Skip to main content
protocols.pageprotocols.page

Streamable HTTP

since 2025-03-26

Remote MCP servers accessible over the network, shared across multiple clients, deployed as services

Streamable HTTP is the MCP transport for remote servers. Clients POST JSON-RPC messages to a single HTTP endpoint. Servers can respond immediately (standard HTTP) or open an SSE stream for long-running operations. Replaced the legacy HTTP+SSE transport in MCP spec 2025-03-26.

Overview

Streamable HTTP replaced the legacy HTTP+SSE transport from the original MCP 2024-11-05 spec. The key improvement is unification: both simple and streaming responses use the same endpoint. Clients always POST to the server's endpoint URL. The server decides whether to respond immediately with a JSON body (for quick tool calls) or upgrade to SSE for streaming results.

Authentication uses OAuth 2.1 with RFC 9728 Protected Resource Metadata and RFC 8707 audience binding (added in MCP 2025-06-18). The server publishes its OAuth metadata at /.well-known/oauth-authorization-server, allowing clients to discover auth endpoints automatically.

The 2026-07-28 spec change removed the Mcp-Session-Id header entirely. Sessions are now stateless by design. Servers that need cross-call state use explicit, server-minted handles passed as tool arguments.

Wire Format

Streamable HTTP – wire format
http
// Client POSTs to /mcp endpoint:
POST /mcp HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: Bearer <oauth-token>
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search","arguments":{"query":"MCP transports"}}}

// Server returns SSE stream for long-running tool:
HTTP/1.1 200 OK
Content-Type: text/event-stream
Cache-Control: no-cache

data: {"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"Searching..."}],"isError":false}}

data: {"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"Found 3 results..."}],"isError":false,"meta":{"done":true}}}

Advantages

  • +Remote access – server runs anywhere, clients connect over HTTPS
  • +Multiple clients – one server instance serves many clients simultaneously
  • +Standard HTTP infrastructure – works with load balancers, CDNs, API gateways
  • +OAuth 2.1 security – RFC 9728 discovery, RFC 8707 audience binding
  • +Flexible response mode – simple JSON for fast calls, SSE for streaming

Limitations

  • –Requires TLS – HTTPS mandatory for authentication headers
  • –OAuth setup – requires authorization server configuration
  • –Higher latency than stdio for simple calls (network round-trip)
  • –SSE requires proxy configuration – Nginx needs X-Accel-Buffering: no
MCP Specification – Transports →