MCP-STL-005

GET on the MCP endpoint returns 405

“HTTP GET or DELETE to the MCP endpoint: respond with 405 Method Not Allowed.” — spec anchor

How to fix this

Respond to an HTTP GET on the MCP endpoint with 405 Method Not Allowed.

Example: failing and passing

The server accepts a GET on the MCP endpoint and opens an event stream, which this revision removed.

Violates MCP-STL-005 · HTTP

GET /mcp HTTP/1.1
Host: mcp.example.com
Accept: application/json, text/event-stream

HTTP/1.1 200 OK
Content-Type: text/event-stream

The server answers a GET on the MCP endpoint with 405 Method Not Allowed.

Complies with MCP-STL-005 · HTTP

GET /mcp HTTP/1.1
Host: mcp.example.com
Accept: application/json, text/event-stream

HTTP/1.1 405 Method Not Allowed
Allow: POST

Check your own server against MCP-STL-005

Probe P5.1 checks MCP-STL-005 in the same request as 1 other rule, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: statelessness and Mcp-Session-Id explained.

Other Statelessness and session removal rules

MCP-STL-001Server never mints or echoes Mcp-Session-Id
MCP-STL-002A client-supplied Mcp-Session-Id is ignored, not required
MCP-STL-003A cold modern request succeeds with no prior handshake
MCP-STL-004Server does not rely on prior requests over the same connection
MCP-STL-006DELETE on the MCP endpoint returns 405
MCP-STL-007Last-Event-ID is ignored — streams are not resumable
MCP-STL-008tools/list does not vary per connection