JSON-RPC 2.0 message format is correct
Why it matters
JSON-RPC 2.0 is the wire protocol underpinning every MCP interaction. A response missing "jsonrpc": "2.0" will be rejected by any compliant client. Responses that don't echo the request id leave the client unable to correlate responses to outstanding requests — causing hangs or misrouted results. Non-standard error formats ({'error': 'message'} instead of {'error': {'code': -32601, 'message': '...'}}) break client error handling. These are CWE-116 (improper encoding) failures that make the server non-interoperable.
Severity rationale
Critical because a malformed JSON-RPC envelope breaks the entire protocol layer — clients reject non-conformant responses and the server becomes non-functional regardless of tool correctness.
Remediation
Use the official MCP SDK transport, which handles JSON-RPC 2.0 formatting automatically. For custom implementations, every response must match this structure exactly.
// src/transport/handler.ts — JSON-RPC 2.0 response
const response = {
jsonrpc: '2.0', // required, must be the string '2.0'
id: request.id, // must match the incoming request id exactly
result: { /* ... */ }
}
// Error responses
const error = {
jsonrpc: '2.0',
id: request.id,
error: {
code: -32601, // integer, from standard codes
message: 'Method not found', // human-readable string
}
}
Never construct raw JSON and write it to stdout — use StdioServerTransport from the SDK.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the MCP Server Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-116 — Improper Encoding or Escaping of Output
- external · jsonrpc-2.0-spec — JSON-RPC 2.0 Specification
- external · mcp-spec-transport — MCP Specification — Transport and JSON-RPC message format
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mcp-server·automated