# Fix: _meta missing clientCapabilities is rejected (-32602 or -32600)

> Web-audit fix skill for the `mcp-modern-clientcaps` check (MCP, SHOULD).

## Goal

Enforce the mandatory clientCapabilities key on every modern request.

## Fix

Reject a modern request whose `params._meta` omits
`io.modelcontextprotocol/clientCapabilities` with a well-formed error envelope. The check
accepts two codes: `-32602` (Invalid params, the SDK-typed refusal) as the primary, and
`-32600` (Invalid Request family) from conforming non-SDK servers. The key is mandatory on
every `2026-07-28` request even when the client has no capabilities to declare; an empty
object is valid.

## Resources

- [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Enforce the mandatory clientCapabilities key on every modern request
Fix: Reject a modern request whose `params._meta` omits `io.modelcontextprotocol/clientCapabilities` with a well-formed error envelope. The check accepts two codes: `-32602` (Invalid params, the SDK-typed refusal) as the primary, and `-32600` (Invalid Request family) from conforming non-SDK servers. The key is mandatory on every `2026-07-28` request even when the client has no capabilities to declare; an empty object is valid.
Skill: https://anc.dev/fix/mcp-modern-clientcaps
Docs: https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-modern-clientcaps` check should report `pass`.