Hi — found a reproducible crash in @21st-dev/magic (v0.0.46) while exercising it as an MCP client would.
What happens: a JSON-RPC request whose id is an object (instead of a string/number/null) causes the server to shut down rather than reject the request. It logs Shutting down server (PID: ...) and closes stdin, and every later request on that connection then fails because the process has exited.
Minimal reproducer — send this one frame after a normal initialize:
{"jsonrpc": "2.0", "id": {"bad": "id"}, "method": "ping"}Expected: reject the malformed id with a JSON-RPC error and stay running.
Actual: server logs Shutting down server (PID: ...) and exits.
(Per the JSON-RPC 2.0 spec, id must be a String, Number, or Null, so the ideal behavior is to reject it with an error and stay up.)
For context, everything else handled correctly right up to this point: wrong-type tool arguments returned proper -32602 validation errors, and an unknown method returned -32601. It's specifically the malformed id that takes it down. Reproduced identically under both Claude Code and Cursor client behavior; a fresh relaunch and re-handshake works fine.
How I found it: I ran the server in an isolated sandbox under emulated Claude Code and Cursor traffic (a tool I'm building, Throne). Full sealed record with the step-by-step JSON-RPC trace: https://usethrone.dev/server/21st-dev-magic
Happy to share the full raw trace if useful. Thanks for building this — the feedback ask in your README is what prompted a clean report.
Hi — found a reproducible crash in
@21st-dev/magic(v0.0.46) while exercising it as an MCP client would.What happens: a JSON-RPC request whose
idis an object (instead of a string/number/null) causes the server to shut down rather than reject the request. It logsShutting down server (PID: ...)and closes stdin, and every later request on that connection then fails because the process has exited.Minimal reproducer — send this one frame after a normal initialize:
{"jsonrpc": "2.0", "id": {"bad": "id"}, "method": "ping"}Expected: reject the malformed
idwith a JSON-RPC error and stay running.Actual: server logs
Shutting down server (PID: ...)and exits.(Per the JSON-RPC 2.0 spec,
idmust be a String, Number, or Null, so the ideal behavior is to reject it with an error and stay up.)For context, everything else handled correctly right up to this point: wrong-type tool arguments returned proper
-32602validation errors, and an unknown method returned-32601. It's specifically the malformedidthat takes it down. Reproduced identically under both Claude Code and Cursor client behavior; a fresh relaunch and re-handshake works fine.How I found it: I ran the server in an isolated sandbox under emulated Claude Code and Cursor traffic (a tool I'm building, Throne). Full sealed record with the step-by-step JSON-RPC trace: https://usethrone.dev/server/21st-dev-magic
Happy to share the full raw trace if useful. Thanks for building this — the feedback ask in your README is what prompted a clean report.