MCP010 — The removed HTTP GET stream endpoint is still served
| Severity | error |
| Fixed by | Upgrading your MCP SDK to a release targeting 2026-07-28 |
| Transports | http |
| Specification | 2026-07-28 |
| Changelog entry | Major change 4 (SEP-2575) |
Why this changed
The GET half of Streamable HTTP — the always-open server-to-client stream —
was replaced by subscriptions/listen. A GET endpoint still answering with
an event stream means the old notification path is live, and clients that no
longer open it will silently miss everything sent down it.
Running just this check
npx mcp-stateless --http https://mcp.example.com/mcp --only MCP010Suppressing it
If this check does not apply to your server, skip it:
npx mcp-stateless --http https://mcp.example.com/mcp --skip MCP010Rule ids are permanent and are never reissued, so a suppression cannot start silently matching a different check later.
Generated from src/rules/MCP010.ts by
scripts/gen-rule-docs.mjs. Edit the rule source, not this page.