Last-Event-ID is ignored — streams are not resumable

How to fix this

Ignore the `Last-Event-ID` header. Streams are not resumable in this revision, so the header is inert — but rejecting a request that carries it breaks clients that still send it.

Example: failing and passing

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list
Last-Event-ID: 1

{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {"_meta": {
  "io.modelcontextprotocol/protocolVersion": "2026-07-28",
  "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "error": {"code": -32600, "message": "Cannot resume stream"}}

POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list
Last-Event-ID: 1

{"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {"_meta": {
  "io.modelcontextprotocol/protocolVersion": "2026-07-28",
  "io.modelcontextprotocol/clientCapabilities": {}}}}

HTTP/1.1 200 OK
Content-Type: application/json

{"jsonrpc": "2.0", "id": 1, "result": {"resultType": "complete", "tools": [], "ttlMs": 300000, "cacheScope": "public"}}

How the validator checks this

Probe P5.4, against a streamable-http server on the modern protocol. What it reports:

pass

Last-Event-ID was ignored — streams are not resumable

warn

Rejected a request carrying Last-Event-ID (HTTP …); it should simply be ignored

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Check your own server against MCP-STL-007

Probe P5.4 checks MCP-STL-007 in a request of its own, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: statelessness and Mcp-Session-Id explained.

Other Statelessness and session removal rules

• MCP-STL-001Server never mints or echoes Mcp-Session-Id
• MCP-STL-002A client-supplied Mcp-Session-Id is ignored, not required
• MCP-STL-003A cold modern request succeeds with no prior handshake
• MCP-STL-004Server does not rely on prior requests over the same connection
• MCP-STL-005GET on the MCP endpoint returns 405
• MCP-STL-006DELETE on the MCP endpoint returns 405
• MCP-STL-008tools/list does not vary per connection