Handles notifications without sending a response
Why it matters
JSON-RPC 2.0 defines notifications as messages with no id — they require no response, and sending one violates the spec. A server that sends error responses to notifications/initialized (because it tries to echo the id that isn't there) causes clients to receive unexpected extra messages, which can desync the message stream. A server that crashes on an unknown notification type (notifications/cancelled, notifications/roots/list_changed) can be triggered by any client action that emits those events, making stability fragile in real workloads.
Severity rationale
Low because notification handling errors cause protocol drift and occasional crashes rather than data exposure, and most SDK-based servers get this right automatically.
Remediation
In custom message handlers, check for the absence of id to identify notifications and return without responding.
// src/transport/handler.ts
function handleMessage(message: unknown) {
// Notifications: no id field — process but do not respond
if (!('id' in (message as object))) {
const notification = message as { method: string }
if (notification.method === 'notifications/initialized') {
isInitialized = true
}
// Unknown notifications: silently ignore
return
}
// Requests: have an id — must respond
return handleRequest(message as JsonRpcRequest)
}
SDK-based servers handle this automatically — do not override the SDK's default notification handling.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the MCP Server Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · jsonrpc-2.0-notifications — JSON-RPC 2.0 Specification — Notification (no id, no response)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mcp-server·automated