createmcps.com

MCP-STL-006

DELETE on the MCP endpoint returns 405

“HTTP GET or DELETE to the MCP endpoint: respond with 405 Method Not Allowed.” — spec anchor

How to fix this

Respond to an HTTP DELETE on the MCP endpoint with 405 Method Not Allowed.

Example: failing and passing

The server accepts a DELETE on the MCP endpoint, as if there were a session to terminate.
Violates MCP-STL-006 · HTTP
DELETE /mcp HTTP/1.1
Host: mcp.example.com
Accept: application/json, text/event-stream

HTTP/1.1 200 OK
The server answers a DELETE on the MCP endpoint with 405 Method Not Allowed.
Complies with MCP-STL-006 · HTTP
DELETE /mcp HTTP/1.1
Host: mcp.example.com
Accept: application/json, text/event-stream

HTTP/1.1 405 Method Not Allowed
Allow: POST

Check your own server against MCP-STL-006

Probe P5.2 checks MCP-STL-006 in a request of its own, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: statelessness and Mcp-Session-Id explained.

Other Statelessness and session removal rules

  • MCP-STL-001Server never mints or echoes Mcp-Session-Id
  • MCP-STL-002A client-supplied Mcp-Session-Id is ignored, not required
  • MCP-STL-003A cold modern request succeeds with no prior handshake
  • MCP-STL-004Server does not rely on prior requests over the same connection
  • MCP-STL-005GET on the MCP endpoint returns 405
  • MCP-STL-007Last-Event-ID is ignored — streams are not resumable
  • MCP-STL-008tools/list does not vary per connection