Initial Checks
Description
No logging in _handle_stateful_request when session ID is unknown/expired
Description
The else branch in StreamableHTTPSessionManager._handle_stateful_request() has no logging when it rejects a request with an unknown session ID.
The other two branches both log:
logger.debug("Session already exists for session ID ...")
logger.info("Created new transport for session ...")
The else branch just returns 404 (or 400 on previous version) silently.
https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http_manager.py
else:
# Unknown or expired session ID - return 404 per MCP spec
error_response = JSONRPCError(
jsonrpc="2.0",
id=None,
error=ErrorData(code=INVALID_REQUEST, message="Session not found"),
)
response = Response(
content=error_response.model_dump_json(by_alias=True, exclude_unset=True),
status_code=HTTPStatus.NOT_FOUND,
media_type="application/json",
)
await response(scope, receive, send)
We hit this in production after a server restart. A client not to be named was sending a stale mcp-session-id on every request and we had no idea why connections were failing. Wrapped the ASGI app in middleware to log rejected requests before we could see it was the same expired session ID every time.
A logger.warning here would have saved us a lot of time:
else:
logger.warning(
"Rejected request with unknown session ID: %s",
session_id,
)
...
Related issues
Thanks for all your hard work!
Example Code
Python & MCP Python SDK
- MCP SDK: 1.24.0 (also confirmed on older versions back when this returned 400)
- Python: 3.13
Initial Checks
Description
No logging in
_handle_stateful_requestwhen session ID is unknown/expiredDescription
The
elsebranch inStreamableHTTPSessionManager._handle_stateful_request()has no logging when it rejects a request with an unknown session ID.The other two branches both log:
logger.debug("Session already exists for session ID ...")logger.info("Created new transport for session ...")The
elsebranch just returns 404 (or 400 on previous version) silently.https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http_manager.py
We hit this in production after a server restart. A client not to be named was sending a stale
mcp-session-idon every request and we had no idea why connections were failing. Wrapped the ASGI app in middleware to log rejected requests before we could see it was the same expired session ID every time.A
logger.warninghere would have saved us a lot of time:Related issues
Thanks for all your hard work!
Example Code
Python & MCP Python SDK