fix: stateless transport should ignore unmatched cancellations and reject DELETE with 405

server/cancelled_stateless_test.go

@@ -0,0 +1,29 @@
+package server
+
+import (
+	"encoding/json"
+	"io"
+	"testing"
+
+	"github.com/ThinkInAIXYZ/go-mcp/transport"
+)
+
+// A cancellation that cannot be matched to an in-progress request (e.g. in
+// stateless mode, where there is no session to look it up in) is fire-and-forget
+// per the MCP cancellation spec and must be ignored, not answered with an error.
+func TestStatelessCancelledNotificationIgnored(t *testing.T) {
+	reader, _ := io.Pipe()
+	_, writer := io.Pipe()
+
+	s, err := NewServer(transport.NewMockServerTransport(reader, writer))
+	if err != nil {
+		t.Fatalf("NewServer: %v", err)
+	}
+
+	params := json.RawMessage(`{"requestId":"123","reason":"Request timed out"}`)
+
+	// sessionID "" => no session (stateless); must be ignored, returning nil.
+	if err := s.handleNotifyWithCancelled("", params); err != nil {
+		t.Fatalf("stateless cancelled notification: got err %v, want nil (ignored)", err)
+	}
+}

server/handle.go

@@ -300,7 +300,10 @@ func (server *Server) handleNotifyWithCancelled(sessionID string, rawParams json
 
 	s, ok := server.sessionManager.GetSession(sessionID)
 	if !ok {
-		return pkg.ErrLackSession
+		// No session to match the request against (e.g. stateless mode). Per the
+		// cancellation spec a notification referencing an unknown request is
+		// fire-and-forget and must be ignored, not answered with an error.
+		return nil
 	}
 
 	cancel, ok := s.GetClientReqID2cancelFunc().Get(fmt.Sprint(params.RequestID))

transport/streamable_http_server.go

@@ -360,6 +360,11 @@ func (t *streamableHTTPServerTransport) handleGet(w http.ResponseWriter, r *http
 }
 
 func (t *streamableHTTPServerTransport) handleDelete(w http.ResponseWriter, r *http.Request) {
+	if t.stateMode == Stateless {
+		t.writeError(w, http.StatusMethodNotAllowed, "server is stateless, does not support session termination")
+		return
+	}
+
 	sessionID := r.Header.Get("Mcp-Session-Id")
 	if sessionID == "" {
 		t.writeError(w, http.StatusBadRequest, "Missing session ID")

transport/streamable_http_stateless_test.go

@@ -0,0 +1,27 @@
+package transport
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// In stateless mode there are no sessions to terminate, so a DELETE to the MCP
+// endpoint must respond 405 Method Not Allowed (per the Streamable HTTP session
+// management spec), rather than 400 "Missing session ID".
+func TestStatelessDeleteReturnsMethodNotAllowed(t *testing.T) {
+	_, handler, err := NewStreamableHTTPServerTransportAndHandler(
+		WithStreamableHTTPServerTransportAndHandlerOptionStateMode(Stateless),
+	)
+	if err != nil {
+		t.Fatalf("NewStreamableHTTPServerTransportAndHandler: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodDelete, "/mcp", nil)
+	w := httptest.NewRecorder()
+	handler.HandleMCP().ServeHTTP(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("stateless DELETE: got status %d, want %d", w.Code, http.StatusMethodNotAllowed)
+	}
+}