mcp: streamable client keeps the session ID from a rejected server/discover, so the fallback initialize fails
维护者通常 1 天内回复
评估
这个 Issue 还没有评估数据。
描述
Checklist
- I searched the existing issues, and this has not been reported before.
- This is a real problem that I ran into myself, using the latest release of the SDK.
- I ran into it in a production system, not in a toy example, a benchmark, or an automated or AI-driven scan of the code.
- I (a human) examined the relevant SDK code, and wrote or reviewed every line of this report. It is not unreviewed AI output.
- This report is brief and concise, and sticks to the facts needed to understand the problem.
What happened?
Client.Connect over StreamableClientTransport fails with mismatching session IDs against a legacy (2025-06-18) server that answers server/discover with HTTP 200, a JSON-RPC -32601 error, and an Mcp-Session-Id header.
streamableClientConn.Write stores the session ID from the rejected discover response. The fallback initialize is then sent with that ID, the server assigns a new one, and the session-ID check in streamable.go fails. Servers that reject server/discover with HTTP 400 are not affected, because checkResponse returns before the header is read.
Expected: the fallback initialize is sent without a session ID, and the session uses the ID returned with the InitializeResult. Under 2025-11-25 a session ID is assigned "on the HTTP response containing the InitializeResult", and 2026-07-28 has no sessions, so a session ID on a server/discover response should not be kept.
How to reproduce
// The server sets Mcp-Session-Id: discover-session on its -32601 reply to server/discover,
// and Mcp-Session-Id: initialize-session on its reply to initialize.
cs, err := mcp.NewClient(impl, nil).Connect(ctx, &mcp.StreamableClientTransport{Endpoint: url}, nil)
// err: mismatching session IDs "discover-session" and "initialize-session"
Where did you hit this?
An MCP gateway that uses go-sdk to list and call tools on third-party remote MCP servers.
Go MCP SDK version
v1.8.0 (also on main at 328036e)
Go version
go1.26
Proposed fix
Skip storing the session ID when the request is server/discover. I have a one-line change with a table test covering the 200/-32601 case and the existing HTTP 400 rejection shapes, and I'm happy to send it if this is assigned to me.
AI disclosure: I used Claude Code to trace the code and draft this report, and I reviewed it.
- 主要语言
- Go
- 星标
- 5.3k
- 派生
- 614
- 平均合并
- 23 小时 55 分钟
- 30 天内合并 PR
- 62
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
modelcontextprotocol/go-sdk 的其他 Issue
-
mcp: typed tool handlers lose wrapped JSON-RPC errors可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 2/5 1-3 小时 新手友好度 85/100
modelcontextprotocol/go-sdk#1529 · 1 条评论 ·
维护者通常 1 天内回复
-
Expose generic `SendNotification` on `ServerSession` for custom protocol extensions可能重新可做 关联的 PR 已关闭且未合并。 未关闭needs investigation
难度 2/5 1-3 小时 新手友好度 72/100
modelcontextprotocol/go-sdk#745 · 13 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
mcp: ClientSession.ReadResource keeps uncacheable and expired results until the session ends可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 3/5 1-2 天 新手友好度 74/100
modelcontextprotocol/go-sdk#1526 ·
维护者通常 1 天内回复
-
auth: OAuth client rejects protected resource metadata when the MCP server URL has a query string可能已有人在做 @beiryu 于 2 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 74/100
modelcontextprotocol/go-sdk#1519 · 2 条评论 ·
维护者通常 1 天内回复
-
`ping` and `logging/setLevel` still sent for protocol 2026-07-28可能已有人在做 @nahapetyan-serob 于 1 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 65/100
modelcontextprotocol/go-sdk#1518 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
查看 modelcontextprotocol/go-sdk 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 62/100
-
evener-transcript-v2-upgrade tool still scans transcript files through bufio's 4 KiB default buffer未关闭
难度 1/5 1 小时以内 新手友好度 78/100
prime-radiant-inc/evener#6370 ·
维护者通常 1 天内回复
-
ManageSieve proxy: a backend's NO/BYE greeting is skipped as a capability line and reported as EOF未关闭bug
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 65/100
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 62/100
ManageIQ/manageiq-pods#1476 ·
维护者通常 1 天内回复