Skip to main content
Sessions keep per-client state (caching, auth, limits). Managed by the MCP SDK via mcp-session-id HTTP header (spec: https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management).

How it works

  • SDK generates a UUID when no session header is present.
  • Server returns it in mcp-session-id on initialize.
  • Client sends the header on all requests.
  • Server reuses the session; middleware sees it as context.session_id.

Get session ID

Per-session patterns (minimal)

State / rate limit / cache key by context.session_id or "anonymous":
Per-session cache:

Notes

  • Only available on Streamable HTTP transport; stdio has no sessions.
  • Use per-session storage to avoid data leakage.
  • Keep session data lean; expire if needed.