Session ID not present in memory store should return 404, not 400

[sthomson-wyn]

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

When a session ID is provided by a client, but it is not present in the in-memory session store for the server, the server returns a 400

python-sdk/src/mcp/server/streamable_http_manager.py

Lines 250 to 256 in d0443a1

	else:
	# Invalid session ID
	response = Response(
	"Bad Request: No valid session ID provided",
	status_code=HTTPStatus.BAD_REQUEST,
	)
	await response(scope, receive, send)

This is a problem, because as noted in #880 sessions are not persisted between restarts

This library should return a 404, as in

python-sdk/src/mcp/server/streamable_http.py

Line 371 in d0443a1

HTTPStatus.NOT_FOUND,

So that the client can re-initialize and get a new session ID as needed (as in https://github.com/mark3labs/mcp-go/blob/8f5b048218f6d044c3322f16b8cb0b08e10bf5d0/client/transport/streamable_http.go#L257).

400 isn't applicable because the request isn't bad, but the server simply doesn't persist sessions between restarts.

Example Code

Python & MCP Python SDK

3.10.12 and 2.3.4

[felixweinberger]

Should be resolved by Stateful Streamable-HTTP: send 404 Not Found on unknown Mcp-Session-Id #1417 if someone comes here we should prioritize reviewing that.

[tybalex]

encountered the same issue.

[maxisbey]

Fixed by #1945 (v1.x) and the equivalent change on main — StreamableHTTPSessionManager now returns HTTP 404 for unknown/expired session IDs. This was a duplicate of #1727, which was closed when #1945 merged; this one was missed.

_{AI Disclaimer}