A server receives a tools/call request over Streamable HTTP whose _meta contains io.modelcontextprotocol/protocolVersion but no io.modelcontextprotocol/clientCapabilities field. How must the server handle the request?
Select an answer to reveal the explanation.
Short Explanation
Showing up to the airport without your boarding pass isn't the same as having an empty one. A missing required field makes the request malformed: -32602 and a 400. The trap is quietly assuming "no field" means "no capabilities."
Full Explanation
Revision 2026-07-28 is stateless, so every client request carries per-request protocol fields in _meta. Two are required: io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities; clientInfo is recommended but optional. A request missing any required field is malformed, and the server must reject it with JSON-RPC error -32602, Invalid params, with HTTP status 400 Bad Request on the HTTP transport. Treating the absent field as an empty object would hide a client bug and blur the difference between declaring nothing and declaring nothing at all; an explicit empty object is valid, a missing field is not. MissingRequiredClientCapability, -32021, applies when the field is present but lacks a capability the specific request needs, and its data lists the missing capabilities, not everything the server supports. Reusing earlier capabilities relies on connection state, which the protocol removed; each request must be understandable on its own, which is what allows any server instance behind a load balancer to process it. Exam caveat: the same rule applies to a missing protocolVersion field. Operational check: send a request with clientCapabilities removed from _meta and confirm a 400 response carrying error code -32602 rather than a successful tool result.