Answer HEAD on the SSE endpoint with GET's headers and no body

Author: Kludex

src/mcp/server/mcpserver/server.py

@@ -1173,8 +1173,12 @@ def sse_app(
 
         async def sse_endpoint(request: Request) -> Response:
             if request.method == "HEAD":
-                # The SSE stream never ends, so a HEAD answered with it would never complete.
-                return Response(status_code=405, headers={"Allow": "GET"})
+                # GET's headers without its never-ending stream; a Content-Length would claim an empty one.
+                response = Response(
+                    media_type="text/event-stream", headers={"Cache-Control": "no-store", "X-Accel-Buffering": "no"}
+                )
+                del response.headers["content-length"]
+                return response
             async with sse.connect_sse(  # pragma: no cover
                 request.scope,
                 request.receive,

src/mcp/server/sse.py

@@ -15,9 +15,11 @@
 
     # Define handler functions
     async def handle_sse(request):
-        # Starlette also routes HEAD here; the stream never ends, so a HEAD would never complete
+        # Starlette also routes HEAD here: answer with GET's headers, not its never-ending stream
         if request.method == "HEAD":
-            return Response(status_code=405, headers={"Allow": "GET"})
+            response = Response(media_type="text/event-stream", headers={"Cache-Control": "no-store"})
+            del response.headers["content-length"]
+            return response
         async with sse.connect_sse(
             request.scope, request.receive, request._send
         ) as streams:

tests/interaction/_requirements.py

@@ -2708,8 +2708,8 @@ def __post_init__(self) -> None:
     "transport:sse:head": Requirement(
         source="issue:#3736",
         behavior=(
-            "A HEAD request to the SSE endpoint of `MCPServer.sse_app()` is answered 405 with `Allow: GET` "
-            "without opening a session or a stream, so the connection stays usable."
+            "A HEAD request to the SSE endpoint of `MCPServer.sse_app()` is answered at once with the "
+            "headers a GET would get and no body or Content-Length, without opening a session or a stream."
         ),
         transports=("sse",),
         note="Only observable over the legacy SSE transport.",

tests/interaction/transports/test_sse.py

@@ -93,12 +93,21 @@ async def test_post_for_an_unknown_session_is_rejected() -> None:
 
 
 @requirement("transport:sse:head")
-async def test_head_on_the_sse_endpoint_is_answered_without_opening_a_stream() -> None:
+async def test_head_on_the_sse_endpoint_is_answered_with_headers_only() -> None:
     """`MCPServer.sse_app()` answers HEAD at once instead of streaming forever."""
     app = MCPServer("legacy").sse_app(
         transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False)
     )
     async with httpx2.AsyncClient(transport=StreamingASGITransport(app), base_url=BASE_URL) as http:
         with anyio.fail_after(5):
             response = await http.head("/sse")
-    assert (response.status_code, response.headers["allow"]) == snapshot((405, "GET"))
+    assert (response.status_code, dict(response.headers)) == snapshot(
+        (
+            200,
+            {
+                "cache-control": "no-store",
+                "x-accel-buffering": "no",
+                "content-type": "text/event-stream; charset=utf-8",
+            },
+        )
+    )