MCP-STL-001

Server never mints or echoes Mcp-Session-Id

“Remove protocol-level sessions and the Mcp-Session-Id header from the Streamable HTTP transport.” — spec anchor

How to fix this

Stop minting and stop echoing `Mcp-Session-Id`. Protocol-level sessions were removed from the Streamable HTTP transport, so the header has no meaning in this revision.

Example: failing and passing

The server echoes an Mcp-Session-Id header back on the response.

Violates MCP-STL-001 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list
Mcp-Session-Id: 550e8400-e29b-41d4-a716-446655440000

{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {"_meta": {
  "io.modelcontextprotocol/protocolVersion": "2026-07-28",
  "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json
Mcp-Session-Id: 550e8400-e29b-41d4-a716-446655440000

...

The server returns no Mcp-Session-Id header at all.

Complies with MCP-STL-001 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list
Mcp-Session-Id: 550e8400-e29b-41d4-a716-446655440000

{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {"_meta": {
  "io.modelcontextprotocol/protocolVersion": "2026-07-28",
  "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

...

How the validator checks this

Probe P5.3, against a streamable-http server on the modern protocol. What it reports:

pass: No Mcp-Session-Id minted or echoed
fail: Returned Mcp-Session-Id: … — the header was removed from the transport; a modern server must neither mint nor echo it

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-STL-002.

Check your own server against MCP-STL-001

Probe P5.3 checks MCP-STL-001 in the same request as 1 other rule, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: statelessness and Mcp-Session-Id explained.

Other Statelessness and session removal rules

MCP-STL-002A client-supplied Mcp-Session-Id is ignored, not required
MCP-STL-003A cold modern request succeeds with no prior handshake
MCP-STL-004Server does not rely on prior requests over the same connection
MCP-STL-005GET on the MCP endpoint returns 405
MCP-STL-006DELETE on the MCP endpoint returns 405
MCP-STL-007Last-Event-ID is ignored — streams are not resumable
MCP-STL-008tools/list does not vary per connection