# Fix: a non-JSON body draws -32700 (or a typed HTTP 400/415 refusal)

> Web-audit fix skill for the `mcp-malformed-body` check (MCP, SHOULD).

## Goal

Refuse an unparseable request body with a parse-error envelope or a typed HTTP refusal.

## Fix

Answer a `POST` whose body is not valid JSON with the JSON-RPC parse-error envelope
(`error.code: -32700`, `id: null`); delivering it at HTTP `400` is fine. A bare HTTP `400`
or `415` with no envelope also conforms as a typed refusal. What fails the check: a `200`
with garbage, a hang, or any other bare status (a bare `404` reads as a dead endpoint, not
a refusal).

## Resources

- [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Refuse an unparseable request body with a parse-error envelope or a typed HTTP refusal
Fix: Answer a `POST` whose body is not valid JSON with the JSON-RPC parse-error envelope (`error.code: -32700`, `id: null`); delivering it at HTTP `400` is fine. A bare HTTP `400` or `415` with no envelope also conforms as a typed refusal. What fails the check: a `200` with garbage, a hang, or any other bare status (a bare `404` reads as a dead endpoint, not a refusal).
Skill: https://anc.dev/fix/mcp-malformed-body
Docs: https://www.jsonrpc.org/specification#error_object
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-malformed-body` check should report `pass`.