Implement SEP-2567: Sessionless MCP via Explicit State Handles

[felixweinberger]

This is a tracking issue for implementation of SEP-2567.

[mattzcarey]

Status — SEP-2567 (Sessionless MCP via Explicit State Handles)

Track: A (core) — tangled with SEP-2575 (#2184); the spec page calls these "the only genuinely tangled group — one without the other is half a model." Ships together.
Spec: seps/2567-sessionless-mcp.md · merged spec#2567 2026-05-07

What's done

• Nothing in main yet.
• Closed exploration: feat(core): deprecate sessionId on base Transport/BaseContext; legacySessionId() helper (SEP-2567) #2060 (Transport.sessionId / BaseContext.sessionId → optional + @deprecated, legacySessionId(t) helper, LegacySessionTransport type). The "session is a transport-specific concern, not a base-protocol one" framing carries forward into the v2-stateless stack.

Open PR stack (same as #2184, v2-stateless label)

See #2184 for the full chain. Sessionless wire behavior is implemented across #2131 (StreamableHTTP) and #2132 (stdio + InMemory).

Outstanding (acceptance criteria, summary)

• Mcp-Session-Id header removed from base transport interface (kept on concrete SHTTP transport as legacy-only)
• List endpoints (tools/list, resources/list, prompts/list) MUST NOT depend on per-connection or prior-call state
• List results MUST NOT change as a side effect of other requests on the same connection
• JSON-RPC id unique per outstanding request (not per session)
• Server MUST NOT require same-connection reuse — two requests over two connections succeed identically
• subscriptions/listen opt-in model with io.modelcontextprotocol/subscriptionId correlation
• Server MUST NOT infer capabilities from prior requests (per-message _meta, see Implement SEP-2575: Make MCP Stateless #2184)
• Roots fetched via MRTR ListRootsRequest, not push (overlap with Implement SEP-2322: Multi Round-Trip Requests #2187)
• Cancellation semantics: HTTP SSE-stream close treated as cancel; stdio uses notifications/cancelled

Test backlog

• [DRAFT] test(e2e): 2026-06 spec backlog — SEP-2260 + SEP-2575/2567 as expected-fail stubs #2180 (DRAFT) — paired with 2575 in the e2e known-failure stub matrix.

Cross-cutting

SEP-2567 is what makes Track B's sessionless HTTP / subscriptions slice possible. Track B can build the transport-shape contract against the agreed seam before #2131/#2132 merge.

Dupes

#2182 is a duplicate of this issue — should be closed.