# Fix: a JSON-only Accept is answered without SSE framing

> Web-audit fix skill for the `mcp-accept-json` check (MCP, SHOULD).

## Goal

Serve a single application/json response to a client whose Accept names only application/json.

## Fix

Read the request `Accept` header and answer within it. Streamable HTTP lets the server reply
either with one `application/json` body or with a `text/event-stream`, and the choice is the
client's to constrain: a caller that sends `Accept: application/json` alone is telling you its
HTTP client cannot read a stream. Answering that caller with `text/event-stream` returns a
`200` over a body it cannot parse, and no status code tells it what went wrong.
Parse the header with q-value semantics rather than a substring match, buffer the response,
and emit `Content-Type: application/json`. Reserve the stream for callers that accept it. If
your server genuinely cannot produce a single JSON body, refuse with `406 Not Acceptable`
instead: that at least fails the caller immediately and in the open.

## Resources

- [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)
- [RFC 9110 section 12.5.1 (Accept)](https://www.rfc-editor.org/rfc/rfc9110#name-accept)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Serve a single application/json response to a client whose Accept names only application/json
Fix: Read the request `Accept` header and answer within it. Streamable HTTP lets the server reply either with one `application/json` body or with a `text/event-stream`, and the choice is the client's to constrain: a caller that sends `Accept: application/json` alone is telling you its HTTP client cannot read a stream. Answering that caller with `text/event-stream` returns a `200` over a body it cannot parse, and no status code tells it what went wrong. Parse the header with q-value semantics rather than a substring match, buffer the response, and emit `Content-Type: application/json`. Reserve the stream for callers that accept it. If your server genuinely cannot produce a single JSON body, refuse with `406 Not Acceptable` instead: that at least fails the caller immediately and in the open.
Skill: https://anc.dev/fix/mcp-accept-json
Docs: https://modelcontextprotocol.io/specification/2025-06-18/basic/transports, https://www.rfc-editor.org/rfc/rfc9110#name-accept
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-accept-json` check should report `pass`.