Implement the MCP Streamable HTTP transport server-side under spec revision 2026-07-28 (single POST endpoint, no sessions, no GET stream)

Documented steps

1. Expose ONE MCP endpoint path (e.g. https://example.com/mcp) that supports HTTP POST only. Every JSON-RPC message from the client is its own new POST.
2. Reject requests whose Accept header does not list BOTH application/json and text/event-stream — clients MUST send both.
3. Validate the Origin header on every incoming connection to prevent DNS rebinding. If Origin is present and invalid, respond HTTP 403 Forbidden; the body MAY be a JSON-RPC error response with no id.
4. When running locally, bind only to 127.0.0.1, not 0.0.0.0.
5. If the POST body is a JSON-RPC notification and you accept it, return HTTP 202 Accepted with no body; if you cannot accept it, return an HTTP error status such as 400.
6. If the POST body is a JSON-RPC request, respond with EITHER Content-Type: application/json (a single JSON object) OR Content-Type: text/event-stream (an SSE stream scoped to that one request). Clients must support both, so pick per request.
7. On an SSE response stream you MAY send notifications/progress and notifications/message that relate to the originating request, then the final JSON-RPC response, which SHOULD terminate the stream.
8. Never send an independent JSON-RPC *request* on that stream. Server-to-client interactions (sampling, elicitation, roots) are embedded in results as InputRequiredResult per MRTR (SEP-2322) instead.
9. Set X-Accel-Buffering: no on SSE responses so reverse proxies such as nginx do not buffer events.
10. On long-lived streams, periodically emit an SSE comment line (a line starting with a colon, e.g. ':\r\n') as a keep-alive so intermediaries do not drop the connection.
11. Treat closure of the SSE response stream as cancellation of that request: stop work as soon as practical and send no further messages for it.
12. Respond 405 Method Not Allowed to HTTP GET or DELETE on the MCP endpoint — the GET stream endpoint and session termination via DELETE were removed in this revision.
13. Verify against the spec page before shipping: https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http