fix(server): parse Accept media types exactly

[SnowSky1]

Fixes #2480.

Summary

Streamable HTTP server Accept validation used raw substring checks, so values such as application/jsonx and text/event-stream-bogus incorrectly satisfied the required concrete media types. This affected both POST negotiation and GET SSE requests.

This change:

• adds an internal listsMediaType helper that parses the comma-separated Accept list and compares media-type essences case-insensitively;
• handles parameters and quoted parameter values without splitting on commas inside quoted strings;
• updates GET and POST Streamable HTTP validation to use exact media-type matching;
• adds regression coverage for substring false positives, valid case/parameter variants, quoted commas, wildcards, and missing headers;
• includes a patch changeset for the server and core-internal packages.

This follows the same parsed-media-type approach recently applied to Content-Type in #2441 / #2444, while keeping Accept-specific list parsing internal.

Testing

• pnpm --filter @modelcontextprotocol/core-internal test -- test/shared/mediaType.test.ts — 11 passing
• pnpm --filter @modelcontextprotocol/server test -- test/server/streamableHttp.test.ts — 50 passing
• pnpm --filter @modelcontextprotocol/core-internal check — clean
• pnpm --filter @modelcontextprotocol/server check — clean
• pre-push hook: full workspace typecheck, lint, and build — clean

[changeset-bot]

🦋 Changeset detected

Latest commit: e3715bc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/core-internal	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2481

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2481

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2481

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2481

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2481

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2481

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2481

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2481

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2481

commit: e3715bc

[SnowSky1]

Rebased onto current main. Revalidated the touched packages: core-internal media-type tests 11/11 pass, server streamable HTTP tests 55/55 pass, and both package typechecks are clean. The repository pre-push hook also completed the full workspace build, lint, and typecheck successfully. CI is rerunning now.

[SnowSky1]

@felixweinberger, when you have a chance, could you review this? It complements #2441 by applying exact media-type parsing to Accept; the branch is rebased onto current main, mergeable, and all CI checks are green.