@@ -6,7 +6,7 @@ A Model Context Protocol server that provides web content fetching capabilities.
 
 Source: https://github.com/modelcontextprotocol/servers/tree/main/src/fetch
 
-Requires MCP Python SDK 2.x (`mcp>=2.2,<3`).
+Requires MCP Python SDK 2.x (`mcp>=2.3,<3`).
 
 > [!CAUTION]
 > This server can access local/internal IP addresses and may represent a security risk. Exercise caution when using this MCP server to ensure this does not expose any sensitive data.
 
@@ -18,7 +18,7 @@ classifiers = [
 dependencies = [
     "httpx[socks]>=0.27",
     "markdownify>=0.13.1",
-    "mcp>=2.2,<3",
+    "mcp>=2.3,<3",
     "protego>=0.6.2",
     "pydantic>=2.0.0",
     "readabilipy>=0.2.0",
 
@@ -359,16 +359,21 @@ def reject_unknown_names(server: MCPServer) -> ServerMiddleware[Any]:
     async def middleware(
         ctx: ServerRequestContext[Any, Any], call_next: CallNext
     ) -> HandlerResult:
-        params: Mapping[str, Any] = ctx.params or {}
+        # Raw params, not yet validated: only a string name and a mapping of
+        # arguments are inspected here. Anything malformed is left to the
+        # SDK's own params validation, which answers it with -32602.
+        params = ctx.params if isinstance(ctx.params, Mapping) else {}
         name = params.get("name")
+        if not isinstance(name, str):
+            return await call_next(ctx)
         if ctx.method == "tools/call":
             if name not in {tool.name for tool in await server.list_tools()}:
                 raise MCPError(code=INVALID_PARAMS, message=f"Unknown tool: {name}")
         elif ctx.method == "prompts/get":
             if name not in {prompt.name for prompt in await server.list_prompts()}:
                 raise MCPError(code=INVALID_PARAMS, message=f"Unknown prompt: {name}")
             arguments = params.get("arguments") or {}
-            if "url" not in arguments:
+            if isinstance(arguments, Mapping) and "url" not in arguments:
                 raise MCPError(code=INVALID_PARAMS, message="URL is required")
         return await call_next(ctx)
 
 
@@ -30,7 +30,14 @@
 import readabilipy.simple_json
 from mcp import ClientSession
 from mcp.shared.memory import create_client_server_memory_streams
-from mcp.types import InitializeResult
+from mcp.shared.message import SessionMessage
+from mcp.types import (
+    InitializeResult,
+    JSONRPCError,
+    JSONRPCNotification,
+    JSONRPCRequest,
+    JSONRPCResponse,
+)
 
 import mcp_server_fetch.server as server_module
 
@@ -152,3 +159,70 @@ def private_tempdir(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     each other's pages.
     """
     monkeypatch.setattr(tempfile, "tempdir", str(tmp_path))
+
+
+async def raw_request(
+    method: str, params: dict[str, Any]
+) -> Union[JSONRPCResponse, JSONRPCError]:
+    """Send one request exactly as given, bypassing the client's own checks.
+
+    `ClientSession` validates what it sends, so a malformed request (a list as
+    a tool name, a number as the arguments) can only reach the server as raw
+    JSON-RPC: a 2025-11-25 handshake, then the request, and its response.
+    """
+    async with create_client_server_memory_streams() as (
+        (client_read, client_write),
+        server_streams,
+    ):
+
+        @asynccontextmanager
+        async def fake_stdio_server() -> AsyncIterator[Any]:
+            yield server_streams
+
+        async def receive(request_id: int) -> Union[JSONRPCResponse, JSONRPCError]:
+            async for item in client_read:
+                assert isinstance(item, SessionMessage)
+                message = item.message
+                if (
+                    isinstance(message, (JSONRPCResponse, JSONRPCError))
+                    and message.id == request_id
+                ):
+                    return message
+            raise AssertionError("the server closed the stream")  # pragma: no cover
+
+        with patch("mcp.server.mcpserver.server.stdio_server", fake_stdio_server):
+            async with anyio.create_task_group() as tg:
+                tg.start_soon(lambda: server_module.serve())
+                await client_write.send(
+                    SessionMessage(
+                        JSONRPCRequest(
+                            jsonrpc="2.0",
+                            id=1,
+                            method="initialize",
+                            params={
+                                "protocolVersion": "2025-11-25",
+                                "capabilities": {},
+                                "clientInfo": {"name": "raw", "version": "0"},
+                            },
+                        )
+                    )
+                )
+                await receive(1)
+                await client_write.send(
+                    SessionMessage(
+                        JSONRPCNotification(
+                            jsonrpc="2.0", method="notifications/initialized"
+                        )
+                    )
+                )
+                await client_write.send(
+                    SessionMessage(
+                        JSONRPCRequest(
+                            jsonrpc="2.0", id=2, method=method, params=params
+                        )
+                    )
+                )
+                response = await receive(2)
+                tg.cancel_scope.cancel()
+                return response
+    raise AssertionError("unreachable")  # pragma: no cover
@@ -29,15 +29,15 @@
 from mcp.shared.exceptions import MCPError
 from mcp.shared.memory import create_client_server_memory_streams
 from mcp.shared.message import SessionMessage
-from mcp.types import INVALID_PARAMS, CallToolResult, JSONRPCRequest
+from mcp.types import INVALID_PARAMS, CallToolResult, JSONRPCError, JSONRPCRequest
 
 from mcp_server_fetch.server import (
     DEFAULT_USER_AGENT_AUTONOMOUS,
     DEFAULT_USER_AGENT_MANUAL,
     serve,
 )
 
-from .harness import FakeWeb, connect
+from .harness import FakeWeb, connect, raw_request
 
 PAGE = "https://example.com/page"
 ROBOTS = "https://example.com/robots.txt"
@@ -287,6 +287,33 @@ async def test_unknown_tool_name_is_a_jsonrpc_error(web: FakeWeb) -> None:
     assert web.requests == []
 
 
+@pytest.mark.parametrize(
+    ("method", "params"),
+    [
+        ("tools/call", {"name": [], "arguments": {}}),
+        ("tools/call", {"name": {}, "arguments": {}}),
+        ("prompts/get", {"name": [], "arguments": {}}),
+        ("prompts/get", {"name": "fetch", "arguments": 1}),
+    ],
+    ids=[
+        "tool-name-list",
+        "tool-name-object",
+        "prompt-name-list",
+        "prompt-arguments-number",
+    ],
+)
+async def test_malformed_request_is_invalid_params_not_an_internal_error(
+    web: FakeWeb, method: str, params: dict[str, Any]
+) -> None:
+    # #5175 review: the unknown-name middleware sees raw params, so it leaves
+    # a non-string name or non-mapping arguments to the SDK's validation,
+    # which answers -32602, instead of failing on them with -32603.
+    response = await raw_request(method, params)
+    assert isinstance(response, JSONRPCError), response
+    assert response.error.code == INVALID_PARAMS
+    assert web.requests == []
+
+
 async def test_unknown_tool_name_is_rejected_before_argument_validation(
     web: FakeWeb,
 ) -> None:
 
@@ -8,7 +8,7 @@ A Model Context Protocol server for Git repository interaction and automation. T
 
 Source: https://github.com/modelcontextprotocol/servers/tree/main/src/git
 
-Requires MCP Python SDK 2.x (`mcp>=2.2,<3`). The server is built on the SDK's high-level `MCPServer`: each tool is a typed Python function, and the SDK derives its input schema from the signature.
+Requires MCP Python SDK 2.x (`mcp>=2.3,<3`). The server is built on the SDK's high-level `MCPServer`: each tool is a typed Python function, and the SDK derives its input schema from the signature.
 
 Please note that mcp-server-git is currently in early development. The functionality and available tools are subject to change and expansion as we continue to develop and improve the server.
 
 
@@ -18,7 +18,7 @@ classifiers = [
 dependencies = [
     "click>=8.1.7",
     "gitpython>=3.1.60",
-    "mcp>=2.2,<3",
+    "mcp>=2.3,<3",
     "pydantic>=2.0.0",
 ]
 
 
@@ -17,6 +17,7 @@
 # logging), so nothing differs between them.
 
 import logging
+import threading
 from collections.abc import Callable, Iterator
 from contextlib import contextmanager
 from enum import Enum
@@ -445,16 +446,23 @@ def reported_to_model() -> Iterator[None]:
 _P = ParamSpec("_P")
 
 
+# `MCPServer` runs a synchronous tool in a worker thread, so two calls can
+# overlap. A git operation is a check followed by a change (staged changes,
+# then the commit), and the index is shared, so one call at a time: the lock
+# keeps the serial behavior the server had when tools ran on the event loop.
+_GIT_LOCK = threading.Lock()
+
+
 def reports_failures(fn: Callable[_P, str]) -> Callable[_P, str]:
-    """Run a tool function inside `reported_to_model()`.
+    """Run a tool function alone, inside `reported_to_model()`.
 
     `wraps` keeps the signature, which is what `MCPServer` reads to build the
     tool's input schema.
     """
 
     @wraps(fn)
     def wrapper(*args: _P.args, **kwargs: _P.kwargs) -> str:
-        with reported_to_model():
+        with _GIT_LOCK, reported_to_model():
             return fn(*args, **kwargs)
 
     return wrapper
 
@@ -10,6 +10,8 @@
 
 import json
 import re
+import threading
+import time
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 from importlib.metadata import version
@@ -704,6 +706,33 @@ async def test_an_unanticipated_exception_is_reported_generically(repo: git.Repo
     assert result == text_result("Error executing tool git_status", is_error=True)
 
 
+async def test_overlapping_tool_calls_run_one_at_a_time(repo: git.Repo):
+    # #5175 review: MCPServer runs a synchronous tool in a worker thread, so
+    # two calls can overlap, and a git operation is a check and then a change
+    # on a shared index. The server runs one tool call at a time.
+    active = 0
+    peak = 0
+    guard = threading.Lock()
+
+    def slow_status(_repo: git.Repo) -> str:
+        nonlocal active, peak
+        with guard:
+            active += 1
+            peak = max(peak, active)
+        time.sleep(0.2)
+        with guard:
+            active -= 1
+        return "clean"
+
+    root = str(root_of(repo))
+    with mock.patch("mcp_server_git.server.git_status", side_effect=slow_status):
+        async with connect(None) as session:
+            async with anyio.create_task_group() as tg:
+                for _ in range(3):
+                    tg.start_soon(session.call_tool, "git_status", {"repo_path": root})
+    assert peak == 1
+
+
 async def test_git_create_branch_rejects_flag_injection(repo: git.Repo):
     root = str(root_of(repo))
     assert await call(
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ classifiers = [`
`18`	`18`	`dependencies = [`
`19`	`19`	`"click>=8.1.7",`
`20`	`20`	`"gitpython>=3.1.60",`
`21`		`- "mcp>=2.2,<3",`
	`21`	`+ "mcp>=2.3,<3",`
`22`	`22`	`"pydantic>=2.0.0",`
`23`	`23`	`]`
`24`	`24`