Skip to content

fix: handle optional/out-of-order query params in UriTemplate.match()#1920

Open
Christian-Sidak wants to merge 1 commit intomodelcontextprotocol:mainfrom
Christian-Sidak:fix/uri-template-optional-query-params
Open

fix: handle optional/out-of-order query params in UriTemplate.match()#1920
Christian-Sidak wants to merge 1 commit intomodelcontextprotocol:mainfrom
Christian-Sidak:fix/uri-template-optional-query-params

Conversation

@Christian-Sidak
Copy link
Copy Markdown
Contributor

Summary

Fixes #1079

  • UriTemplate.match() now treats {?param1,param2} query parameters as truly optional per RFC 6570 -- URIs match with no query params, a subset of params, or params in any order
  • Path variable patterns ({var}) no longer consume ? or # delimiters, so templates like {id}{?fields} correctly split at the query boundary
  • Adds 9 new tests covering the reported scenarios (no params, partial params, reordered params, unknown params, encoded values)

Root cause

partToRegExp() was generating a rigid regex for ?/& operators that required every declared query param in exact declaration order (e.g. \?q=([^&]+)&page=([^&]+)). This made all query params mandatory and order-dependent.

Fix

  1. partToRegExp() -- skip ?/& operators entirely (return empty patterns)
  2. Simple operator pattern -- exclude ? and # from the character class so path variables stop before the query string
  3. match() -- collect query param names from ?/& parts, append an optional (?:[?&][^#]*)? pattern to the regex, then parse actual query params from the URI in an order-independent pass after the regex match

Test plan

  • All 489 existing tests pass
  • 9 new tests added covering: no query params, subset of params, reordered params, all params present, single optional param, partial multi-param, unknown params ignored, encoded values, base path mismatch rejection

…ms per RFC 6570

Query parameter templates ({?param1,param2}) now correctly match URIs
where some or all query params are missing, and where params appear in
any order. Previously, all declared params had to be present in the
exact template-declared order.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@Christian-Sidak Christian-Sidak requested a review from a team as a code owner April 17, 2026 04:42
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 17, 2026

🦋 Changeset detected

Latest commit: 4202930

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@modelcontextprotocol/core Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Apr 17, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1920

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1920

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1920

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1920

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1920

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1920

commit: 4202930

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

# MCP SDK ResourceTemplate URI Validation Issue: RFC 6570 Template Matching Behavior

1 participant