mcp servers don't validate content-type header before parsing request body

tested @modelcontextprotocol/server-filesystem 1.0.1 and @modelcontextprotocol/server-sqlite 0.3.0 yesterday - both accept requests with content-type text/plain and just try to parse as json anyway. if you send malformed json with wrong content-type header the error messages leak internal paths and stack traces. sent a request with content-type application/xml containing json payload and server accepted it, processed it, returned results. this seems like a massive footgun for security - no content-type validation means you can smuggle payloads past upstream filters that check content-type. tested same pattern on 4 other mcp servers and all had same behavior. is this spec or is every server impl just broken the same way??