# Fix: a batch carrying a modern-envelope request is rejected -32600

> Web-audit fix skill for the `mcp-batch-reject` check (MCP, SHOULD).

## Goal

Refuse JSON array batches that carry modern-era envelopes with -32600.

## Fix

Reject a JSON array batch whose element carries the modern `params._meta` envelope
(protocol revision `2026-07-28`) with `error.code: -32600` (Invalid Request) and `id: null`.
Modern-era requests are single-request only: an envelope-bearing element inside an array is
never valid, so serving it (or answering anything other than `-32600`) is non-conforming.

## Resources

- [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object)
- [MCP transports (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Refuse JSON array batches that carry modern-era envelopes with -32600
Fix: Reject a JSON array batch whose element carries the modern `params._meta` envelope (protocol revision `2026-07-28`) with `error.code: -32600` (Invalid Request) and `id: null`. Modern-era requests are single-request only: an envelope-bearing element inside an array is never valid, so serving it (or answering anything other than `-32600`) is non-conforming.
Skill: https://anc.dev/fix/mcp-batch-reject
Docs: https://www.jsonrpc.org/specification#error_object, https://modelcontextprotocol.io/specification/2026-07-28/basic/transports
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-batch-reject` check should report `pass`.