Fix: a JSON-only Accept is answered without SSE framing

Web-audit fix skill for the mcp-accept-json check (MCP, SHOULD).

Goal

Serve a single application/json response to a client whose Accept names only application/json.

Fix

Read the request Accept header and answer within it. Streamable HTTP lets the server reply either with one application/json body or with a text/event-stream, and the choice is the client's to constrain: a caller that sends Accept: application/json alone is telling you its HTTP client cannot read a stream. Answering that caller with text/event-stream returns a 200 over a body it cannot parse, and no status code tells it what went wrong. Parse the header with q-value semantics rather than a substring match, buffer the response, and emit Content-Type: application/json. Reserve the stream for callers that accept it. If your server genuinely cannot produce a single JSON body, refuse with 406 Not Acceptable instead: that at least fails the caller immediately and in the open.

Resources

Copy-paste prompt

Paste this into your coding agent. Your audit adds what it observed for this check:

Verify

Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the mcp-accept-json check should report pass.