Source record · tier 1 standards and regulators

Model Context Protocol specification 2026-07-28, Streamable HTTP

Publisher: Model Context Protocol project
URL: https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http
Published: 2026-07-28
Updated: unknown
Accessed: 2026-09-05
HTTP status: 200
License: MIT license; permitted under the specification license

Source notes citing this source

On Streamable HTTP, a client that supports both modern and legacy MCP versions MAY detect the server's era by attempting a modern request first; on 400 Bad Request it SHOULD inspect the response body and fall back to initialize only if the body is empty or is not a recognized modern JSON-RPC error. in context
A Streamable HTTP client written for MCP revisions 2025-03-26 through 2025-11-25 that drops and later resumes a response stream would, against a 2026-07-28-only server, have its in-flight request cancelled rather than preserved, because the newer revision treats stream closure as cancellation and ignores Last-Event-ID. inferred in context
In Streamable HTTP the client MUST include an Accept header listing both application/json and text/event-stream on each POST. in context
In Streamable HTTP under MCP revision 2026-07-28, the server MUST treat the closing of a request's SSE response stream as cancellation of that request; no notifications/cancelled message is required or expected. in context
In Streamable HTTP under MCP revision 2026-07-28, a server that processes the request body MUST reject a request whose mirrored header values are missing, malformed or do not match the body, returning HTTP 400 Bad Request with JSON-RPC error code -32020 (HeaderMismatch). in context
A Streamable HTTP server that supports only MCP revision 2026-07-28 SHOULD respond to an HTTP GET or DELETE on the MCP endpoint with 405 Method Not Allowed, SHOULD ignore an Mcp-Session-Id header without minting or echoing session IDs, and SHOULD ignore a Last-Event-ID header. in context
In Streamable HTTP under MCP revision 2026-07-28, long-lived change notifications are delivered on the SSE response stream of a subscriptions/listen POST, while request-scoped notifications such as notifications/progress and notifications/message flow only on the response stream of the request they relate to. in context
In Streamable HTTP under MCP revision 2026-07-28, servers running locally SHOULD bind only to localhost (127.0.0.1) rather than all interfaces, and servers SHOULD implement proper authentication for all connections. in context
In Streamable HTTP under MCP revision 2026-07-28, a server that does not implement the requested RPC method MUST respond with 404 Not Found and a JSON-RPC error with code -32601, and a server that does not implement the requested protocol version MUST respond with 400 Bad Request and an UnsupportedProtocolVersionError listing its supported versions. in context
MCP revision 2026-07-28 defines no client-to-server notifications over Streamable HTTP: the only client-sent core notification, notifications/cancelled, is used only on stdio, and header requirements for notification POSTs are not defined by the revision. in context
In Streamable HTTP under MCP revision 2026-07-28 the server MUST NOT send independent JSON-RPC requests on an SSE response stream; notifications on that stream MUST relate to the originating client request, and the final JSON-RPC response SHOULD terminate the stream. in context
In Streamable HTTP under MCP revision 2026-07-28, when the POST body is a JSON-RPC notification that the server accepts, the server MUST return HTTP 202 Accepted with no body. in context
In Streamable HTTP under MCP revision 2026-07-28, servers MUST validate the Origin header on all incoming connections and MUST respond with HTTP 403 Forbidden when an Origin header is present and invalid. in context
In Streamable HTTP under MCP revision 2026-07-28, when the POST body is a JSON-RPC request the server MUST return either Content-Type application/json with a single JSON object or Content-Type text/event-stream with an SSE response stream, and the client MUST support both. in context
In Streamable HTTP under MCP revision 2026-07-28 the server MUST provide a single MCP endpoint path that supports POST, and every JSON-RPC message sent by the client MUST be a new HTTP POST to that endpoint. in context
Under MCP revision 2026-07-28, a client that wants to support older HTTP+SSE servers POSTs a request to the server URL and, if it fails with 400, 404 or 405 and the response body is not a recognized modern JSON-RPC error, issues a GET expecting an SSE stream whose first event is an endpoint event, after which it uses the old transport. in context
In Streamable HTTP under MCP revision 2026-07-28, servers SHOULD include the X-Accel-Buffering: no response header when initiating an SSE stream, and are encouraged (non-normatively) to emit periodic SSE comment lines as keep-alives on long-lived streams such as the subscriptions/listen response. in context
In Streamable HTTP under MCP revision 2026-07-28, the Mcp-Method header (mirroring method) is required on all requests and the Mcp-Name header (mirroring params.name or params.uri) is required on tools/call, resources/read and prompts/get requests. in context
In Streamable HTTP under MCP revision 2026-07-28, every POST to the MCP endpoint MUST include an MCP-Protocol-Version header whose value MUST match the io.modelcontextprotocol/protocolVersion field in the request body's _meta; on mismatch the server MUST reject with 400 Bad Request and a HeaderMismatch JSON-RPC error. in context
The MCP-Protocol-Version HTTP header was not defined by protocol versions earlier than 2025-06-18; under revision 2026-07-28 a server that supports such clients MAY treat a request omitting the header as protocol version 2025-03-26, and a server that does not support them MUST reject the request. in context
In MCP revision 2026-07-28, clients using Streamable HTTP MUST support x-mcp-header annotations, mirroring designated tool parameter values into Mcp-Param-{name} headers and excluding from tools/list results any tool whose annotation violates the constraints, whereas clients using other transports such as stdio MAY ignore x-mcp-header annotations entirely. in context
Resumable server-sent event streams via the Last-Event-ID header are not supported in the 2026-07-28 revision. in context
Client reconnection after a dropped stream is graded MAY and the specification publishes no backoff schedule no retry cap and no way to learn what was missed. in context

Cite this source record

APA

WarmTransfer. (2026, July 28). Model Context Protocol specification 2026-07-28, Streamable HTTP. WarmTransfer. https://warmtransfer.net/knowledge/sources/mcp-spec-2026-07-28-streamable-http

BibTeX

@misc{warmtransfer-mcp-spec-2026-07-28-streamable-http,
  title  = {Model Context Protocol specification 2026-07-28, Streamable HTTP},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/mcp-spec-2026-07-28-streamable-http},
  note   = {Model Context Protocol project, accessed 2026-09-05}
}