fix(server): set Allow: POST on stateless legacy 405 responses

HU
1mo ago
+24-1

Motivation and Context

Fixes #2970.

createMcpHandler's legacy stateless fallback answers non-POST requests with 405 Method not allowed but omits the Allow header. RFC 9110 §15.5.6 requires Allow on 405 responses. WebStandardStreamableHTTPServerTransport.handleUnsupportedRequest() already sets Allow: GET, POST, DELETE; the stateless fallback only accepts POST, so it should advertise Allow: POST.

How Has This Been Tested?

  • Extended the existing 405 cases in legacyStatelessFallback.test.ts and createMcpHandler.test.ts to assert Allow: POST.
  • Confirmed the new assertions fail on unmodified main and pass with this change.
  • Ran the full createMcpHandler + legacyStatelessFallback suites (61 tests).
  • pnpm --filter @modelcontextprotocol/server typecheck and lint passed.
  • Pre-push hook ran repo-wide build, typecheck, and lint successfully.

Breaking Changes

None. Adds a response header on an existing 405 path; status and JSON-RPC body are unchanged.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository style guidelines
  • New and existing tests pass locally
  • I have added tests that prove my fix is effective
  • I have checked my changes for security concerns including secrets and unsafe parsing

AI assistance

This change was prepared with AI assistance (Grok Bot). I reviewed the diff, ran the tests above, and take responsibility for the content.