MCP Session Not Found: Diagnose 404 Errors After Deploys

An MCP session not found error after deployment can mean that a client is sending an identifier the receiving server no longer recognizes. But a 404 alone does not prove session loss. First identify the protocol revision and whether the response came from the MCP server or a proxy serving the wrong route.

Check the protocol before changing session settings

In the legacy 2025-11-25 Streamable HTTP specification, a server can assign an Mcp-Session-Id during initialization. A client receiving a session-related 404 must start a new session by initializing without the old identifier. See the legacy session-management rules.

The 2026-07-28 protocol instead carries version and client capabilities with requests; earlier connection-scoped initialization belongs to its compatibility path. Do not add legacy session recovery to a modern implementation merely because an old tutorial recommends it. Check the current transport overview and Streamable HTTP compatibility guidance.

Record the client version, server SDK version, protocol actually used and endpoint URL. A current SDK version does not by itself tell you which compatibility path a particular client exercised.

The 2026-07-28 HTTP binding also specifies HTTP 404 with JSON-RPC code -32601 when the RPC method is not implemented. That is a method-support failure, not evidence of an expired legacy session. Inspect the response body as well as the status.

Find the boundary returning 404

Observation	Working hypothesis	Next evidence
HTTP 404 with JSON-RPC code -32601 on the 2026-07-28 path	Unsupported RPC method	Requested method and server capabilities
Fresh connections fail before any useful exchange	Wrong route, deployment or compatibility configuration	Proxy route and server request log
Existing legacy connection fails after restart; fresh connection succeeds	Lost or expired session state	Session lifecycle and restart timestamps
Failure varies by receiving instance	State or configuration differs between replicas	Instance identity for each correlated request
Request reaches the tool and a provider returns not found	Application resource or permission problem	Sanitized tool/provider error

A branded HTML 404 page and an MCP response are different clues. Compare response type and a safe correlation identifier. Keep authorization values and raw session identifiers out of shared reports.

Run a controlled restart experiment

Use a staging server and a harmless read tool. Keep the identity and test resource constant. This is a proposed experiment, not a report of a test run by Lucivo.

1. Establish the connection and complete the read. Record which instance served it.
2. Restart that instance without changing code or credentials.
3. Repeat the read through the existing client connection.
4. For a legacy session client, observe whether it obtains a new session through the supported recovery flow.
5. Repeat the read through a fresh client connection.

Record observed outcomes beside the expected ones. If both old and fresh connections fail, session recovery is not a sufficient explanation. Investigate the route, startup failure or deployment configuration instead. If only one client fails to recover, compare its supported revision and recovery behavior before changing the server architecture.

Check replicas separately from restarts

If the problem appears only with multiple replicas, run the same read in a controlled one-instance deployment, then restore the multi-instance test. Correlate failures with the receiving instance. Improvement with one instance is evidence to investigate state distribution; it is not proof of a particular load-balancer defect.

For a legacy server, consider routing affinity or an SDK-supported shared-state design only after identifying where state lives. Affinity alone cannot preserve memory through process loss. For a stateless design, explicitly handle any application state your tools still need. A cart, draft or transaction remains application state even when transport sessions disappear.

Verify recovery without duplicating work

Finish with discovery and a harmless read after a restart, then after changing replicas. A recovered connection does not establish what happened to a write whose response was lost. Use the safe-retry guide before replaying consequential work.

If the failure is authorization, follow MCP unauthorized after login. If the connection works but tools are missing, use the discovery diagnostic.

Documentation checked October 12, 2026. The diagnostic experiments are proposed procedures, not measured client results.