mcp: streamable client keeps the session ID from a rejected server/discover, so the fallback initialize fails

Open
  • Is something wrong?
#1,522 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@simon0191 is already working on this.

Since Nov 13, 2026.

  • #1523 by @simon0191 — open

Assessment

This issue has not been assessed yet.

Description

Checklist
  • I searched the existing issues, and this has not been reported before.
  • This is a real problem that I ran into myself, using the latest release of the SDK.
  • I ran into it in a production system, not in a toy example, a benchmark, or an automated or AI-driven scan of the code.
  • I (a human) examined the relevant SDK code, and wrote or reviewed every line of this report. It is not unreviewed AI output.
  • This report is brief and concise, and sticks to the facts needed to understand the problem.
What happened?

Client.Connect over StreamableClientTransport fails with mismatching session IDs against a legacy (2025-06-18) server that answers server/discover with HTTP 200, a JSON-RPC -32601 error, and an Mcp-Session-Id header.

streamableClientConn.Write stores the session ID from the rejected discover response. The fallback initialize is then sent with that ID, the server assigns a new one, and the session-ID check in streamable.go fails. Servers that reject server/discover with HTTP 400 are not affected, because checkResponse returns before the header is read.

Expected: the fallback initialize is sent without a session ID, and the session uses the ID returned with the InitializeResult. Under 2025-11-25 a session ID is assigned "on the HTTP response containing the InitializeResult", and 2026-07-28 has no sessions, so a session ID on a server/discover response should not be kept.

How to reproduce
// The server sets Mcp-Session-Id: discover-session on its -32601 reply to server/discover,
// and Mcp-Session-Id: initialize-session on its reply to initialize.
cs, err := mcp.NewClient(impl, nil).Connect(ctx, &mcp.StreamableClientTransport{Endpoint: url}, nil)
// err: mismatching session IDs "discover-session" and "initialize-session"
Where did you hit this?

An MCP gateway that uses go-sdk to list and call tools on third-party remote MCP servers.

Go MCP SDK version

v1.8.0 (also on main at 328036e)

Go version

go1.26

Proposed fix

Skip storing the session ID when the request is server/discover. I have a one-line change with a table test covering the 200/-32601 case and the existing HTTP 400 rejection shapes, and I'm happy to send it if this is assigned to me.

AI disclosure: I used Claude Code to trace the code and draft this report, and I reviewed it.

Dominant language
Go
Stars
5.3k
Forks
614
Avg merge
23h 55m
Merged PRs (30d)
62

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/go-sdk

All issues in modelcontextprotocol/go-sdk

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.