Concept card

MCP Streaming HTTP Transport — For Production Multi-Tenant Deployments

As of 2026-07-24T14:00:00Z

Edited by Cédric-Olivier Mâry, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is MCP Streaming HTTP Transport — For Production Multi-Tenant Deployments?

MCP's Streamable HTTP transport treats every request as independent by default, replacing the SSE-only design that broke session continuity behind a load balancer — the only transport that scales horizontally on stateless containers.

MCP's Streamable HTTP transport, introduced in the Model Context Protocol specification revision of March 2025 and superseding the original SSE-only transport, is the production wire format for serving MCP tools to remote agent clients over a network. A single HTTPS endpoint accepts JSON-RPC 2.0 requests by POST; the server replies with a plain JSON response for a one-shot tool call, or upgrades the same connection to a chunked event stream when a tool needs to push partial results, progress updates, or a long-lived subscription. The transport is stateless by default, every request carries its full JSON-RPC payload and can, in principle, land on any backend instance, but it supports stateful sessions through a session-id header negotiated during the initial handshake, for the cases where continuity across requests is actually needed.

Why It Exists

The original MCP transport was SSE-only: a persistent server-to-client event stream carried all server-originated messages, with client requests routed back over a separate HTTP POST channel. That asymmetric design worked well for simple local tooling, but it imposed a standing connection requirement that made horizontal scaling behind a load balancer unreliable; successive requests in the same logical session could land on different backend instances, silently breaking continuity. Streamable HTTP resolves this by treating every request as independent unless a session is explicitly negotiated, a design that maps directly onto stateless container runtimes and lets a load balancer route each request without needing sticky sessions as the default assumption.

Why The Transport Choice Is An Architecture Decision, Not A Detail

Why it matters

The old SSE-only transport required a persistent connection, so different request cycles could land on different backend instances and break sessions — a real horizontal-scaling blocker.
Streamable HTTP lets the same MCP server autoscale on BTP Cloud Foundry or Kyma, terminate TLS at the edge, and authenticate with OAuth 2.1 bearer tokens.
Per-tenant audit logs from every tool call can flow into SAP AI Agent Hub, satisfying EU AI Act Art. 9 record-keeping at the transport layer.

Key points

Streamable HTTP transport — MCP spec revision 2025-03, replaces the original SSE-only transport; one POST /mcp endpoint, optional upgrade to chunked SSE for streaming responses.
Stateless by default — horizontal scaling on BTP Cloud Foundry / Kyma; optional Mcp-Session-Id header for stateful sessions when needed.
OAuth 2.1 mandated — MCP spec 2025-06 requires bearer-token auth for HTTP transports; no API-key-only deployments survive a security review.
Multi-tenant ready — per-tenant audit logs flow into SAP AI Agent Hub (C211); EU AI Act Art. 9-49 record-keeping discharged at the transport layer.
Anti-pattern — shipping a stdio-only server then rewriting for production; build HTTP from day one when more than one operator will use it.
MCP Streaming HTTP Transport — For Production Multi-Tenant Deployments is mastered only when it changes a named buyer decision.
Start with the semantic contract and control model before demonstrating the tool.
Use current SAP, analyst, study, KG, and news signals as evidence, not decoration.
Separate verified facts from directional trends and modeled assumptions.
Define owner, metric, threshold, support path, and rollback before scaling.

Terms used on this page

Streamable HTTP: MCP transport introduced 2025-03 — single HTTPS POST endpoint, optional upgrade to chunked text/event-stream for partial results; production wire format.
Mcp-Session-Id: Optional HTTP header negotiated at initialize for stateful sessions across multiple requests; not required for stateless tool calls.
OAuth 2.1: Auth profile mandated by MCP 2025-06 for HTTP transports; consolidates OAuth 2.0 best practices, drops the implicit + ROPC flows.
Per-tenant scope: OAuth claim narrowing a token's access to one customer tenant's MCP tools and data scopes; foundation of multi-tenant isolation.
Decision owner: The accountable person who accepts the trade-off and funds the next action.
Semantic contract: The shared definition of business terms, metrics, entities, and access rules used by tools and teams.
Control plane: The layer that applies policy, access, lineage, monitoring, and escalation across the operating model.
Evidence grade: A label that separates verified fact, directional signal, modeled assumption, and field observation.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks · the facts worth quoting.

Open in the app →