Lowercase response header names in StreamableHTTPTransport

## Motivation and Context

The Rack 3 SPEC requires response header names to be lowercase.
https://github.com/rack/rack/blob/main/SPEC.rdoc says in its "The Headers" section:

> Header keys must not contain uppercase ASCII characters (A-Z).

https://github.com/rack/rack/blob/main/SPEC.rdoc#the-headers

However, `StreamableHTTPTransport` emitted capitalized names such as `Content-Type` and `Mcp-Session-Id`.
Any `Rack::Lint`-wrapped stack, including the default development mode of rackup, rejects every response
from the transport with a `LintError` 500. Lowercasing the names restores Rack 3 compliance.
HTTP header names are case-insensitive on the wire, so HTTP clients are unaffected;
only in-process consumers that read the raw Rack headers hash see the new keys.

Lowercase is also the only representation valid across HTTP versions: RFC 9113 makes uppercase field names
a protocol error on HTTP/2, so proxies and h2-capable servers already require it.
The TypeScript SDK sets `headers['mcp-session-id']` and the Python SDK defines `MCP_SESSION_ID_HEADER = "mcp-session-id"`,
so lowercase also matches what the reference SDKs emit; the MCP spec's `Mcp-Session-Id` casing is prose convention,
not a wire requirement.

Examples and documentation deliberately keep the spec's `Mcp-Session-Id` casing where it does not name
a Rack response hash key: curl invocations and `examples/streamable_http_client.rb` set request headers,
which the Rack response rule does not govern; the rack-cors `expose:` entry carries a header name as
an `Access-Control-Expose-Headers` value, which browsers match case-insensitively;
and README/docs prose follows the MCP specification's documentation convention.
Only code reading the raw Rack response headers hash, a case-sensitive Hash lookup, had to switch to lowercase keys.

AGENTS.md now records the lowercase rule under the code style guidelines, since the MCP spec's `Mcp-Session-Id` prose casing
invites reintroducing capitalized names in future transport work.

## How Has This Been Tested?

Added a regression test asserting that header names are lowercase in initialize, GET SSE, DELETE, and parse error responses.
Existing tests that read the raw headers hash were updated to the new keys. Verified with rake test, rake rubocop,
and rake conformance.

## Breaking Changes

Code that reads the raw Rack response headers hash returned by `handle_request`, or by middleware around the mounted transport,
with exact-case keys such as `"Mcp-Session-Id"` must switch to the lowercase keys. Clients speaking HTTP are
unaffected because header names are case-insensitive on the wire.

Author: koic

AGENTS.md

@@ -32,6 +32,7 @@ This is the official Ruby SDK for the Model Context Protocol (MCP), implementing
 - Use frozen string literals
 - Follow Ruby community conventions
 - Keep dependencies minimal
+- Use lowercase HTTP response header names (e.g. `mcp-session-id`); the Rack 3 SPEC requires this, and the MCP spec's `Mcp-Session-Id` casing is prose convention only
 
 ## Commit message conventions
 

examples/streamable_http_server.rb

@@ -105,7 +105,7 @@ def call(env)
           @mcp_logger.error("Response error: #{parsed["error"]["message"]}")
         else
           @mcp_logger.info("Response: success (id: #{parsed["id"]})")
-          @sse_logger.info("Session created: #{headers["Mcp-Session-Id"]}") if headers["Mcp-Session-Id"]
+          @sse_logger.info("Session created: #{headers["mcp-session-id"]}") if headers["mcp-session-id"]
         end
       rescue JSON::ParserError
         @mcp_logger.warn("Invalid JSON in response")

lib/mcp/server/transports/streamable_http_transport.rb

@@ -19,9 +19,9 @@ class StreamableHTTPTransport < Transport
         class InvalidJsonError < StandardError; end
 
         SSE_HEADERS = {
-          "Content-Type" => "text/event-stream",
-          "Cache-Control" => "no-cache",
-          "Connection" => "keep-alive",
+          "content-type" => "text/event-stream",
+          "cache-control" => "no-cache",
+          "connection" => "keep-alive",
         }.freeze
 
         # Secure defaults for stateful mode. Without a finite idle timeout, sessions live until an explicit client DELETE,
@@ -566,7 +566,7 @@ def handle_get(request)
         end
 
         def handle_delete(request)
-          success_response = [200, { "Content-Type" => "application/json" }, [{ success: true }.to_json]]
+          success_response = [200, { "content-type" => "application/json" }, [{ success: true }.to_json]]
 
           if @stateless
             protocol_version_error = validate_protocol_version_header(request)
@@ -762,7 +762,7 @@ def validate_protocol_version_header(request)
 
         def json_rpc_error_response(status:, code:, message:)
           body = { jsonrpc: "2.0", id: nil, error: { code: code, message: message } }
-          [status, { "Content-Type" => "application/json" }, [body.to_json]]
+          [status, { "content-type" => "application/json" }, [body.to_json]]
         end
 
         def notification?(body)
@@ -870,10 +870,10 @@ def handle_initialization(request, body_string, body)
           end
 
           headers = {
-            "Content-Type" => "application/json",
+            "content-type" => "application/json",
           }
 
-          headers["Mcp-Session-Id"] = session_id if session_id
+          headers["mcp-session-id"] = session_id if session_id
 
           [200, headers, [response]]
         end
@@ -915,7 +915,7 @@ def handle_regular_request(body_string, session_id, related_request_id: nil)
             # which would produce an empty body the client cannot parse as JSON.
             return handle_accepted if response.nil?
 
-            [200, { "Content-Type" => "application/json" }, [response]]
+            [200, { "content-type" => "application/json" }, [response]]
           end
         end
 
@@ -1148,7 +1148,7 @@ def invalid_request_response(message, request_id: nil)
               message: message,
             },
           }
-          [400, { "Content-Type" => "application/json" }, [body.to_json]]
+          [400, { "content-type" => "application/json" }, [body.to_json]]
         end
 
         def session_already_connected_response

test/mcp/server/transports/streamable_http_notification_integration_test.rb

@@ -28,7 +28,7 @@ class StreamableHTTPNotificationIntegrationTest < ActiveSupport::TestCase
             { jsonrpc: "2.0", method: "initialize", id: "init", params: initialize_params }.to_json,
           )
           init_response = @transport.handle_request(init_request)
-          session_id = init_response[1]["Mcp-Session-Id"]
+          session_id = init_response[1]["mcp-session-id"]
 
           # Connect with SSE
           io = StringIO.new
@@ -77,7 +77,7 @@ class StreamableHTTPNotificationIntegrationTest < ActiveSupport::TestCase
             { jsonrpc: "2.0", method: "initialize", id: "123", params: initialize_params }.to_json,
           )
           init_response1 = @transport.handle_request(init_request1)
-          session_id1 = init_response1[1]["Mcp-Session-Id"]
+          session_id1 = init_response1[1]["mcp-session-id"]
 
           init_request2 = create_rack_request(
             "POST",
@@ -86,7 +86,7 @@ class StreamableHTTPNotificationIntegrationTest < ActiveSupport::TestCase
             { jsonrpc: "2.0", method: "initialize", id: "456", params: initialize_params }.to_json,
           )
           init_response2 = @transport.handle_request(init_request2)
-          session_id2 = init_response2[1]["Mcp-Session-Id"]
+          session_id2 = init_response2[1]["mcp-session-id"]
 
           # Connect both sessions with SSE
           io1 = StringIO.new
@@ -132,7 +132,7 @@ class StreamableHTTPNotificationIntegrationTest < ActiveSupport::TestCase
             { jsonrpc: "2.0", method: "initialize", id: "init", params: initialize_params }.to_json,
           )
           init_response = @transport.handle_request(init_request)
-          session_id = init_response[1]["Mcp-Session-Id"]
+          session_id = init_response[1]["mcp-session-id"]
 
           # Connect with SSE
           io = StringIO.new
@@ -168,7 +168,7 @@ class StreamableHTTPNotificationIntegrationTest < ActiveSupport::TestCase
             { jsonrpc: "2.0", method: "initialize", id: "init", params: initialize_params }.to_json,
           )
           init_response = @transport.handle_request(init_request)
-          session_id = init_response[1]["Mcp-Session-Id"]
+          session_id = init_response[1]["mcp-session-id"]
 
           # Connect with SSE
           io = StringIO.new
@@ -212,7 +212,7 @@ class StreamableHTTPNotificationIntegrationTest < ActiveSupport::TestCase
             { jsonrpc: "2.0", method: "initialize", id: "init", params: initialize_params }.to_json,
           )
           init_response = @transport.handle_request(init_request)
-          session_id = init_response[1]["Mcp-Session-Id"]
+          session_id = init_response[1]["mcp-session-id"]
 
           # Connect with SSE
           io = StringIO.new