Broker sends session-less liveness ping to upstream MCP servers; rejected by strict streamable-HTTP servers (mcp-searxng 2.0.0)

[rwlove]

Summary

The mcp-gateway broker (v0.9.0) issues POST /mcp requests to an upstream MCP server without an established session — no prior initialize, no Mcp-Session-Id, and no MCP-Protocol-Version header. This appears to be a liveness ping. Upstream MCP servers that strictly enforce the streamable-HTTP transport spec reject these requests, and the broker then drops the server entirely.

Observed with

• Broker: ghcr.io/kuadrant/mcp-gateway:v0.9.0
• Upstream: mcp-searxng 2.0.0 (HTTP transport, stateful — no MCP_HTTP_STATELESS)

What happens

The upstream server logs the broker's request as invalid:

POST request rejected - invalid request: {
  sessionId: 'undefined',
  hasInitializeRequest: false,
  userAgent: 'mcp-broker',
  contentType: 'application/json',
  accept: 'application/json, text/event-stream'
}

The broker then logs, after 3 consecutive failures:

level=ERROR msg="failure threshold reached, removing tools and prompts" threshold=3

…and de-federates the upstream, removing all of its tools/prompts. The same upstream on 1.16.0 works fine — the older server tolerated the session-less ping; 2.0.0's stricter validation does not.

Expected

Per the streamable-HTTP transport spec, the broker should complete a proper stateful handshake before issuing other requests:

1. POST /mcp an initialize request first,
2. carry the returned Mcp-Session-Id on all subsequent requests (including pings),
3. and/or send MCP-Protocol-Version on any session-less POST.

Right now the broker's session-less ping is spec-noncompliant against servers that enforce the newer revisions (2026-07-28 and the retained legacy revisions).

Cross-reference

Upstream-server side of this interop issue: ihor-sokoliuk/mcp-searxng#256