Repository navigation
401 in Streamable HTTP should be handled gracefully #1295
Description
Initial Checks
- I confirm that I'm using the latest version of MCP Python SDK
- I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue
Description
Currently, streamable_http will call response.raise_for_status() when handling POST requests. (ref).
This means that a 401 will bubble up and cause the entire program to crash.
While a 401 on server initialize could warrant an exception, we have a use case where a MCP server will return 401 for specific unauthorized operations, and allow others.
This should be handled gracefully, similar to how _handle_unexpected_content_type works, returning a JSONRPC message outlining an unauthorized exception was thrown.
This would let an agent or other client handle it instead of crashing the program.
Python & MCP Python SDK
Python 3.12 and MCP SDK v1.13.1
Activity
fix: handle HTTP 4xx/5xx gracefully in StreamableHTTP transport
sgoel2be24-cyber commentedon Aug 10, 2026
I'd like to take this.
Opened a focused fix in #3276.
Reproduced on current
main: a bare HTTP 401 after initialize still mapped toINTERNAL_ERROR/"Server returned an error response", so agents couldn't distinguish operation-specific auth denials. The PR maps bare 401 →Unauthorizedand 403 →Forbidden(withdata.http_status) and adds regression tests.AI assistance disclosure: AI was used for analysis/implementation support; I reviewed and verified the changes and tests.
sgoel2be24-cyber commentedon Sep 4, 2026
Hi maintainers, could you assign #1295 to me so #3276 can reopen automatically? Its 29 checks pass, and I am ready to rebase.
Kludex commentedon Oct 14, 2026
The crash is gone on main: a non-2xx response now resolves the request with a JSON-RPC error. Exposing the HTTP status to callers is tracked in #2110, so closing in favour of that.