Relax Accept header requirement for JSON-only responses

[domdomegg]

Summary

This PR relaxes the Accept header validation for servers with is_json_response_enabled=True. These servers only return application/json responses and never use SSE, so they should only require application/json in the Accept header rather than requiring both application/json and text/event-stream.

Changes

• Modified _handle_post_request to conditionally validate the Accept header based on response mode
• Extracted validation logic into a new _validate_accept_header method to reduce complexity
• Added test coverage for JSON-only Accept header validation
• Maintained backward compatibility - requests with both content types still work

Benefits

• Easier to test JSON-only MCP servers with tools like curl
• Follows the principle that servers should only require what they actually need to return
• All existing tests pass

[felixweinberger]

Should we add tests that also cover the failure cases of this new validation?

E.g. missing Accept header and incorrect accept header (e.g. sending event/stream on a JSON server)

I think these should return 406

[domdomegg]

@felixweinberger sounds good, have added tests for those

[felixweinberger]

This looks allowed by the spec, though indirectly: https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#sending-messages-to-the-server

The client MUST include an Accept header, listing both application/json and text/event-stream as supported content types.

So technically speaking we should never even get into a situation where this is actually a problem as clients should always support both. However, JSON only servers are clearly allowed by this:

If the input is a JSON-RPC request, the server MUST either return Content-Type: text/event-stream, to initiate an SSE stream, or Content-Type: application/json, to return one JSON object. The client MUST support both these cases.

So relaxing the server-side requirement makes sense to me, though the benefit seems unclear right now. I guess we save a few keystrokes on curl not having to type both types?