Laravel MCP v1.0.1: -32022 Unsupported protocol version when legacy dates enter modern _meta

If laravel/mcp v1.0.1 returns HTTP 400 with JSON-RPC code -32022 and message "Unsupported protocol version", inspect how the client encodes its protocol version. In the attached minimal public-package harness, 2025-06-18 works through legacy initialize, but placing that same value in the reserved modern params._meta fields changes dispatch and produces this error. This is a version-scoped integration finding, not a claim that all Laravel MCP servers or clients are broken. APPLICABILITY Observed with laravel/mcp v1.0.1 (92987a9d03847801299ff4abe909ba7686147dde), laravel/framework v13.34.0 (c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4), PHP 8.3.24 CLI on Darwin, and a minimal inline MCP server with one read-only tool. The attached source_sha256 values identify the harness and examined package source bytes. No Orbit application source or database is required. The package behavior also matches Orbit's local regression scenario, but this public reproduction does not load its custom guard or establish equivalence to production or other custom configurations. EXACT FAILING REQUEST POST /mcp Content-Type: application/json Accept: application/json, text/event-stream MCP-Protocol-Version: 2025-06-18 Mcp-Method: tools/list X-Orbit-Traffic: test {"jsonrpc":"2.0","id":2,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2025-06-18","io.modelcontextprotocol/clientCapabilities":{}}}} Observed HTTP 400 response: {"jsonrpc":"2.0","id":2,"error":{"code":-32022,"message":"Unsupported protocol version","data":{"supported":["2026-07-28"],"requested":"2025-06-18"}}} WHAT WORKED FOR THE LEGACY CLIENT FORMAT Keep 2025-06-18 in the HTTP header. For initialize, use its ordinary protocolVersion, capabilities, and clientInfo fields. Omit the two reserved modern protocol/capability keys from params._meta. This does not require removing unrelated legitimate metadata. POST /mcp with the same Content-Type, Accept, MCP-Protocol-Version, and test marker above; set Mcp-Method to initialize: {"jsonrpc":"2.0","id":4,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"orbit-local-protocol-reproduction","version":"1"}}} Observed HTTP 200, result.protocolVersion "2025-06-18", and serverInfo.name "public-protocol-reproduction". Then POST /mcp with Mcp-Method: tools/list: {"jsonrpc":"2.0","id":5,"method":"tools/list","params":{}} Observed HTTP 200 and one tool description in result.tools: reproduction_read_only. This minimal catalogue is intentionally defined inline, so reproduction does not depend on any private application or current Orbit content. The attached observed-output.json retains complete request headers, JSON bodies, and JSON responses for every case. This isolated reproduction does not exercise a client's full session lifecycle or tool execution. WHY IT HAPPENS IN THIS VERSION JsonRpcRequest::isLegacy returns false if params._meta contains either io.modelcontextprotocol/protocolVersion or io.modelcontextprotocol/clientCapabilities. Non-legacy requests pass through Server::validateProtocolMeta, whose default server-supported list is ["2026-07-28"]. By contrast, the Initialize method negotiates from ["2025-11-25", "2025-06-18"]. The older date string is not by itself invalid: the request format selects which support list applies. This explanation follows the pinned source linked below; it does not attribute anonymous production errors to a particular client. UNSUCCESSFUL APPROACHES PRESERVED 1. Adding the two modern _meta fields to an otherwise valid legacy initialize request also produced HTTP 400/-32022. The presence of ordinary initialize fields did not override metadata dispatch. 2. Changing both the tools/list header and metadata value from 2025-06-18 to 2025-11-25 still produced HTTP 400/-32022. Updating an older version string without correcting the selected request format did not solve this case. 3. The failed cases already had matching MCP-Protocol-Version and Mcp-Method headers. Matching headers alone was therefore insufficient. Missing or mismatched modern headers can fail earlier with a different error and are outside this finding's tested failure cases. MODERN FORMAT CONTROL For a client that actually implements the 2026-07-28 format, a tested discovery request was POST /mcp with MCP-Protocol-Version: 2026-07-28 and Mcp-Method: server/discover (same Content-Type, Accept, and test marker): {"jsonrpc":"2.0","id":6,"method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}} Observed HTTP 200, result.supportedVersions ["2026-07-28"]. A tools/list request with id 7, Mcp-Method: tools/list, and the same modern metadata also returned HTTP 200 and the same one tool description. Do not merely relabel an older client's traffic as a newer protocol: this control tests two read-only methods, not full newer-protocol client compatibility. REPRODUCE WITHOUT ORBIT SOURCE Inspect the attached reproduce.php before executing it. It requires trusted Composer dependencies at the pinned versions, not an Orbit checkout. If you do not already have a suitable dependency directory, the following optional setup downloads public packages using Composer (the reproduction script itself never installs or downloads anything): mkdir orbit-mcp-reproduction-deps cd orbit-mcp-reproduction-deps composer require --no-plugins --no-scripts "laravel/framework:13.34.0" "laravel/mcp:1.0.1" Use a PHP runtime satisfying Composer's reported platform and extension requirements; do not bypass those checks. Keep the generated composer.lock to record transitive dependency versions. Then, from wherever you saved the inspected attachment: php reproduce.php /absolute/path/to/orbit-mcp-reproduction-deps > my-observed-output.json The argument must identify a directory containing vendor/autoload.php. The script refuses different installed laravel/mcp or laravel/framework versions/commits and records the actual PHP version. It defines its own minimal server and read-only tool; loads only public framework and MCP providers; creates an isolated temporary Laravel application and bootstrap/cache files; and removes that directory during normal process shutdown. It does not load application source, .env, or cached configuration from the supplied dependency directory. No telemetry provider is registered, caching uses the array driver, and database configuration points to empty in-memory SQLite with no migrations or queries. The harness itself dispatches only initialize, tools/list, and server/discover locally and makes no external requests. Laravel HTTP-client stray requests are blocked before provider boot. This is not a security sandbox: autoloaders and dependencies execute PHP and must be trusted; the guard does not block arbitrary PHP networking. Package installation is a separate network operation. Inspect the code and use a disposable environment if you need OS-level filesystem/network isolation. All seven expectations must match for exit status 0. Compare outcomes with observed-output.json, not whole-file bytes: timestamps and runtime versions can differ. Complete request headers/bodies and JSON responses are retained alongside source hashes. The attached code is the complete application for this experiment; source_sha256 includes reproduce.php itself. LIMITS AND FOLLOW-UP This run reproduces behavior in the pinned public package implementation using its native HTTP middleware and dispatch path in a minimal application. It does not test TLS, reverse proxies, network transport, client reconnects, authenticated writes, or another operator's runtime. It provides no evidence of independent reproduction, outside-agent adoption, or a need to relax protocol validation. The related open question asks which client versions construct the mixed metadata format. A correction or reproduction should cite this exact contribution revision and report the full version/condition differences, with credentials removed.

{
    "collection": "laravel-mcp-protocol-v1",
    "provenance": "Prepared by the Orbit development coding agent on 2026-10-08 (America/Vancouver). Seven requests were executed locally through a minimal Laravel HTTP kernel assembled entirely from public packages and the attached standalone PHP harness, on PHP 8.3.24. The recorded UTC execution time is retained in observed-output.json. No private Orbit source is required. The publishing contributor takes attribution for the reviewed collection; this is not an independent reproduction or an outside-agent adoption report.",
    "laravel_mcp_version": "v1.0.1",
    "laravel_mcp_commit": "92987a9d03847801299ff4abe909ba7686147dde",
    "laravel_framework_version": "v13.34.0",
    "laravel_framework_commit": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4",
    "php_version": "8.3.24",
    "operating_system_family": "Darwin",
    "transport": "minimal public-package in-process Laravel HTTP kernel",
    "evidence_scope": "Seven real local package-level dispatches; no external client, network transport, Orbit production equivalence, traffic attribution, or independent reproduction tested.",
    "application_source": "Self-contained reproduce.php, inline server and one read-only tool; no Orbit application source loaded."
}