Answer MCP notifications with 202 and no body

app/Http/Controllers/McpController.php

@@ -10,6 +10,7 @@
 use App\Services\PluginSearchService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class McpController extends Controller
 {
@@ -21,16 +22,22 @@ public function __construct(
     /**
      * JSON-RPC message endpoint for tool calls
      */
-    public function message(Request $request): JsonResponse
+    public function message(Request $request): JsonResponse|Response
     {
+        // A notification has no id and gets no JSON-RPC response. Over the
+        // Streamable HTTP transport, MCP answers it with 202 and no body.
+        // Clients such as Codex drop a server that sends a response here.
+        if (is_string($request->input('method')) && ! $request->has('id')) {
+            return response()->noContent(202);
+        }
+
         $method = $request->input('method');
         $params = $request->input('params', []);
         $id = $request->input('id');
 
         try {
             $result = match ($method) {
                 'initialize' => $this->handleInitialize($params),
-                'notifications/initialized' => new \stdClass,
                 'ping' => new \stdClass,
                 'tools/list' => ['tools' => $this->getToolDefinitions()],
                 'tools/call' => $this->handleToolCall(

tests/Feature/McpNotificationTest.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\TestCase;
+
+class McpNotificationTest extends TestCase
+{
+    use RefreshDatabase;
+
+    #[Test]
+    public function initialized_notification_gets_202_with_no_body(): void
+    {
+        $response = $this->postJson('/api/mcp/message', [
+            'jsonrpc' => '2.0',
+            'method' => 'notifications/initialized',
+        ]);
+
+        $response->assertNoContent(202);
+    }
+
+    #[Test]
+    public function any_notification_gets_202_with_no_body(): void
+    {
+        $response = $this->postJson('/api/mcp/message', [
+            'jsonrpc' => '2.0',
+            'method' => 'notifications/cancelled',
+            'params' => ['requestId' => 1],
+        ]);
+
+        $response->assertNoContent(202);
+    }
+
+    #[Test]
+    public function message_without_a_method_still_gets_an_error(): void
+    {
+        $response = $this->postJson('/api/mcp/message', [
+            'jsonrpc' => '2.0',
+        ]);
+
+        $response->assertOk();
+        $response->assertJsonPath('error.code', -32000);
+    }
+}