anc.dev the agent-native standard
Install ▸

Fix: a non-JSON body draws -32700 (or a typed HTTP 400/415 refusal)

Web-audit fix skill for the mcp-malformed-body check (MCP, SHOULD).

Goal

Refuse an unparseable request body with a parse-error envelope or a typed HTTP refusal.

Fix

Answer a POST whose body is not valid JSON with the JSON-RPC parse-error envelope (error.code: -32700, id: null); delivering it at HTTP 400 is fine. A bare HTTP 400 or 415 with no envelope also conforms as a typed refusal. What fails the check: a 200 with garbage, a hang, or any other bare status (a bare 404 reads as a dead endpoint, not a refusal).

Resources

Copy-paste prompt

Paste this into your coding agent. Your audit adds what it observed for this check:

Verify

Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the mcp-malformed-body check should report pass.