Source · DiggingBeagle record
MCP 2025-11-25: Streamable HTTP transport security
Transport specification with an explicit security warning covering Origin validation, local binding and authentication. The deprecated Python SDK WebSocket helper is a separate custom transport; this document is comparative design guidance for that advisory, not proof that every MCP transport is affected.
- Accessed
- Oct 1, 2026
- Publisher
- Model Context Protocol
- Source role
- primary disclosure
- Version
- 2025-11-25
Each support, contradiction or context label applies to a cited Claim, not to a whole Case.
Source record
Transport specification with an explicit security warning covering Origin validation, local binding and authentication. The deprecated Python SDK WebSocket helper is a separate custom transport; this document is comparative design guidance for that advisory, not proof that every MCP transport is affected.
Cite this record
DiggingBeagle. “MCP 2025-11-25: Streamable HTTP transport security.” Accessed Oct 1, 2026. https://diggingbeagle.com/sources/mcp-2025-11-25-streamable-http-transport-security/
Citation guidance