Reject a second initialize on an already-initialized session

A server that had already completed the initialize handshake on a
connection answered a repeated initialize request on that same
connection as a fresh handshake, silently overwriting the session's
recorded client_params and negotiated protocol version. A
check_capability call made after that point then answered against the
second client's declared capabilities.

The handshake now commits at most once per connection: a repeated
initialize is answered with JSON-RPC error -32600 (INVALID_REQUEST,
"Session already initialized") and the established session keeps
serving. The check lives at the runner's request-dispatch boundary,
right next to its mirror (the request-before-initialize gate), so every
transport gets it without any transport-level body sniffing.

The discriminator is client_params rather than initialize_accepted: the
legacy stateless path builds a per-request connection that is born past
the gate but has no peer info yet, and its one initialize must still be
accepted.

No compliant client is affected. The spec makes initialization the
first interaction of a session, and ClientSession.initialize() is
already idempotent (a repeat call returns the first result without
sending anything). This only applies to the legacy (2025-11-25 and
earlier) handshake; the 2026-07-28 protocol removes initialize
entirely.

Closes #2605

Author: maxisbey

docs/migration.md

@@ -49,6 +49,23 @@ per the spec's SHOULD. v1 answered the cancelled request with an error
 with anyio cancellation when its scope is cancelled, so no reply is needed to
 unblock it.
 
+### A second `initialize` on an already-initialized session is rejected
+
+A server that has already completed the `initialize` handshake on a connection now answers a
+repeated `initialize` request on that same connection with JSON-RPC error `-32600`
+(`INVALID_REQUEST`, message `"Session already initialized"`) instead of re-running the handshake.
+Previously the repeat was answered as a fresh handshake and silently overwrote the session's
+recorded `client_params` and negotiated protocol version, so a `check_capability` call made after
+that point answered against the second client's declared capabilities
+([#2605](https://github.com/modelcontextprotocol/python-sdk/issues/2605)).
+
+No compliant client is affected: the spec makes initialization the first interaction of a session,
+and the SDK's own `ClientSession.initialize()` is idempotent (a repeat call returns the first
+result without sending anything). A peer that needs a fresh handshake should open a new
+connection — on streamable HTTP, a `POST` without an `Mcp-Session-Id` header. This applies only to
+the legacy (2025-11-25 and earlier) handshake; the 2026-07-28 protocol removes `initialize`
+entirely.
+
 ### `streamablehttp_client` removed
 
 The deprecated `streamablehttp_client` function has been removed. Use `streamable_http_client` instead.

src/mcp/server/runner.py

@@ -26,6 +26,7 @@
     CLIENT_INFO_META_KEY,
     INTERNAL_ERROR,
     INVALID_PARAMS,
+    INVALID_REQUEST,
     METHOD_NOT_FOUND,
     PROTOCOL_VERSION_META_KEY,
     ErrorData,
@@ -177,6 +178,15 @@ async def _inner(ctx: ServerRequestContext[LifespanT, Any]) -> HandlerResult:
             # the gate become a per-version legacy path then. Initialize runs inline
             # (read loop parked), so awaiting the peer anywhere on this path deadlocks.
             if method == "initialize":
+                # The handshake commits at most once per connection: a repeat would
+                # silently overwrite the negotiated `client_params` and
+                # `protocol_version` at the commit at the bottom of `_on_request`
+                # (#2605). The discriminator is `client_params`, not
+                # `initialize_accepted`: a born-ready `from_envelope` connection
+                # (the legacy stateless path) is already past the gate but has no
+                # peer info yet, and its one `initialize` must still be accepted.
+                if self.connection.client_params is not None:
+                    raise MCPError(code=INVALID_REQUEST, message="Session already initialized")
                 return self._serialize(method, version, self._handle_initialize(params))
             # Methods without a handler are METHOD_NOT_FOUND regardless of
             # initialization state: JSON-RPC 2.0 reserves -32601 for "not

tests/interaction/_requirements.py

@@ -2571,12 +2571,6 @@ def __post_init__(self) -> None:
         source="sdk",
         behavior="A second initialize on an already-initialized session transport is rejected.",
         transports=("streamable-http",),
-        divergence=Divergence(
-            note=(
-                "The transport forwards a second initialize carrying the existing session ID to the running "
-                "server, which answers it as a fresh handshake; nothing rejects re-initialization."
-            ),
-        ),
         removed_in="2026-07-28",
         note=(
             "removed in 2026-07-28 (SEP-2567); per-session initialize guard retired with Mcp-Session-Id, no "

tests/interaction/transports/test_hosting_session.py

@@ -12,7 +12,7 @@
 import httpx
 import pytest
 from inline_snapshot import snapshot
-from mcp_types import JSONRPCResponse, ListToolsResult, PaginatedRequestParams, Tool
+from mcp_types import INVALID_REQUEST, JSONRPCError, JSONRPCResponse, ListToolsResult, PaginatedRequestParams, Tool
 
 from mcp.server import Server, ServerRequestContext
 from tests.interaction._connect import (
@@ -142,20 +142,38 @@ async def test_terminating_one_session_leaves_others_working() -> None:
 
 
 @requirement("hosting:session:reinitialize")
-async def test_second_initialize_on_an_existing_session_is_accepted() -> None:
-    """A second initialize POST carrying an existing session ID is processed rather than rejected.
-
-    See the divergence on the requirement: the entry expects a rejection, but the SDK forwards the
-    second initialize to the running server, which answers it as a fresh handshake.
+async def test_second_initialize_on_an_existing_session_is_rejected_and_the_session_survives() -> None:
+    """A second initialize POST on an existing session is answered with INVALID_REQUEST,
+    and the established session keeps serving.
+
+    SDK-defined, no spec MUST: closes the gap where the server answered a repeated initialize as a
+    fresh handshake and silently overwrote the session's committed client_params (python-sdk#2605;
+    the kernel-level proof that the committed state survives is in tests/server/test_runner.py).
+    Raw HTTP because the SDK Client performs exactly one handshake and cannot be made to repeat it.
+
+    Steps:
+      1. A real handshake establishes the session.
+      2. A second initialize on that session ID routes to the existing transport (the instance
+         count stays 1) and is rejected at the JSON-RPC layer. The HTTP status is still 200: in
+         legacy SSE mode the response stream is committed before dispatch, so the rejection
+         arrives as a JSONRPCError event on it.
+      3. tools/list on the same session still answers, proving the rejection tore nothing down.
     """
     async with mounted_app(_server()) as (http, manager):
         session_id = await initialize_via_http(http)
+
         response, messages = await post_jsonrpc(http, initialize_body(request_id=2), session_id=session_id)
         assert len(manager._server_instances) == 1
+        assert response.status_code == snapshot(200)
+        assert isinstance(messages[0], JSONRPCError)
+        assert messages[0].id == 2
+        assert messages[0].error.code == INVALID_REQUEST
+        assert messages[0].error.message == snapshot("Session already initialized")
 
-    assert response.status_code == snapshot(200)
-    assert isinstance(messages[0], JSONRPCResponse)
-    assert messages[0].id == 2
+        _, after = await post_jsonrpc(http, {"jsonrpc": "2.0", "id": 3, "method": "tools/list"}, session_id=session_id)
+
+    assert isinstance(after[0], JSONRPCResponse)
+    assert after[0].result["tools"][0]["name"] == "noop"
 
 
 @requirement("hosting:stateless:no-session-id")

tests/server/test_runner.py

@@ -19,6 +19,7 @@
 from mcp_types import (
     INTERNAL_ERROR,
     INVALID_PARAMS,
+    INVALID_REQUEST,
     LATEST_PROTOCOL_VERSION,
     METHOD_NOT_FOUND,
     ClientCapabilities,
@@ -175,6 +176,30 @@ async def test_runner_initialize_opens_gate_but_event_fires_only_after_initializ
         await runner.connection.initialized.wait()
 
 
+@pytest.mark.anyio
+async def test_runner_rejects_a_second_initialize_and_preserves_the_committed_handshake(server: SrvT):
+    """A second `initialize` on an already-initialized connection is rejected with
+    INVALID_REQUEST and the first handshake's committed `client_params` and
+    `protocol_version` survive unchanged.
+
+    SDK-defined (no spec MUST mandates the rejection). Regression lock for python-sdk#2605,
+    where the repeat was answered as a fresh handshake and silently overwrote both."""
+    impostor = InitializeRequestParams(
+        protocol_version=OLDEST_SUPPORTED_VERSION,
+        capabilities=ClientCapabilities(),
+        client_info=Implementation(name="impostor", version="9.9"),
+    ).model_dump(by_alias=True, exclude_none=True)
+    # `connected_runner(server)` already performed the real initialize (client name
+    # "test-client", protocol version LATEST_HANDSHAKE_VERSION) before yielding.
+    async with connected_runner(server) as (client, runner):
+        with pytest.raises(MCPError) as exc:
+            await client.send_raw_request("initialize", impostor)
+        assert exc.value.error == ErrorData(code=INVALID_REQUEST, message="Session already initialized")
+        assert runner.connection.client_params is not None
+        assert runner.connection.client_params.client_info.name == "test-client"
+        assert runner.connection.protocol_version == LATEST_HANDSHAKE_VERSION
+
+
 @pytest.mark.anyio
 async def test_runner_gates_requests_before_initialize(server: SrvT):
     async with connected_runner(server, initialized=False) as (client, _):