Return 405 on GET when stateless_http=True

[itomise]

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

When a Streamable HTTP server is configured with stateless_http=True, GET /mcp is still accepted and opens an SSE stream that has no session context and can never receive server-initiated messages — a dead-end.

The MCP Streamable HTTP spec explicitly permits returning 405 Method Not Allowed when the server does not offer an SSE stream at the endpoint
(spec):

The server MUST return HTTP 405 Method Not Allowed if an SSE stream is
not offered at the endpoint.

A stateless server cannot offer one — there is no session to push to — so GET should 405. The TypeScript SDK already behaves this way in its stateless example.

A prior PR (#2262) proposed essentially this change but was closed for lack of a corresponding issue per CONTRIBUTING.md.
Opening this issue to agree on scope so the fix can be re-submitted.

Example Code

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-server", stateless_http=True, json_response=True)

@mcp.tool()
def ping() -> str:
    return "pong"

app = mcp.streamable_http_app()

A couple of clarifications for triage:

Current vs expected behavior

Today (v1.27.0):

$ curl -i -X GET http://localhost:8000/mcp
HTTP/1.1 200 OK
content-type: text/event-stream
... (stream idles until platform timeout)

Expected:

$ curl -i -X GET http://localhost:8000/mcp
HTTP/1.1 405 Method Not Allowed
Allow: POST

Concrete impact

The idle GET SSE stream holds a long-lived connection per client with no useful payload, exhausting concurrent connection limits on serverless platforms like Cloud Run. Background previously raised in #2232 / #1941.

Proposed resolution

PR #2262 already has a working implementation. Once this issue is labeled ready for work, reopening it (narrowed to GET per this issue's scope) should be sufficient — no new PR needed.

Python & MCP Python SDK

1.27.0

[faridun-ag2]

I'd like to pick this up. The fix is straightforward: in _handle_stateless_request (streamable_http_manager.py, line ~153), check the request method before creating a transport. If it's GET (or DELETE), return 405 with Allow: POST immediately instead of spinning up a dead SSE stream.
This keeps StreamableHTTPServerTransport unaware of stateless semantics and avoids touching the stateful path.
The closed PR #2262 had a working implementation. I'll follow the same direction but scope it to the manager layer.
Could this be labeled ready for work so I can proceed?