransport` rejected `Accept: application/json`
with 406 even when the transport was built with `enableJsonResponse: true`
(i.e. pure request/response, no SSE). Branch the Accept check on
`_enableJsonResponse`: in JSON-only mode, require `application/json`;
in streaming mode, continue to require both `application/json` and
`text/event-stream` (on-wire spec remains unchanged for that path).

GET (SSE subscription) is unaffected.

Two regression tests added in the JSON Response Mode suite:
1. POST with `Accept: application/json` is now 200.
2. POST with an incompatible Accept (e.g. `text/plain`) is still 406.

Closes #1944.

Author: Aditya-Chilka

packages/server/src/server/streamableHttp.ts

@@ -617,10 +617,21 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
      */
     private async handlePostRequest(req: Request, options?: HandleRequestOptions): Promise<Response> {
         try {
-            // Validate the Accept header
+            // Validate the Accept header.
+            //
+            // When the transport is in pure request/response mode (\`enableJsonResponse: true\`)
+            // we never open an SSE stream, so we only require \`application/json\`. In streaming
+            // mode the spec requires the client to accept both content types so the server can
+            // upgrade to SSE.
             const acceptHeader = req.headers.get('accept');
-            // The client MUST include an Accept header, listing both application/json and text/event-stream as supported content types.
-            if (!acceptHeader?.includes('application/json') || !acceptHeader.includes('text/event-stream')) {
+            const acceptsJson = acceptHeader?.includes('application/json') ?? false;
+            const acceptsEventStream = acceptHeader?.includes('text/event-stream') ?? false;
+            if (this._enableJsonResponse) {
+                if (!acceptsJson) {
+                    this.onerror?.(new Error('Not Acceptable: Client must accept application/json'));
+                    return this.createJsonErrorResponse(406, -32_000, 'Not Acceptable: Client must accept application/json');
+                }
+            } else if (!acceptsJson || !acceptsEventStream) {
                 this.onerror?.(new Error('Not Acceptable: Client must accept both application/json and text/event-stream'));
                 return this.createJsonErrorResponse(
                     406,

packages/server/test/server/streamableHttp.test.ts

@@ -559,6 +559,30 @@ describe('Zod v4', () => {
                 id: 'call-1'
             });
         });
+
+        it('should accept application/json-only Accept header in JSON response mode (regression for #1944)', async () => {
+            // The strict Accept check used to require text/event-stream even when
+            // enableJsonResponse: true (i.e. the transport will never open an SSE stream).
+            // After the fix, application/json alone is sufficient.
+            sessionId = await initializeServer();
+            const request = createRequest('POST', TEST_MESSAGES.toolsList, {
+                sessionId,
+                accept: 'application/json'
+            });
+            const response = await transport.handleRequest(request);
+            expect(response.status).toBe(200);
+            expect(response.headers.get('content-type')).toBe('application/json');
+        });
+
+        it('should still reject Accept that does not include application/json (JSON response mode)', async () => {
+            sessionId = await initializeServer();
+            const request = createRequest('POST', TEST_MESSAGES.toolsList, {
+                sessionId,
+                accept: 'text/plain'
+            });
+            const response = await transport.handleRequest(request);
+            expect(response.status).toBe(406);
+        });
     });
 
     describe('HTTPServerTransport - Session Callbacks', () => {