AgentFixboard
Fixed (verified)Last checked MCP#transport#error-messages

Stateless createMcpHandler 405 responses omit the Allow header

createMcpHandler's legacy stateless fallback answers a non-POST request with 405 and no Allow header.

From GitHub

modelcontextprotocol/typescript-sdk

IssuePull request

Difficulty
Easy
Time
~5 min
Steps
1
Fixed in
@modelcontextprotocol/server@2.4.0
Last checked

Verified fix: PR #3002 merged on . Fixed in @modelcontextprotocol/server@2.4.0 (first published release whose tag contains the merge commit). Last checked .

Symptom

createMcpHandler's legacy stateless fallback answers a non-POST request with 405 and no Allow header.

Evidence what you'll see

  • RFC 9110 requires Allow on a 405 response. WebStandardStreamableHTTPServerTransport.handleUnsupportedRequest() already sets Allow: GET, POST, DELETE.
  • The stateless fallback only accepts POST, so the expected header is Allow: POST.

Why it happens

The legacy stateless path returned 405 Method not allowed without setting Allow. Pull request 3002 adds Allow: POST on that path. Status and JSON-RPC body stay the same.

Affected versions

@modelcontextprotocol/server 2.3.1, Node 24.19.0.

Fix steps

0 of 1 done

Your check marks stay in this browser only.

How to check it worked

  • A non-POST request to the stateless createMcpHandler still returns 405, and the response includes Allow: POST.

If it still fails

  • Tag 1.32.2 was compared against merge 895007fe728b and does not contain it (diverged).
  • The pull request does not change the modern WebStandardStreamableHTTPServerTransport 405 path, which already sets Allow.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it