Skip to content
MCP Stateless Check

MCP003 — Server still uses the removed Mcp-Session-Id header
Severity error
Fixed by Upgrading your MCP SDK to a release targeting 2026-07-28
Transports http
Specification 2026-07-28
Changelog entry Major change 1 (SEP-2567)

Why this changed

Protocol-level sessions are gone, and with them Mcp-Session-Id. A server still minting the header is carrying cross-call state that 2026-07-28 clients will not echo back, so that state silently stops working.

Running just this check

Terminal window
npx mcp-stateless --http https://mcp.example.com/mcp --only MCP003

Suppressing it

If this check does not apply to your server, skip it:

Terminal window
npx mcp-stateless --http https://mcp.example.com/mcp --skip MCP003

Rule ids are permanent and are never reissued, so a suppression cannot start silently matching a different check later.

Generated from src/rules/MCP003.ts by scripts/gen-rule-docs.mjs. Edit the rule source, not this page.