What is Streamable HTTP?

Streamable HTTP is one of the two standard transports in the Model Context Protocol, and it is the one meant for servers that run as independent processes and serve many clients. The server publishes a single MCP endpoint, for example a URL ending in /mcp. The client sends every JSON-RPC request or notification as its own HTTP POST and must be ready to accept either JSON or an event stream in return. For each request the server chooses: a single JSON object, or an SSE stream that carries progress notifications and then the final response. Closing that stream cancels the request.

The spec revision dated 2026-07-28 changed this transport. It removed the GET stream endpoint and protocol-level sessions, and long-lived change notifications now arrive on the response stream of a subscriptions/listen request. Revisions from 2025-03-26 through 2025-11-25 let servers assign session IDs and let clients open a GET stream, so a client that talks to older servers needs fallback logic. Streamable HTTP replaced the HTTP+SSE transport from 2024-11-05, which is now deprecated.

The spec attaches security rules to it. Servers must validate the Origin header to block DNS rebinding, should bind to localhost when running locally, and should authenticate all connections.