fix: return 405 for pre-session GET the server won't serve as SSE

[dosvk]

Closes #3102

Summary

Per the Streamable HTTP transport spec (Listening for Messages from the Server):

The server MUST either return Content-Type: text/event-stream in response to this HTTP GET, or else return HTTP 405 Method Not Allowed, indicating that the server does not offer an SSE stream at this endpoint.

In stateful mode, a pre-session GET (no mcp-session-id header) returned 400 Bad Request: Missing session ID instead. Since client transports that probe for a standalone SSE stream before initialize treat only 405 as the graceful "no SSE — fall back to POST" signal (e.g. the TypeScript SDK's _startOrAuthSse), any other status aborts the handshake — the interop break described in #3102 (credit to @fgranata for the thorough root-cause analysis).

The 406-for-wildcard-Accept arm of the report is already fixed on main via check_accept_headers; this PR addresses the remaining 400 path.

Changes

• _handle_get_request: a session-less GET in stateful mode now returns 405 with Allow: GET, POST, DELETE (matching _handle_unsupported_request), before Accept validation — the spec's requirement applies to any GET the server won't serve as SSE, regardless of Accept header.
• New regression test covering the client-probe shapes (Accept: */*, application/json, absent, text/event-stream), asserting status, Allow header, and JSON-RPC error code.
• Updated one existing test that asserted the old 400 behavior.

Backward compatibility

Post-session GETs (valid mcp-session-id + SSE Accept) are unchanged and still serve SSE. Stateless mode is unaffected. POST/DELETE session validation is unchanged.

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/mcp/server/streamable_http.py">

<violation number="1" location="src/mcp/server/streamable_http.py:670">
P1: A pre-session GET now leaves an unused stateful session behind. The manager creates and registers a transport before this handler can return 405, and the client's fallback initialize creates another one; with the default no idle timeout, each probe retains a server task and session entry indefinitely. Consider rejecting session-less GETs in the manager before provisioning a transport (or explicitly removing and closing the provisional transport).</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: A pre-session GET now leaves an unused stateful session behind. The manager creates and registers a transport before this handler can return 405, and the client's fallback initialize creates another one; with the default no idle timeout, each probe retains a server task and session entry indefinitely. Consider rejecting session-less GETs in the manager before provisioning a transport (or explicitly removing and closing the provisional transport).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/server/streamable_http.py, line 670:

<comment>A pre-session GET now leaves an unused stateful session behind. The manager creates and registers a transport before this handler can return 405, and the client's fallback initialize creates another one; with the default no idle timeout, each probe retains a server task and session entry indefinitely. Consider rejecting session-less GETs in the manager before provisioning a transport (or explicitly removing and closing the provisional transport).</comment>

<file context>
@@ -656,11 +656,29 @@ async def _handle_get_request(self, request: Request, send: Send) -> None:
+        # Per MCP spec, pre-session GETs that cannot be served as SSE must return
+        # 405 Method Not Allowed. A GET without a session ID in stateful mode
+        # cannot establish an SSE stream because no session exists yet.
+        if self.mcp_session_id and not self._get_session_id(request):
+            headers = {
+                "Allow": "GET, POST, DELETE",
</file context>

[dosvk]

Good catch on the session leak — fixed in the latest commits.

The 405 rejection now happens in StreamableHTTPSessionManager._handle_stateful_request() before any transport is created or registered, so pre-session GET probes no longer leave a session behind (verified by test_pre_session_get_rejected_without_creating_transport, which asserts _server_instances stays empty). Security validation still runs first so DNS-rebinding rejections keep their 421.

The transport-level check remains as a defensive path for standalone (manager-less) transport use, now with its own tests instead of a pragma: no cover. Coverage on both changed files is back to 100%, and the snapshot assertions are collapsed per ruff format.