MCP Python SDK sessionId not maintained in browser with TypeScript SDK client

[waugmeiigaxaa]

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

[BUG] MCP Python SDK sessionId not maintained in browser with TypeScript SDK client

Issue: MCP Python SDK as Server, TypeScript SDK as Client – Node.js works, browser session management fails

Description

When using the official MCP Python SDK (fastmcp) as the server and the TypeScript SDK as the client, session management (mcp-session-id) works correctly in Node.js, but fails in browser environments. This results in repeated "Missing session ID" errors or lost sessions for every request.

Environment

• Server: MCP Python SDK (fastmcp), streamable_http_app, Starlette/uvicorn
• Client: TypeScript SDK (@modelcontextprotocol/sdk), StreamableHTTPClientTransport
• Node.js: Session management works out of the box
• Browser (React/Vitest): Session cannot be maintained
• All code is reverted to official logic, no monkey patching or custom fetch

Key Code Snippets

Server (http-server-streamable.py):

app = mcp.streamable_http_app()
app.add_middleware(
 CORSMiddleware,
 allow_origins=["http://localhost:3000"],
 allow_credentials=True,
 allow_methods=["*"],
 allow_headers=["*"]
)
uvicorn.run(app, host="127.0.0.1", port=8000)

Client (mcpService.ts):

// MCPService (browser and Node.js):
const transport = new StreamableHTTPClientTransport(new URL(this.url));
await mcp.connect(transport);
// In browser, MCPService does not automatically manage sessionId between requests.
// The first response from the server includes Mcp-Session-Id, but MCPService does not persist or inject it for subsequent requests.
// In Node.js, sessionId is managed via cookies and works as expected.

Test Case (mcp-streamable-browser.test.ts):

import { describe, it, expect } from 'vitest';
import { MCPService } from '../../../engine/service/mcpService';

describe('MCPService streamable http tool list', () => {
 it('should fetch tool list from MCP Python server', async () => {
 const mcp = new MCPService('http://127.0.0.1:8000/mcp', 'STREAMABLE_HTTP');
 const result = await Promise.race([
 mcp.listTools(),
 new Promise<{ data: null; error: string }>(resolve => setTimeout(() => resolve({ data: null, error: 'timeout' }), 5000))
 ]);
 const { data, error } = result as { data: any; error: any };
 console.log('Tool list:', data, error);
 console.log('SessionId:', mcp['transport']?.sessionId);
 });
});

Steps to Reproduce

1. Start MCP Python server with the CORS config above (expose_headers tried, but does not help).
2. The SDK makes two requests: the first response from the server includes a valid Mcp-Session-Id header, but the client does not send the sessionId in the header for the second request, causing session management to fail.
3. Same code in Node.js maintains sessionId correctly.

Expected Behavior

• Browser environment should maintain session just like Node.js, with mcp-session-id correctly read and reused, so all requests are in the same session.

Request

• Please confirm if there is a bug in the TypeScript SDK sessionId handling for browsers, or a compatibility issue in the Python SDK server.
• Please provide best practices or a fix for browser session management.

Log Output

Please see the following log output for reference:

1st fetch 200ok
{"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"mcp-client","version":"1.0.0"}},"jsonrpc":"2.0","id":0}
response header
...
mcp-session-id:68709f581d3740ae82a3dcb523f0ac8c
...
request header (dont have mcp-session-id)
2st fetch 400 Bad Request
{"method":"notifications/initialized","jsonrpc":"2.0"}
{
 "jsonrpc": "2.0",
 "id": "server-error",
 "error": {
 "code": -32600,
 "message": "Bad Request: Missing session ID"
 }
}
response header
...
mcp-session-id:44295e965b524e97b45ccf6351201c13
...
request header (dont have mcp-session-id)


nodejs test log out 
Tool list: [ ... ] undefined ([explain,not test log] sucess get toollist,no error)
SessionId: a9911fbfa8fa4eb78dad791b2dddfc33

Python & MCP Python SDK

python 
python version 3.12
mcp 1.9.2

typescript
@modelcontextprotocol/sdk": "^1.13.0
node version v22.17.0

Other information

When both the MCP server and client use the official TypeScript SDK, session management works as expected.

[jcppython]

Question

MCP Server

mcp = FastMCP(...) # stateless_http=False

MCP Server Log

[10/10/25 23:08:09] DEBUG Creating new streamable_http_manager.py:221
 transport 
 INFO Created new streamable_http_manager.py:233
 transport with 
 session ID: 
 d85558545b0c4d73aced 
 98cb9ae016d4 
INFO: 21.90.6.46:33162 - "POST /mcp HTTP/1.1" 400 Bad Request

Client Response

curl -i -X POST "http://xxxx:8000/mcp" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{
 "jsonrpc": "2.0",
 "id": "2",
 "method": "tools/list"
 }'


HTTP/1.1 400 Bad Request
date: Fri, 10 Oct 2025 15:08:08 GMT
server: uvicorn
content-type: application/json
mcp-session-id: d85558545b0c4d73aced98cb9ae016d4
content-length: 105

{"jsonrpc":"2.0","id":"server-error","error":{"code":-32600,"message":"Bad Request: Missing session ID"}}

Debug

Create the new_session_id here and assign it to http_transport Even though the value is assigned above, it is still determined to have a Missing session ID.

I encountered a similar issue when using the Python SDK，It seems we’ve found the issue during debugging—we can double-check it. @pja-ant

[tomasdev]

Not sure if it's the same bug, but a simple MCP Server fails when:

curl -X POST http://localhost:8042/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"method":"notifications/initialized","jsonrpc":"2.0"}'

{"jsonrpc":"2.0","id":"server-error","error":{"code":-32600,"message":"Bad Request: Missing session ID"}}%

The notifications/* endpoints should be exempted from requiring a session ID per the spec https://modelcontextprotocol.io/specification/2025-06-18/basic/index#notifications:

Notifications MUST NOT include an ID.

[maxisbey]

Thanks for the detailed report. I reproduced this and confirmed it's a CORS configuration issue rather than an SDK bug.

Root cause

Your server config sets allow_headers=["*"] but is missing expose_headers. These control two different CORS response headers:

• allow_headers → Access-Control-Allow-Headers — which headers the browser may send in requests
• expose_headers → Access-Control-Expose-Headers — which response headers browser JavaScript may read

Without expose_headers, Mcp-Session-Id is present on the wire (you can see it in DevTools → Network), but response.headers.get("mcp-session-id") returns null because the browser hides non-safelisted headers from JS. The TypeScript SDK then has nothing to echo back on the next request → 400 Missing session ID.

Node.js doesn't enforce CORS, which is why the same code works there.

Fix

app.add_middleware(
 CORSMiddleware,
 allow_origins=["http://localhost:3000"],
 allow_credentials=True,
 allow_methods=["*"],
 allow_headers=["*"],
 expose_headers=["Mcp-Session-Id"], # <-- add this
)

This is documented in the README:

python-sdk/README.md

Lines 1358 to 1382 in e6235d1

	#### CORS Configuration for Browser-Based Clients
	If you'd like your server to be accessible by browser-based MCP clients, you'll need to configure CORS headers. The `Mcp-Session-Id` header must be exposed for browser clients to access it:
	```python
	from starlette.applications import Starlette
	from starlette.middleware.cors import CORSMiddleware
	# Create your Starlette app first
	starlette_app = Starlette(routes=[...])
	# Then wrap it with CORS middleware
	starlette_app = CORSMiddleware(
	starlette_app,
	allow_origins=["*"], # Configure appropriately for production
	allow_methods=["GET", "POST", "DELETE"], # MCP streamable HTTP methods
	expose_headers=["Mcp-Session-Id"],
	)
	```
	This configuration is necessary because:
	- The MCP streamable HTTP transport uses the `Mcp-Session-Id` header for session management
	- Browsers restrict access to response headers unless explicitly exposed via CORS
	- Without this configuration, browser-based clients won't be able to read the session ID from initialization responses

---

Quick note on the two follow-up comments, which describe different (expected) behaviors:

• @jcppython — your curl sends tools/list with no mcp-session-id header and no prior initialize. For stateful servers that's a spec-required 400; you must initialize first and include the returned session ID on all subsequent requests.
• @tomasdev — the spec section you linked refers to the JSON-RPC id field inside the message body (notifications omit it). The HTTP mcp-session-id header is a separate transport-level requirement and applies to all requests after init, including notifications.

Closing as a configuration issue — happy to reopen if the fix above doesn't resolve it.

_{AI Disclaimer}