') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(examples): return 404 for unknown session IDs, 400 for missing by felixweinberger · Pull Request #1770 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content

fix(examples): return 404 for unknown session IDs, 400 for missing - #1770

Merged
felixweinberger merged 4 commits into
mainfrom
fweinberger/session-404-fix
Mar 30, 2026
Merged

fix(examples): return 404 for unknown session IDs, 400 for missing#1770
felixweinberger merged 4 commits into
mainfrom
fweinberger/session-404-fix

Conversation

@felixweinberger

@felixweinbergerfelixweinberger commented Mar 26, 2026

Copy link
Copy Markdown
Contributor

Splits the session ID check in example servers so unknown session IDs return 404 (signaling clients to start a new session) while missing session IDs return 400.

Motivation and Context

Per spec, clients interpret 404 on a request with Mcp-Session-Id as "start a new session." The examples were returning 400 for both cases, breaking client recovery logic. Issue was reported by the VS Code team.

Fixes#389

How Has This Been Tested?

pnpm check:all passes. Covers all example servers plus conformance test servers.

Breaking Changes

None — examples only.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

Supersedes #1331, #1560, #1678, #1707 — thanks @lraveri and @owendevereaux for the earlier work. This consolidates on a tighter diff and covers authTestServer.ts and jsonResponseStreamableHttp.ts which the previous PRs missed.

@felixweinberger
fix(examples): return 404 for unknown session IDs, 400 for missing
15e5b36
Per spec, clients interpret 404 as "start a new session" — the examples
were returning 400 for both missing and unknown session IDs, which breaks
client recovery logic. Split the check so unknown IDs return 404.
Fixes#389
@felixweinberger
felixweinberger requested a review from a team as a code ownerMarch 26, 2026 17:14
@changeset-bot

changeset-botBot commented Mar 26, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: c61edba

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

This was referenced Mar 26, 2026
Closed
Closed
Closed
Closed
@pkg-pr-new

pkg-pr-newBot commented Mar 26, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1770

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1770

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1770

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1770

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1770

commit: c61edba

claude[bot]
claudeBot reviewed Mar 26, 2026
View reviewed changes

@claudeclaudeBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, straightforward mechanical split of session ID checks across example and conformance test servers.

Extended reasoning...

Overview

This PR modifies 7 example server files and 2 conformance test server files to split the combined session ID check into two separate branches: 400 for missing session ID, 404 for unknown session ID.

Security risks

None. Changes are in example and test servers only.

Level of scrutiny

Low. Mechanical, repetitive change to example and test code, not library code.

Other factors

Consolidates 4 previous PRs. Pattern is consistent across all files. No bugs found.

@bhosmer-ant
bhosmer-ant self-requested a review March 30, 2026 17:24
bhosmer-ant
bhosmer-ant approved these changes Mar 30, 2026
View reviewed changes

@bhosmer-antbhosmer-ant left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct HTTP semantics — splitting the conflated !sessionId || !transports[sessionId] check into 400 (missing header = client error) vs 404 (session not found = resource gone, could be expiry/restart). Pattern applied consistently across all 8 example/test servers. LGTM.

@felixweinberger
felixweinberger enabled auto-merge (squash) March 30, 2026 20:58
@felixweinberger
felixweinberger merged commit 8822c96 into mainMar 30, 2026
16 checks passed
@felixweinberger
felixweinberger deleted the fweinberger/session-404-fix branch March 30, 2026 21:00
@claudeclaudeBot mentioned this pull request Jun 18, 2026
Merged
9 tasks
@claudeclaudeBot mentioned this pull request Jun 30, 2026
Merged
9 tasks
@claudeclaudeBot mentioned this pull request Aug 17, 2026
Merged
9 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claudeclaude[bot]claude[bot] left review comments
@bhosmer-antbhosmer-antbhosmer-ant approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Streamable HTTP examples use incorrect status code for invalid session IDs

2 participants

@felixweinberger@bhosmer-ant