StreamableHTTPSessionManager returns 400 instead of 404 for unknown session ID #1727

Description

StreamableHTTPSessionManager._handle_stateful_request() returns HTTP 400 Bad Request when a session ID is provided but not found in the server instances. According to the MCP spec, this should be HTTP 404 Not Found.

Spec Reference

From the Streamable HTTP transport spec:

Servers that require a session ID SHOULD respond to requests without an Mcp-Session-Id header (other than initialization) with HTTP 400 Bad Request.

The server MAY terminate the session at any time, after which it MUST respond to requests containing that session ID with HTTP 404 Not Found.

When a client receives HTTP 404 in response to a request containing an Mcp-Session-Id, it MUST start a new session by sending a new InitializeRequest without a session ID attached.

Current Behavior

In src/mcp/server/streamable_http_manager.py, the _handle_stateful_request method:

if request_mcp_session_id is not None and request_mcp_session_id in self._server_instances:
    # Handle existing session
    ...
elif request_mcp_session_id is None:
    # Create new session
    ...
else:
    # Session ID provided but not found
    response = Response(
        "Bad Request: No valid session ID provided",
        status_code=HTTPStatus.BAD_REQUEST,  # ← Should be NOT_FOUND (404)
    )

Expected Behavior

The else branch should return 404 Not Found:

else:
    response = Response(
        "Not Found: Session not found",
        status_code=HTTPStatus.NOT_FOUND,
    )

Why This Matters

The distinction matters for client behavior:

• 400 indicates a malformed request - clients may retry or report an error
• 404 indicates the session doesn't exist - clients know to re-initialize

The transport layer (streamable_http.py) correctly implements this in _validate_session(), but the manager layer has its own session lookup that doesn't follow the same pattern.

Note

The TypeScript SDK's StreamableHTTPServerTransport correctly returns 404 for session mismatch in its validateSession method.