MCP-STL-003

A cold modern request succeeds with no prior handshake

“Make MCP stateless: remove the initialize/notifications/initialized handshake.” — spec anchor

How to fix this

Answer a request that arrives cold, with no prior handshake. `initialize` and `notifications/initialized` were removed; every request is self-contained.

Example: failing and passing

The server refuses the first request on a fresh connection because no initialize handshake happened.

Violates MCP-STL-003 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: server/discover

{"jsonrpc": "2.0", "id": 1, "method": "server/discover", "params": {"_meta": {
  "io.modelcontextprotocol/protocolVersion": "2026-07-28",
  "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32600, "message": "Server not initialized"}}

The server answers the very first request, sent with no initialize beforehand, from the request's own _meta.

Complies with MCP-STL-003 · HTTP

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: server/discover

{"jsonrpc": "2.0", "id": 1, "method": "server/discover", "params": {"_meta": {
  "io.modelcontextprotocol/protocolVersion": "2026-07-28",
  "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete",
  "supportedVersions": ["2026-07-28"], "capabilities": {"tools": {}},
  "ttlMs": 3600000, "cacheScope": "public"}}

How the validator checks this

Probe P1.1, against a streamable-http server on the modern protocol. What it reports:

pass: Cold request succeeded with no prior handshake

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-DSC-001, MCP-DSC-002, MCP-DSC-003, MCP-DSC-004, MCP-DSC-005, MCP-RES-001, MCP-RES-002, MCP-RES-005.

Check your own server against MCP-STL-003

Probe P1.1 checks MCP-STL-003 in the same request as 8 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: statelessness and Mcp-Session-Id explained.

Other Statelessness and session removal rules

MCP-STL-001Server never mints or echoes Mcp-Session-Id
MCP-STL-002A client-supplied Mcp-Session-Id is ignored, not required
MCP-STL-004Server does not rely on prior requests over the same connection
MCP-STL-005GET on the MCP endpoint returns 405
MCP-STL-006DELETE on the MCP endpoint returns 405
MCP-STL-007Last-Event-ID is ignored — streams are not resumable
MCP-STL-008tools/list does not vary per connection