--- title: "Streamable HTTP: the MCP transport explained - actionlake" description: "Streamable HTTP is the MCP transport for remote servers: one endpoint, each message an HTTP POST, answers as JSON or SSE. What changed in 2026-07-28 and why." canonical: https://actionlake.com/glossary/streamable-http updated: 2026-10-22 --- Model Context Protocol # Streamable HTTP transport Streamable HTTP is the standard MCP transport for remote servers: the client sends each JSON-RPC message as an HTTP POST to one endpoint, and the server answers with a JSON object or a Server-Sent Events stream. Updated 22 October 2026 Also called Streamable HTTP, MCP HTTP transport 4 sources checked **On this page** Connect an agent to every system you run. 100,000 calls free a month. No card. [Start free](https://actionlake.com/console?start=sandbox) ## What it is The [Model Context Protocol](https://actionlake.com/glossary/mcp) defines two standard transports. stdio carries messages over a local process's standard input and output. Streamable HTTP carries them over HTTP to a single URL, the **MCP endpoint**, such as `https://example.com/mcp`. It was introduced in protocol version 2025-03-26 and replaced the earlier HTTP+SSE transport, which is now deprecated. ## Why it matters It is what makes a [remote MCP server](https://actionlake.com/glossary/remote-mcp-server) possible. Because it is ordinary HTTP, it works through load balancers, proxies and firewalls, it can use standard authentication, and a server can scale across many instances. ## How it works In every revision, the client sends each message as its own `POST` with an `Accept` header listing `application/json` and `text/event-stream`. For a request, the server answers with one JSON object or opens an SSE stream that carries progress and ends with the response. The revisions differ in the details: - **2025-03-26 to 2025-11-25.** A server may assign a session with the `MCP-Session-Id` header. A client may open a standalone SSE stream with `GET` for server-initiated messages, and streams can resume with `Last-Event-ID`. After initialisation the client sends `MCP-Protocol-Version` on every request. - **2026-07-28.** The `GET` stream and protocol-level sessions are gone. Every request carries its protocol version and capabilities in the body, mirrored into headers such as `MCP-Protocol-Version`, `Mcp-Method` and `Mcp-Name` so gateways can route without parsing the body; the server must reject a header that disagrees with the body. Long-lived notifications use a `subscriptions/listen` request. In both, servers must validate the `Origin` header to stop DNS rebinding, and should authenticate every connection. ## Example ``` POST /mcp HTTP/1.1 Authorization: Bearer Accept: application/json, text/event-stream Content-Type: application/json MCP-Protocol-Version: 2025-11-25 {"jsonrpc":"2.0","id":2,"method":"tools/call", "params":{"name":"check","arguments":{"action":"..."}}} ``` ## Common pitfalls - **Buffering proxies.** A reverse proxy that buffers responses holds SSE events back. The 2026-07-28 text says servers should send `X-Accel-Buffering: no` on SSE responses. - **Sessions as identity.** A session ID must never stand in for authentication. - **Mixing eras.** A client that speaks only 2026-07-28 and a server that speaks only 2025-11-25 must detect each other; the specification describes the fallback. ## How actionlake handles it The actionlake endpoint, `https://connect.actionlake.com/mcp`, speaks Streamable HTTP on every current revision: 2026-07-28, where each request carries its own version and `server/discover` lists what the server speaks, and the handshake revisions 2025-11-25, 2025-06-18 and 2025-03-26 (the last with JSON-RPC batching). It is POST-only and holds no session, so any instance can answer any request; it offers no `GET` stream and answers `GET` or `DELETE` with 405 and `Allow: POST`, which is the specification's answer for a server without one. Browser-sent `Origin` headers are checked against an allow-list. Each request is authenticated on its own; see [OAuth for MCP](https://actionlake.com/glossary/oauth-dynamic-client-registration). The [API reference](https://actionlake.com/docs/api) documents the REST twin of the same eight tools. ## Questions **Is Streamable HTTP the same as SSE?** No. Server-Sent Events is one way a Streamable HTTP server can stream a response. The old HTTP+SSE transport, with separate endpoints, is deprecated in favour of Streamable HTTP. **Does Streamable HTTP need WebSockets?** No. It uses plain HTTP POST requests, answered either with a JSON body or an SSE stream. **Which MCP revision should a new server support?** The specification's versioning page names the current revision. Many clients in use still speak earlier revisions, so check which ones your clients send before dropping support. ## Related terms - [Remote MCP server A remote MCP server runs on the internet rather than on your computer, and AI clients reach it over HTTPS using the Streamable HTTP transport, usually after an OAuth sign-in.](https://actionlake.com/glossary/remote-mcp-server) - [MCP The Model Context Protocol (MCP) is an open standard that lets an AI application connect to external systems and discover and call their tools, read their resources and use their prompts through one JSON-RPC message format.](https://actionlake.com/glossary/mcp) - [OAuth for MCP OAuth for MCP is the authorisation flow the MCP specification defines for remote servers, in which an MCP client discovers the server's authorisation server, registers itself, sends the person to sign in and consent, and then calls the server with a short-lived, audience-bound access token.](https://actionlake.com/glossary/oauth-dynamic-client-registration) - [MCP client An MCP client is the component inside an AI application that holds one connection to one MCP server, fetches that server's tool list and passes the model's tool calls to it.](https://actionlake.com/glossary/mcp-client) - [MCP server An MCP server is a program that offers tools, resources and prompts to AI applications over the Model Context Protocol, usually by wrapping one system's API, such as a ticket desk or an accounting ledger.](https://actionlake.com/glossary/mcp-server) ## Sources 1. [Transports (2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports) Model Context Protocol · checked 22 October 2026 2. [Streamable HTTP (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http) Model Context Protocol · checked 22 October 2026 3. [Versioning](https://modelcontextprotocol.io/specification/versioning) Model Context Protocol · checked 22 October 2026 4. [Security Best Practices (2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices) Model Context Protocol · checked 22 October 2026 [All 30 glossary terms](https://actionlake.com/glossary) ## Connect an agent. Start free. [Start free](https://actionlake.com/console?start=sandbox) [Read the quickstart](https://actionlake.com/docs/quickstart) 100,000 calls free every month. No card. Hard caps on every key. --- Source: https://actionlake.com/glossary/streamable-http More: https://actionlake.com/llms.txt