[dev-willbird1936]

Description

Return clear 404 JSON responses when the deprecated Everything SSE transport receives an unknown or missing session ID. The affected routes previously logged and left requests unresolved, or dereferenced a failed lookup.

Root cause

The deprecated SSE transport did not consistently validate session lookup before handling GET /sse and POST /message requests.

Testing

• Vitest HTTP-level regressions for unknown GET /sse and POST /message sessions: 2/2 passed.
• Fresh Everything suite recheck on 2026-07-15: 109/109 tests passed across 6 files.
• Everything package build passed.
• Touched-file Prettier and git diff --check passed.
• LLM-client integration was not exercised; tests use HTTP-level transport requests only.

This is an ordinary correctness/resource-handling fix, not a security report. Hosted CI and maintainer review remain pending.

[cliffhall]

Thank you for this pull request, and apologies for the long wait for a response.

Since it was opened, the reference servers have been rebuilt for the 2026-07-28 MCP specification (#4857) and released as v2 (2.0.0 on npm for the TypeScript servers, 2026.10.19 on PyPI for the Python servers). The code this PR changes has been replaced, and the behavior it addresses has either been fixed in v2 or no longer exists in the same form.

This is not a judgment on the change or on you; it's a consequence of the code it targets having been replaced. If the problem still happens on v2, please open a fresh issue with the version you're running and steps to reproduce. Note that this repository now accepts contributions as issues rather than pull requests from anyone but its maintainers; see CONTRIBUTING.md.

This is part of the backlog triage in #4875.