You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
SEP-2567 is merged into the draft spec: protocol-level sessions and the Mcp-Session-Id header are removed from Streamable HTTP, and the list endpoints (tools/list, resources/list, prompts/list) are connection-invariant (see the draft changelog).
The suite has no coverage for it yet: there is no src/seps/sep-2567.yaml, and no scenario exercises the sessionless invariants at the draft revision.
We should add requirement traceability and a draft-suite server scenario, following the sep-2575 pattern (sep-2575.yaml + ServerStatelessScenario).
Related: #222 covers the 2025-11-25 "server MAY omit Mcp-Session-Id" path at the dated spec versions; the draft revision removes sessions outright, so that work is complementary.
Closing this. On reflection the wire-observable substance of SEP-2567 is already covered implicitly: every draft-suite scenario sends sessionless requests, so a server that still required Mcp-Session-Id would fail server-stateless and the rest before any dedicated check ran. The parts a dedicated scenario would add on top are either that same redundancy (accepts-without-session-id) or hard to prove over the wire: list connection-invariance is a "server doesn't vary the list" claim that a two-snapshot probe can only sample, with a real false-positive risk against servers whose lists legitimately change over time, and the backward-compat SHOULDs skip for dual-era servers, which is what most real implementations will be during the transition.
If the traceability dashboard needs SEP-2567 to show as accounted for, an exclusion note pointing at the existing sessionless draft scenarios is a better fit than a scenario whose checks are mostly redundant or heuristic.
Activity
felixweinberger commentedon Jun 18, 2026
Closing this. On reflection the wire-observable substance of SEP-2567 is already covered implicitly: every draft-suite scenario sends sessionless requests, so a server that still required
Mcp-Session-Idwould failserver-statelessand the rest before any dedicated check ran. The parts a dedicated scenario would add on top are either that same redundancy (accepts-without-session-id) or hard to prove over the wire: list connection-invariance is a "server doesn't vary the list" claim that a two-snapshot probe can only sample, with a real false-positive risk against servers whose lists legitimately change over time, and the backward-compat SHOULDs skip for dual-era servers, which is what most real implementations will be during the transition.If the traceability dashboard needs SEP-2567 to show as accounted for, an exclusion note pointing at the existing sessionless draft scenarios is a better fit than a scenario whose checks are mostly redundant or heuristic.