feat: add SEP-2567 (sessionless Streamable HTTP) requirement traceability and server scenario#333
Open
felixweinberger wants to merge 2 commits into
Open
feat: add SEP-2567 (sessionless Streamable HTTP) requirement traceability and server scenario#333felixweinberger wants to merge 2 commits into
felixweinberger wants to merge 2 commits into
Conversation
Map SEP-2567 (remove protocol-level sessions from Streamable HTTP) to conformance requirements: the no-session-required invariant, list-endpoint connection invariance for tools/resources/prompts, and the backward-compatibility handling of legacy session-era traffic. Requirements that are not observable from a black-box harness (request-id reuse scoping, the reworded authorization sentence, the superseded SSE event-id rule) are documented as excluded with reasons.
Add a draft-suite server scenario covering sessionless Streamable HTTP operation: - a request without an Mcp-Session-Id header is served normally - tools/list, resources/list and prompts/list return the same set across independent connections, with unrelated requests interleaved between snapshots (paginated lists are accumulated before comparing) - a server that supports only the draft revision handles legacy session-era traffic per the backward-compatibility section: 405 for GET/DELETE, ignore Mcp-Session-Id without minting or echoing session IDs, ignore Last-Event-ID The backward-compatibility SHOULDs are scoped to servers that support only the draft revision, so the scenario probes with a legacy-shaped initialize request first and reports SKIPPED for dual-era servers (the everything-server is one). Negative tests drive the scenario against mocked non-conformant servers and assert each check fires with the right severity (FAILURE for MUST rows, WARNING for SHOULD rows).
commit: |
Collaborator
Author
|
Short version of what this conformance test checks:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds requirement traceability and a draft-suite server scenario for
SEP-2567 (sessionless Streamable HTTP), following the sep-2575 pattern.
Motivation and Context
Closes #332.
SEP-2567 is merged into the draft spec: it removes protocol-level sessions
and the
Mcp-Session-Idheader from the Streamable HTTP transport, andmakes the list endpoints (
tools/list,resources/list,prompts/list)connection-invariant (see the draft changelog).
The conformance suite has no coverage for it yet — there is no
src/seps/sep-2567.yamland no scenario exercises the sessionlessinvariants at the draft spec version.
This PR adds both, mirroring how SEP-2575 is covered (
sep-2575.yaml+ServerStatelessScenario).src/seps/sep-2567.yaml— 7 check rows, 3 excluded rowsChecks:
sep-2567-server-accepts-requests-without-session-id— sessions areremoved at the draft revision; a request without
Mcp-Session-Idisserved normally. (Anchored to the changelog entry — the removal has no
keyworded sentence by construction.)
sep-2567-{tools,resources,prompts}-list-connection-invariant— thelist "MUST NOT vary per-connection or as a side effect of other requests
on the connection" (server/tools, server/resources, server/prompts
#capabilities).sep-2567-server-rejects-get-and-delete,sep-2567-server-ignores-session-id,sep-2567-server-ignores-last-event-id— the SHOULDs fromEarlier Streamable HTTP Revisions
for servers that support only the draft revision.
Excluded (with reasons in the yaml):
basic/index#requests) — not observable froma black-box harness; the harness cannot compel the implementation under
test to issue two concurrent requests with colliding IDs.
"same logical session" clause); the obligation predates the SEP and is
exercised by the authorization scenarios.
publication; the draft later removed SSE resumability entirely, so the
sentence no longer appears in the spec.
ServerSessionlessScenario(--suite draft,server-sessionless)One scenario, seven checks, registered like the other draft scenarios via
source.introducedIn = DRAFT_PROTOCOL_VERSION. Built on the existingsendStatelessRequest()connection helper.The three backward-compatibility SHOULDs are scoped by the spec to "a
server that supports only this revision". The scenario probes with a
legacy-shaped
initializerequest first; dual-era servers (theeverything-server is one) report SKIPPED for those three checks, per the
spec's instruction that dual-era servers implement the legacy revision's
behavior instead.
List invariance is checked by taking two paginated snapshots of each
declared list endpoint on independent connections, with unrelated requests
interleaved, and comparing the identifier sets. (Per-connection state is
not directly addressable from a black-box harness; every harness request
already arrives on an independent connection — same model as the
sep-2575.yaml exclusions.)
How Has This Been Tested?
npm test— 278/278 passing, includingall-scenarios.test.ts, whichruns
server-sessionlessagainst the everything-server (4 SUCCESS,3 SKIPPED via the dual-era probe; no FAILURE).
src/scenarios/server/sessionless.test.tsdrivethe scenario against mocked non-conformant servers and assert each check
fires with the right severity (FAILURE for MUST rows, WARNING for SHOULD
rows), plus the SKIPPED paths (undeclared capabilities, dual-era).
npm run build,npm run typecheck,npm run lintall pass.src/seps/traceability.jsonis not regenerated here; the traceabilityworkflow refreshes it via PR.
Breaking Changes
None. The scenario is draft-suite only (
--suite draft/--suite all);the default
activesuite is unchanged.Types of changes
Checklist
Additional context
Severity follows the spec keyword per AGENTS.md (MUST → FAILURE, SHOULD →
WARNING). Requirement texts were verified against SEP-2567's spec diff
(
modelcontextprotocol/modelcontextprotocol#2567) and the current draftpages; the three backcompat SHOULDs come from the draft's
"Earlier Streamable HTTP Revisions" section, which is the live normative
expression of the sessionless model for legacy traffic.
Related prior art: #222 covers the 2025-11-25 "server MAY omit
Mcp-Session-Id" path at the dated spec versions; this PR covers the draft
revision where sessions are removed outright, so the two are complementary.