A server that implements only revision 2026-07-28 receives traffic from an older client: HTTP GET and DELETE requests to its MCP endpoint, and POSTs carrying Mcp-Session-Id and Last-Event-ID headers. How should the server respond?
Select an answer to reveal the explanation.
Short Explanation
Your modern server just says that door's closed for GET and DELETE, and shrugs at the old session and resume headers. The trap is playing along with session features that this revision doesn't have.
Full Explanation
Earlier Streamable HTTP revisions let servers assign sessions through Mcp-Session-Id, terminated with HTTP DELETE, let clients open a standalone SSE stream with GET, and allowed resumption through Last-Event-ID. None of these mechanisms exist in revision 2026-07-28. The transport's backward-compatibility guidance says a server supporting only this revision should answer HTTP GET or DELETE to the MCP endpoint with 405 Method Not Allowed, ignore an Mcp-Session-Id header without minting or echoing session IDs, and ignore Last-Event-ID because streams are not resumable. Opening a notification stream on GET restores the removed GET endpoint; modern change notifications flow on the response stream of a subscriptions/listen POST. Echoing the session ID implies a session the server does not keep. Answering 404 is wrong because the endpoint exists and only the method is unsupported, and 404 has a distinct meaning in era detection. Rejecting POSTs that merely carry a session header is unnecessary when the guidance is to ignore it. DELETE has no session to end, and the server cannot replay events it never stored. Exam caveat: a dual-era server that also serves legacy clients would implement the older behaviour for them. Operational check: send GET and DELETE to the endpoint and confirm both return 405.