Implement SEP-2567: Sessionless MCP via Explicit State Handles

[felixweinberger]

This is a tracking issue for implementation of SEP-2567.

[mattzcarey]

Status — SEP-2567 (Sessionless MCP via Explicit State Handles)

Track: A (core) — tangled with SEP-2575 (#2184); the spec page calls these "the only genuinely tangled group — one without the other is half a model." Ships together.
Spec: seps/2567-sessionless-mcp.md · merged spec#2567 2026-05-07

What's done

• Nothing in main yet.
• Closed exploration: feat(core): deprecate sessionId on base Transport/BaseContext; legacySessionId() helper (SEP-2567) #2060 (Transport.sessionId / BaseContext.sessionId → optional + @deprecated, legacySessionId(t) helper, LegacySessionTransport type). The "session is a transport-specific concern, not a base-protocol one" framing carries forward into the v2-stateless stack.

Open PR stack (same as #2184, v2-stateless label)

See #2184 for the full chain. Sessionless wire behavior is implemented across #2131 (StreamableHTTP) and #2132 (stdio + InMemory).

Outstanding (acceptance criteria, summary)

• Mcp-Session-Id header removed from base transport interface (kept on concrete SHTTP transport as legacy-only)
• List endpoints (tools/list, resources/list, prompts/list) MUST NOT depend on per-connection or prior-call state
• List results MUST NOT change as a side effect of other requests on the same connection
• JSON-RPC id unique per outstanding request (not per session)
• Server MUST NOT require same-connection reuse — two requests over two connections succeed identically
• subscriptions/listen opt-in model with io.modelcontextprotocol/subscriptionId correlation
• Server MUST NOT infer capabilities from prior requests (per-message _meta, see Implement SEP-2575: Make MCP Stateless #2184)
• Roots fetched via MRTR ListRootsRequest, not push (overlap with Implement SEP-2322: Multi Round-Trip Requests #2187)
• Cancellation semantics: HTTP SSE-stream close treated as cancel; stdio uses notifications/cancelled

Test backlog

• [DRAFT] test(e2e): 2026-06 spec backlog — SEP-2260 + SEP-2575/2567 as expected-fail stubs #2180 (DRAFT) — paired with 2575 in the e2e known-failure stub matrix.

Cross-cutting

SEP-2567 is what makes Track B's sessionless HTTP / subscriptions slice possible. Track B can build the transport-shape contract against the agreed seam before #2131/#2132 merge.

Dupes

#2182 is a duplicate of this issue — should be closed.

[norika1207-lab]

This looks worth pinning down as a protocol-level regression rather than only an implementation bug.

For Sessionless MCP via explicit state handles, the acceptance test I would want is a minimal client/server fixture that records the exact JSON-RPC or HTTP exchange, then asserts both the wire result and the local lifecycle state after the failure path. In MCP deployments, the dangerous failures are often not just wrong return values; they are pending requests, dropped notifications, mismatched session state, or errors that get translated into a generic response and become impossible to diagnose.

A useful fix boundary would preserve three signals: the protocol error sent to the peer, the local exception or cancellation reason available to application code, and a trace/log field that ties the two together. That makes the behavior debuggable for agent hosts without requiring every host to special-case this SDK detail.