[aphonpra-oai]

In a negotiated 2026-07-28 Streamable HTTP session, the client can remove a valid tool when its input schema has a property named x-mcp-header in dependentRequired.

dependentRequired maps property names to arrays of property names. Those values are not subschemas. The annotation walker currently recurses into the map and mistakes the property name for an off-chain header annotation, causing cache_tools_from_response to remove the tool from tools/list.

For example, this schema is valid:

{
  "type": "object",
  "properties": {
    "x-mcp-header": { "type": "string" },
    "tenant": { "type": "string", "x-mcp-header": "Tenant" }
  },
  "dependentRequired": { "x-mcp-header": ["tenant"] }
}

Exclude dependentRequired from annotation traversal, alongside existing non-schema keywords. Continue validating dependentSchemas, which does contain schemas. This preserves the valid tool without relaxing restrictions on actual header annotations.

Regression coverage checks:

• The valid dependency-name map passes annotation validation.
• The tool remains in both the returned tool list and the transport cache.
• An actual off-chain header annotation inside dependentSchemas remains rejected.

Reference: JSON Schema 2020-12, dependentRequired.

Local validation

Both new positive regressions fail on upstream main without the production change: annotation validation rejects the valid schema, and the transport drops the tool. With the change restored, all 57 header tests and all 4 tool-list/cache tests pass, including continued rejection of actual off-chain annotations.

Commands (one build job and one test thread; features client,transport-streamable-http-client,transport-streamable-http-server):

cargo test -p rmcp --lib --features client,transport-streamable-http-client,transport-streamable-http-server transport::common::mcp_headers -- --test-threads=1
cargo test -p rmcp --lib --features client,transport-streamable-http-client,transport-streamable-http-server cache_tools_ -- --test-threads=1

The full workspace suite was not run locally. This draft is for review of the narrow validator fix.

[github-actions]

@jamadeo is on triage rotation this week and is the reviewer for this one.

Labels come from the PR labeler. Please review the change.

_{Automated triage. Labels are a first pass and the assigned maintainer has the final say.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T23:04:26.473343Z	00f9202	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[aphonpra-oai]

Hey @DaleSeo

You reviewed our reconnect fix in #1363. While testing the Codex upgrade to 3.8.0, I found another issue where dependentRequired causes valid tools to get filtered out.

Could you take a look at #1428? It’s a small fix which stops the SDK from mistaking input names for header instructions and hiding valid tools. Tested discovery and successful tool calls locally through Codex.