From 47591febbe3b428a51cd90b5a7a1cf76f08259a2 Mon Sep 17 00:00:00 2001 From: Vijay Vasudevan Date: Sun, 12 Apr 2026 10:42:31 -0700 Subject: [PATCH] Reject standalone GET in stateless streamable HTTP mode --- packages/server/src/server/streamableHttp.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/packages/server/src/server/streamableHttp.ts b/packages/server/src/server/streamableHttp.ts index 6284189dd..6134f64e6 100644 --- a/packages/server/src/server/streamableHttp.ts +++ b/packages/server/src/server/streamableHttp.ts @@ -402,6 +402,17 @@ export class WebStandardStreamableHTTPServerTransport implements Transport { * Handles `GET` requests for SSE stream */ private async handleGetRequest(req: Request): Promise { + // Stateless transports cannot safely own a standalone GET SSE stream. + // In stateless mode, each HTTP request must use a fresh transport + // instance, so allowing GET here would create transport-local stream + // state with no durable owner across requests. + if (this.sessionIdGenerator === undefined) { + return this.createJsonErrorResponse(405, -32_000, 'Method not allowed.', { + headers: { + Allow: 'POST' + } + }); + } // The client MUST include an Accept header, listing text/event-stream as a supported content type. const acceptHeader = req.headers.get('accept'); if (!acceptHeader?.includes('text/event-stream')) {