fix: fall back to SSE when AutoDetect probe gets 405 with JSON-RPC error body

src/ModelContextProtocol.Core/Client/AutoDetectingClientSessionTransport.cs

@@ -108,6 +108,13 @@ private async Task InitializeAsync(JsonRpcMessage message, CancellationToken can
                 // TryReadJsonRpcErrorAsync returns early on the content type, so there is no double read.
                 var streamableHttpError = await HttpResponseMessageExtensions.CreateHttpRequestExceptionWithBodyAsync(response, cancellationToken).ConfigureAwait(false);
 
+                // Only the legacy initialize-handshake probe failures may fall back to SSE. Authentication,
+                // authorization, and server errors must retain their HTTP semantics without a deprecated GET.
+                if (!ShouldTrySseFallback(response.StatusCode))
+                {
+                    throw streamableHttpError;
+                }
+
                 await streamableHttpTransport.DisposeAsync().ConfigureAwait(false);
                 await InitializeSseTransportAsync(message, streamableHttpError, cancellationToken).ConfigureAwait(false);
             }
@@ -178,6 +185,14 @@ public async ValueTask DisposeAsync()
         }
     }
 
+    /// <summary>
+    /// Determines whether an HTTP failure can indicate an older server that requires the initialize handshake.
+    /// </summary>
+    private static bool ShouldTrySseFallback(HttpStatusCode statusCode) =>
+        statusCode is HttpStatusCode.BadRequest
+            or HttpStatusCode.NotFound
+            or HttpStatusCode.MethodNotAllowed;
+
     [LoggerMessage(Level = LogLevel.Debug, Message = "{EndpointName} attempting to connect using Streamable HTTP transport.")]
     private partial void LogAttemptingStreamableHttp(string endpointName);
 

src/ModelContextProtocol.Core/Client/McpClientImpl.cs

@@ -381,14 +381,19 @@ public async Task ConnectAsync(CancellationToken cancellationToken = default)
                         fallbackToInitialize = true;
                     }
                     catch (HttpRequestException ex) when (
-                        ex.GetStatusCode() is HttpStatusCode.BadRequest or HttpStatusCode.NotFound)
+                        ex.GetStatusCode() is HttpStatusCode.BadRequest
+                                              or HttpStatusCode.NotFound)
                     {
                         // A server predating SEP-2575 can reject the session-less server/discover POST at the
-                        // HTTP layer instead of with a JSON-RPC error: 400 when it cannot parse the request,
+                        // HTTP layer instead of with a JSON-RPC error: 400 when it cannot parse the request, or
                         // 404 when it requires Mcp-Session-Id on every non-initialize POST. A 400 carrying a
                         // structured JSON-RPC error is surfaced as McpProtocolException and handled above, so
                         // anything reaching here is plain or empty. Either way this is an initialize-handshake
-                        // server, so fall back. Other statuses stay uncaught and surface to the caller.
+                        // server, so fall back. A 405 means the POST endpoint rejected the request method
+                        // entirely, so retrying initialize over the same transport is not useful; the spec's 405
+                        // handling is the AutoDetect transport's fallback to SSE, and in explicit Streamable HTTP
+                        // mode a 405 surfaces to the caller. Other statuses stay uncaught and surface to the
+                        // caller.
                         fallbackToInitialize = true;
                     }
                     catch (OperationCanceledException) when (probeCts.IsCancellationRequested && !initializationCts.IsCancellationRequested)

tests/ModelContextProtocol.Tests/Client/July2026ProtocolFallbackTests.cs

@@ -220,7 +220,10 @@ public async Task Client_OnFallbackHttpStatusFromProbe_FallsBackTo_Initialize(
         // A server predating SEP-2575 can reject the session-less server/discover probe at the HTTP layer
         // rather than with a JSON-RPC error: 404 when it requires Mcp-Session-Id on every non-initialize
         // POST, or a plain/empty 400 when it cannot parse the request. Both are initialize-handshake
-        // servers, so the connect must fall back instead of failing.
+        // servers, so the connect must fall back instead of failing. (405 is deliberately excluded: the
+        // POST endpoint rejecting the request method does not mean initialize will succeed over the same
+        // transport, and the spec routes 405 to the AutoDetect transport's SSE fallback — see
+        // Client_On405FromProbe_DoesNotFallBackTo_Initialize.)
         var ct = TestContext.Current.CancellationToken;
         var initializeReceived = false;
 
@@ -240,17 +243,20 @@ public async Task Client_OnFallbackHttpStatusFromProbe_FallsBackTo_Initialize(
     }
 
     [Theory]
-    [InlineData(HttpTransportMode.StreamableHttp)]
-    [InlineData(HttpTransportMode.AutoDetect)]
-    public async Task Client_OnStructuredInvalidRequestFromHttpProbe_FallsBackTo_Initialize(
-        HttpTransportMode transportMode)
+    [InlineData(HttpStatusCode.BadRequest, HttpTransportMode.StreamableHttp)]
+    [InlineData(HttpStatusCode.BadRequest, HttpTransportMode.AutoDetect)]
+    [InlineData(HttpStatusCode.NotFound, HttpTransportMode.StreamableHttp)]
+    [InlineData(HttpStatusCode.NotFound, HttpTransportMode.AutoDetect)]
+    public async Task Client_OnStructuredFallbackHttpStatusFromProbe_FallsBackTo_Initialize(
+        HttpStatusCode status, HttpTransportMode transportMode)
     {
         var ct = TestContext.Current.CancellationToken;
         var initializeReceived = false;
 
         using var mockHttpHandler = new MockHttpHandler();
         using var httpClient = new HttpClient(mockHttpHandler);
-        mockHttpHandler.RequestHandler = CreateStructuredInvalidRequestProbeServer(
+        mockHttpHandler.RequestHandler = CreateStructuredProbeRejectingServer(
+            status,
             () => initializeReceived = true);
 
         await using var transport = CreateTransport(httpClient, transportMode);
@@ -261,23 +267,86 @@ public async Task Client_OnStructuredInvalidRequestFromHttpProbe_FallsBackTo_Ini
         Assert.Equal(McpProtocolVersions.November2025ProtocolVersion, client.NegotiatedProtocolVersion);
     }
 
+    [Theory]
+    [InlineData(HttpTransportMode.StreamableHttp, false)]
+    [InlineData(HttpTransportMode.AutoDetect, true)]
+    public async Task Client_On405FromProbe_DoesNotFallBackTo_Initialize(
+        HttpTransportMode transportMode, bool expectSseAttempt)
+    {
+        // 405 means the POST endpoint rejected the request method, so retrying initialize over the same
+        // transport is not useful. The spec routes 405 to the AutoDetect transport's SSE fallback: in
+        // Streamable HTTP mode the 405 surfaces directly, and in AutoDetect mode the client attempts the
+        // deprecated SSE GET instead of initialize. Neither path may attempt initialize.
+        var ct = TestContext.Current.CancellationToken;
+        var initializeReceived = false;
+        var sseRequested = false;
+
+        using var mockHttpHandler = new MockHttpHandler();
+        using var httpClient = new HttpClient(mockHttpHandler);
+        mockHttpHandler.RequestHandler = CreateProbeRejectingServer(
+            HttpStatusCode.MethodNotAllowed, "Invalid session ID",
+            () => initializeReceived = true, () => sseRequested = true);
+
+        await using var transport = CreateTransport(httpClient, transportMode);
+
+        await Assert.ThrowsAnyAsync<HttpRequestException>(async () =>
+        {
+            await using var client = await McpClient.CreateAsync(transport, new McpClientOptions(),
+                loggerFactory: LoggerFactory, cancellationToken: ct);
+        });
+
+        Assert.False(initializeReceived);
+        Assert.Equal(expectSseAttempt, sseRequested);
+    }
+
+    [Theory]
+    [InlineData(HttpTransportMode.StreamableHttp)]
+    [InlineData(HttpTransportMode.AutoDetect)]
+    public async Task Client_OnStructured405FromProbe_DoesNotFallBackTo_Initialize(
+        HttpTransportMode transportMode)
+    {
+        // A 405 carrying a structured JSON-RPC error body means the peer is a Streamable HTTP server
+        // that rejected the method; the AutoDetect transport adopts the transport and surfaces the error
+        // instead of trying SSE, and neither transport should attempt initialize.
+        var ct = TestContext.Current.CancellationToken;
+        var initializeReceived = false;
+
+        using var mockHttpHandler = new MockHttpHandler();
+        using var httpClient = new HttpClient(mockHttpHandler);
+        mockHttpHandler.RequestHandler = CreateStructuredProbeRejectingServer(
+            HttpStatusCode.MethodNotAllowed, () => initializeReceived = true);
+
+        await using var transport = CreateTransport(httpClient, transportMode);
+
+        await Assert.ThrowsAnyAsync<HttpRequestException>(async () =>
+        {
+            await using var client = await McpClient.CreateAsync(transport, new McpClientOptions(),
+                loggerFactory: LoggerFactory, cancellationToken: ct);
+        });
+
+        Assert.False(initializeReceived);
+    }
+
     [Theory]
     [InlineData(HttpStatusCode.InternalServerError, HttpTransportMode.StreamableHttp)]
     [InlineData(HttpStatusCode.Forbidden, HttpTransportMode.StreamableHttp)]
     [InlineData(HttpStatusCode.InternalServerError, HttpTransportMode.AutoDetect)]
+    [InlineData(HttpStatusCode.Unauthorized, HttpTransportMode.AutoDetect)]
+    [InlineData(HttpStatusCode.Forbidden, HttpTransportMode.AutoDetect)]
     public async Task Client_OnOtherHttpErrorFromProbe_Surfaces_NoFallback(
         HttpStatusCode status, HttpTransportMode transportMode)
     {
-        // Only 400 and 404 are read as "this server needs the initialize handshake". Any other HTTP failure
-        // is a genuine transport error and must surface, so callers are not handed a misleading downstream
-        // error. Guards the deliberate narrowing of the status filter.
+        // Only 400 and 404 indicate that the server needs the initialize handshake (405 routes to the
+        // AutoDetect SSE fallback instead). Authentication and server failures must surface directly,
+        // without probing deprecated SSE or attempting initialize.
         var ct = TestContext.Current.CancellationToken;
         var initializeReceived = false;
+        var sseRequested = false;
 
         using var mockHttpHandler = new MockHttpHandler();
         using var httpClient = new HttpClient(mockHttpHandler);
         mockHttpHandler.RequestHandler = CreateProbeRejectingServer(
-            status, "nope", () => initializeReceived = true);
+            status, "nope", () => initializeReceived = true, () => sseRequested = true);
 
         await using var transport = CreateTransport(httpClient, transportMode);
 
@@ -288,6 +357,7 @@ await Assert.ThrowsAnyAsync<HttpRequestException>(async () =>
         });
 
         Assert.False(initializeReceived);
+        Assert.False(sseRequested);
     }
 
     private HttpClientTransport CreateTransport(HttpClient httpClient, HttpTransportMode transportMode)
@@ -303,13 +373,17 @@ private HttpClientTransport CreateTransport(HttpClient httpClient, HttpTransport
     /// and, if the client falls back, completes an <c>initialize</c> handshake at 2025-11-25.
     /// </summary>
     private static Func<HttpRequestMessage, Task<HttpResponseMessage>> CreateProbeRejectingServer(
-        HttpStatusCode probeStatus, string probeBody, Action onInitialize)
+        HttpStatusCode probeStatus, string probeBody, Action onInitialize, Action? onSseRequest = null)
         => async request =>
         {
             // The server offers no standalone SSE stream, which the spec permits.
             // net472 does not populate a default Content, so every response sets one explicitly.
             if (request.Method == HttpMethod.Get)
+            {
+                // Track accidental AutoDetect fallback for non-allowlisted HTTP failures.
+                onSseRequest?.Invoke();
                 return EmptyResponse(HttpStatusCode.MethodNotAllowed);
+            }
 
             var body = await request.Content!.ReadAsStringAsync();
             using var doc = JsonDocument.Parse(body);
@@ -339,8 +413,8 @@ private static Func<HttpRequestMessage, Task<HttpResponseMessage>> CreateProbeRe
             }
         };
 
-    private static Func<HttpRequestMessage, Task<HttpResponseMessage>> CreateStructuredInvalidRequestProbeServer(
-        Action onInitialize)
+    private static Func<HttpRequestMessage, Task<HttpResponseMessage>> CreateStructuredProbeRejectingServer(
+        HttpStatusCode probeStatus, Action onInitialize)
         => async request =>
         {
             if (request.Method == HttpMethod.Get)
@@ -356,7 +430,7 @@ private static Func<HttpRequestMessage, Task<HttpResponseMessage>> CreateStructu
                 var id = doc.RootElement.GetProperty("id").GetRawText();
                 var error = "{\"jsonrpc\":\"2.0\",\"id\":" + id
                     + ",\"error\":{\"code\":-32600,\"message\":\"Mcp-Session-Id header is required\"}}";
-                return new HttpResponseMessage(HttpStatusCode.BadRequest)
+                return new HttpResponseMessage(probeStatus)
                 {
                     Content = new StringContent(error, Encoding.UTF8, "application/json"),
                 };