requestId 0 is silently dropped by _oncancel, making the first request from every Protocol uncancellable

[feldmannn]

Problem

packages/core/src/shared/protocol.ts:411-414:

private async _oncancel(notification: CancelledNotification): Promise<void> {
    if (!notification.params.requestId) {
        return;
    }
    const controller = this._requestHandlerAbortControllers.get(notification.params.requestId);
    controller?.abort(notification.params.reason);
}

The if (!notification.params.requestId) check is falsy on 0. Combined with:

• _requestMessageId = 0 (line 313)
• const messageId = this._requestMessageId++ (line 868, post-increment)

The first outbound request from every Client or Server instance gets wire id 0. A peer notifications/cancelled { requestId: 0 } is silently dropped. The handler runs to completion with ctx.mcpReq.signal.aborted === false.

Both Client and Server extend Protocol, so the bug applies in both directions (peer-cancelling the client's first request, or peer-cancelling the server's first peer-initiated request).

Reproducer

Requires a build from main or the next alpha (InMemoryTransport is not in the 2.0.0-alpha.2 publish; see #1834). The reproducer drives raw JSON-RPC messages so it can pin the wire id to 0:

import { Server, InMemoryTransport } from '@modelcontextprotocol/server';

const [a, b] = InMemoryTransport.createLinkedPair();
const server = new Server({ name: 's', version: '1' }, { capabilities: { tools: {} } });

let observed;
server.setRequestHandler('tools/call', async (req, ctx) => {
    await new Promise(resolve => {
        ctx.mcpReq.signal.addEventListener('abort', () => {
            observed = true;
            resolve();
        }, { once: true });
        setTimeout(() => {
            observed = ctx.mcpReq.signal.aborted;
            resolve();
        }, 500);
    });
    return { content: [{ type: 'text', text: 'done' }] };
});

await server.connect(a);
b.onmessage = () => {};

await b.send({ jsonrpc: '2.0', id: 0, method: 'tools/call', params: { name: 'foo', arguments: {} } });
await new Promise(r => setTimeout(r, 50));
await b.send({ jsonrpc: '2.0', method: 'notifications/cancelled', params: { requestId: 0 } });
await new Promise(r => setTimeout(r, 600));

console.log('observed:', observed); // false (BUG: should be true)

The same script with id: 1 (a non-zero id) cancels in under 50ms.

Proposed fix

if (notification.params.requestId === undefined) {
    return;
}

JSON-RPC permits string ids too, so a defense-in-depth version is === undefined || requestId === null.

[jshaofa-ui]

Root Cause

Classic JavaScript truthy-check bug in packages/core/src/shared/protocol.ts:411-414:

if (!notification.params.requestId) {  // ← BUG: falsy on 0
    return;
}

Combined with _requestMessageId = 0 (initial value) and post-increment, the first outbound request from every Protocol instance gets wire ID 0. A peer's cancel notification for requestId 0 is silently swallowed — making the first request from every client/server permanently uncancellable.

Proposed Fix

private async _oncancel(notification: CancelledNotification): Promise<void> {
    const requestId = notification.params.requestId;
    if (requestId === undefined || requestId === null) {
        return;
    }
    const controller = this._requestHandlerAbortControllers.get(requestId);
    controller?.abort(notification.params.reason);
}

Impact

• First request from every client/server is uncancellable
• Resource leaks when server handlers hang (can never be aborted)
• Compounds with connection pooling (each new connection = new Protocol = new requestId 0 that's uncancellable)

Files to Modify

1. packages/core/src/shared/protocol.ts — _oncancel method (line ~411)

Test Case

it('should handle cancel notification with requestId 0', async () => {
    const controller = new AbortController();
    protocol._requestHandlerAbortControllers.set(0, controller);
    await protocol._oncancel({
        jsonrpc: '2.0', method: 'notifications/cancelled',
        params: { requestId: 0, reason: 'test' }
    });
    expect(controller.signal.aborted).toBe(true);
});

Full solution: solutions/mcp-typescript-sdk-2115-requestid-zero-dropped-fix.md

[serejaris]

I can take a focused look at this if maintainers agree this is a good small bugfix target.

The regression shape I would use:

• create or expose a Protocol test fixture with an in-flight request controller stored under request id 0;
• send a notifications/cancelled notification with params.requestId = 0;
• assert the matching controller is aborted with the provided reason;
• keep a sibling assertion for missing/null requestId so malformed cancel notifications are still ignored.

The intended patch should stay narrow: _oncancel should ignore only missing request ids (undefined / null), not every falsy id, because 0 is a valid JSON-RPC request id.

I will wait for maintainer direction/assignment before opening a PR to avoid duplicate work.

[mcp-claude]

reproduced on main (3834921) — the !notification.params.requestId check in _oncancel (packages/core-internal/src/shared/protocol.ts:726, v1.x: src/shared/protocol.ts:551) treats requestId 0 as absent, and since _requestMessageId starts at 0 and post-increments, the first outbound request from every Protocol instance uses wire id 0 and is uncancellable. workaround: burn the first id with a throwaway request before anything you might want to cancel. fix is one line: replace the falsy check with an explicit === undefined || === null. also present on origin/v1.x and origin/v1.x-2026-07-28 — needs the same fix there.

repro.ts

import { Server, InMemoryTransport } from '@modelcontextprotocol/server';

async function run(id: number): Promise<{ id: number; observed: boolean | undefined; abortedAtTimeout: boolean }> {
    const [a, b] = InMemoryTransport.createLinkedPair();
    const server = new Server({ name: 's', version: '1' }, { capabilities: { tools: {} } });

    let observed: boolean | undefined;
    let abortedAtTimeout = false;
    let resolveHandler: () => void = () => {};
    const handlerDone = new Promise<void>(resolve => {
        resolveHandler = resolve;
    });

    server.setRequestHandler('tools/call', async (_req, ctx) => {
        await new Promise<void>(resolve => {
            const signal = ctx.mcpReq.signal;
            signal.addEventListener(
                'abort',
                () => {
                    observed = true;
                    resolve();
                },
                { once: true }
            );
            setTimeout(() => {
                abortedAtTimeout = signal.aborted;
                if (observed === undefined) observed = signal.aborted;
                resolve();
            }, 500);
        });
        resolveHandler();
        return { content: [{ type: 'text', text: 'done' }] };
    });

    await server.connect(a);
    b.onmessage = () => {};

    await b.send({
        jsonrpc: '2.0',
        id: 999,
        method: 'initialize',
        params: {
            protocolVersion: '2025-06-18',
            capabilities: {},
            clientInfo: { name: 'c', version: '1' }
        }
    });
    await new Promise(r => setTimeout(r, 20));

    await b.send({
        jsonrpc: '2.0',
        id,
        method: 'tools/call',
        params: { name: 'foo', arguments: {} }
    });
    await new Promise(r => setTimeout(r, 50));

    await b.send({
        jsonrpc: '2.0',
        method: 'notifications/cancelled',
        params: { requestId: id, reason: 'test' }
    });

    await Promise.race([handlerDone, new Promise(r => setTimeout(r, 700))]);
    return { id, observed, abortedAtTimeout };
}

(async () => {
    const r0 = await run(0);
    const r1 = await run(1);
    console.log('id=0 result:', r0);
    console.log('id=1 result:', r1);
})();

command + output

$ npx tsx repro.ts
id=0 result: { id: 0, observed: false, abortedAtTimeout: false }
id=1 result: { id: 1, observed: true, abortedAtTimeout: false }

id=0: the abort listener never fires within the 500ms handler window, and the setTimeout branch observes signal.aborted === false. id=1: the abort listener fires immediately after the cancel notification is delivered.

code path

• _requestMessageId = 0 at protocol.ts:559
• const messageId = this._requestMessageId++ at protocol.ts:1419 — first outbound wire id is 0
• _onrequest stores _requestHandlerAbortControllers.set(request.id, abortController) at protocol.ts:1042
• _oncancel at protocol.ts:725-728:

  if (!notification.params.requestId) {
      return;   // early-returns when requestId === 0
  }
  const controller = this._requestHandlerAbortControllers.get(notification.params.requestId);
  controller?.abort(notification.params.reason);

same broken check lives at src/shared/protocol.ts:551 on origin/v1.x and origin/v1.x-2026-07-28 — backport needed.

suggested fix

// packages/core-internal/src/shared/protocol.ts (main); src/shared/protocol.ts (v1.x branches)
     private async _oncancel(notification: CancelledNotification): Promise<void> {
-        if (!notification.params.requestId) {
+        const { requestId } = notification.params;
+        if (requestId === undefined || requestId === null) {
             return;
         }
         // Handle request cancellation
-        const controller = this._requestHandlerAbortControllers.get(notification.params.requestId);
+        const controller = this._requestHandlerAbortControllers.get(requestId);
         controller?.abort(notification.params.reason);
     }

test to verify: mirrors the existing notifications/cancelled behavior test but pins the inbound requestId to 0 and asserts ctx.mcpReq.signal.aborted === true after the cancel notification arrives. fails on the falsy check, passes with the explicit undefined/null guard.

full test suite on main after the fix: all packages green — codemod (623), core-internal (1347 incl. the new test), core (2), server-legacy (168), client (718), server (439), middleware/{express,fastify,hono,node} (42/22/14/99), examples/shared (2), test/integration (352 passed, 1 skipped). one preexisting unrelated failure in test/integration/test/server/cloudflareWorkers.test.ts (wrangler local worker readiness timeout — no cancel/requestId code in that file).