fix(server): read request bodies where Request.body is not implemented

[littleKitchen]

Fixes #3025

Problem

Firefox does not implement Request.body (it is undefined), so readRequestBody throws on request.body.getReader().
Every POST to a browser-hosted server is then answered 400 with a JSON-RPC parse error: createMcpHandler answers Parse error: the request body could not be read, and WebStandardStreamableHTTPServerTransport answers Parse error: Invalid JSON.
Before #2698 these paths read the body with request.text() and req.json(), which work in Firefox.

Change

When request.body is undefined, read the body with arrayBuffer() and compare its byte length with maxBytes, so an oversized body still gets 413.
With no stream there is nothing to stop early, so in this fallback the limit is checked after the body is read; the Content-Length pre-check still runs first.
Runtimes that expose the stream keep the streaming reader unchanged. No new API.

One test in createMcpHandler.test.ts hides Request.body the way Firefox does, then checks that a modern tools/call is served (200) and that an oversized body gets 413. Includes a patch changeset for @modelcontextprotocol/server.

Validation

• The new test fails on unchanged main (400) and passes with the fix.
• pnpm build:all, pnpm typecheck:all and pnpm lint:all pass.
• pnpm test:all passes in every package except test/e2e, where protocol:timeout:max-total [sse …] fails intermittently on my machine (expected 0 to be greater than or equal to 3 on the tick count). It fails the same way on unchanged main: 3 runs each with and without this change, 1–2 failures per run.
• Not tried in a real Firefox; the test simulates the missing property.

AI disclosure: this PR was written primarily by Claude Code (the fix, the test, the changeset and this description), under my direction.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 49cb43e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3028

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3028

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3028

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3028

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3028

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3028

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3028

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3028

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3028

commit: 49cb43e