Streamable HTTP: header Mcp-Session-Id is not set for "notifications/initialized" request

[ashakirin]

Inspector Version

• 0.17.2

Describe the bug
Connect to MCP server supported Streamable HTTP transport.

1. MCP Inspector sends initialization request { "method": "initialize", "params": { "protocolVersion": "2025-06-18", "capabilities": { "sampling": {}, "elicitation": {}, "roots": { "listChanged": true } }, "clientInfo": { "name": "inspector-client", "version": "0.17.2" } }, "jsonrpc": "2.0", "id": 0 }

2. MCP Server responds with capabilities and sends Mcp-Session-Id in header:
   mcp-session-id d29151a7-b085-4e5d-b08e-258dde3c4ffa
{ "jsonrpc": "2.0", "id": 0, "result": { "protocolVersion": "2025-06-18", "capabilities": { "completions": {}, "logging": {}, "prompts": { "listChanged": true }, "resources": { "subscribe": false, "listChanged": true }, "tools": { "listChanged": true } }, "serverInfo": { "name": "mcp-server-weather-streamable", "version": "1.0.0" } } }
3. Because of some reason, MCP Inspector doesn't send the Mcp-Session-Id header in next request, for initialize notifications:
   accept application/json, text/event-stream accept-encoding gzip, deflate, br, zstd accept-language en-US,en;q=0.9,de-DE;q=0.8,de;q=0.7,ru-RU;q=0.6,ru;q=0.5 authorization Bearer XXX connection keep-alive content-length 54 content-type application/json host localhost:8090 mcp-protocol-version 2025-06-18 origin http://localhost:6274 referer http://localhost:6274/ sec-ch-ua "Google Chrome";v="141", "Not?A_Brand";v="8", "Chromium";v="141" sec-ch-ua-mobile ?0 sec-ch-ua-platform "macOS" sec-fetch-dest empty sec-fetch-mode cors sec-fetch-site same-site user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36

{method: "notifications/initialized", jsonrpc: "2.0"} jsonrpc : "2.0" method : "notifications/initialized"

To Reproduce

1. Configure MCP Server supporting stateful Streamable MCP communication
2. Click on connect
3. See error:
   Connection Error - Check if your MCP server is running and proxy token is correct

Expected behavior
Send Mcp-Session-Id header in all requests after initialization, like spec requires:
If an Mcp-Session-Id is returned by the server during initialization, clients using the Streamable HTTP transport MUST include it in the Mcp-Session-Id header on all of their subsequent HTTP requests.

• OS: Mac OS
• Browser Chrome

[zhaoyao]

I also encounter this issue. The server is implemented using spring-ai 1.1.0-RC1.

spring:
  ai:
    mcp:
      server:
        type: ASYNC
        protocol: STREAMABLE
        streamable-http:
          mcp-endpoint: /mcp

[jvanhill]

Yep... I hit this issue as well. A quick look in the code appears to confirm the inspector will save the session ID away, but doesn't use it on any future requests.

I would also expect that disconnect would issue a request to delete the session.

[bseddon]

In the hope this adds another clue, I'm seeing the same issue when the MCP server is remote. Same inspector session, same server code but run on localhost (same as the inspector) and the inspector does include the session id in requests so it works. This means in my situation there appears to be a problem when the inspector and the server are not on the same address.

[DocX]

I had the same issue, but then figured out my server was missing CORS header. Adding

Access-Control-Expose-Headers: Mcp-Session-Id

Made it work in mcp-inspector.

[bseddon]

Great observation, thanks. Yes, it works when the header is added.

[embesozzi]

Same error in v0.18.0
I can see the mcp-session-id response header returned from the initial POST request when initializing the connection:

{"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{"sampling":{},"elicitation":{},"roots":{"listChanged":true}},"clientInfo":{"name":"inspector-client","version":"0.18.0"}},"jsonrpc":"2.0","id":0}

However, the MCP Inspector does not send the mcp-session-id header when posting:

{"method":"notifications/initialized","jsonrpc":"2.0"}

As a result, the MCP server returns a 400 error with the message "Session ID missing".