fix(server): read request bodies where Request.body is not implemented

[littleKitchen]

Fixes #3025

Problem

Firefox does not implement Request.body (it is undefined), so readRequestBody throws on request.body.getReader().
Every POST to a browser-hosted server is then answered 400 with a JSON-RPC parse error: createMcpHandler answers Parse error: the request body could not be read, and WebStandardStreamableHTTPServerTransport answers Parse error: Invalid JSON.
Before #2698 these paths read the body with request.text() and req.json(), which work in Firefox.

Change

When request.body is undefined, read the body with arrayBuffer() and compare its byte length with maxBytes, so an oversized body still gets 413.
With no stream there is nothing to stop early, so in this fallback the limit is checked after the body is read; the Content-Length pre-check still runs first.
Runtimes that expose the stream keep the streaming reader unchanged. No new API.

One test in createMcpHandler.test.ts hides Request.body the way Firefox does, then checks that a modern tools/call is served (200) and that an oversized body gets 413. Includes a patch changeset for @modelcontextprotocol/server.

Validation

• The new test fails on unchanged main (400) and passes with the fix.
• pnpm build:all, pnpm typecheck:all and pnpm lint:all pass.
• pnpm test:all passes in every package except test/e2e, where protocol:timeout:max-total [sse …] fails intermittently on my machine (expected 0 to be greater than or equal to 3 on the tick count). It fails the same way on unchanged main: 3 runs each with and without this change, 1–2 failures per run.
• Not tried in a real Firefox; the test simulates the missing property.

AI disclosure: this PR was written primarily by Claude Code (the fix, the test, the changeset and this description), under my direction.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 49cb43e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3028

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3028

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3028

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3028

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3028

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3028

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3028

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3028

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3028

commit: 49cb43e

[koriyoshi2041]

Reviewed exact head 49cb43e. The fallback keeps the limit byte-based: an exact 4-byte body is accepted, 5 bytes is rejected, and a 4-byte multibyte UTF-8 body decodes intact when Request.body is unavailable. A consumed fallback request still rejects on a second read, matching normal Fetch body semantics.

I also ran the server package suite (578/578), server typecheck, Prettier on the changed files, and git diff --check; all passed. The Firefox fallback looks sound to me.

[0xamlab]

Verified the fix locally: reverting packages/server/src/server/requestBody.ts:46-48 makes the new Firefox-missing-body test fail with AssertionError: expected 400 to be 200 at createMcpHandler.test.ts:632. With the patch in place, pnpm --filter @modelcontextprotocol/server test passes all 578 server tests. The fallback at line 46 reads the body via request.arrayBuffer() when Request.body is undefined, so browsers like Firefox no longer hit the parse-error path while the 4 MiB limit is still enforced after the read.