A client-supplied Mcp-Session-Id is ignored, not required

How to fix this

Ignore an `Mcp-Session-Id` that a client sends. Do not require it and do not reject the request over it — older clients will keep sending it, and refusing them is its own violation.

How the validator checks this

Probe P5.3, against a streamable-http server on the modern protocol. What it reports:

pass

A client-supplied Mcp-Session-Id was ignored rather than rejected

fail

Rejected a request carrying Mcp-Session-Id (HTTP …). The spec says ignore it — refusing is a different violation, and older clients will keep sending it.

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-STL-001.

Check your own server against this rule

The validator makes real protocol requests and reports this rule as pass, warn or fail alongside the other 78. Validate a server or read how the check works.

Other Statelessness and session removal rules

• MCP-STL-001Server never mints or echoes Mcp-Session-Id
• MCP-STL-003A cold modern request succeeds with no prior handshake
• MCP-STL-004Server does not rely on prior requests over the same connection
• MCP-STL-005GET on the MCP endpoint returns 405
• MCP-STL-006DELETE on the MCP endpoint returns 405
• MCP-STL-007Last-Event-ID is ignored — streams are not resumable
• MCP-STL-008tools/list does not vary per connection