MCPP-TRN06: Legacy HTTP+SSE transport only

Family	Transport
Default severity	medium
Confidence	high
Mode	passive (default scan)
Spec revisions	all

Why it matters

The HTTP+SSE transport (2024-11-05) is replaced by Streamable HTTP since 2025-03-26 and formally deprecated in 2026-07-28. It carries the session identifier in the URL and lacks the protocol-version and Origin requirements of the new transport.

Remediation

Expose a Streamable HTTP endpoint (single POST endpoint). Keep the SSE endpoint only for legacy clients, behind the same authorization.

References

• MCP 2025-11-25 Transports
• MCP 2026-07-28 Streamable HTTP

Suppressing

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-TRN06"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31