Summary

When forwarding JSON-RPC requests to federated MCP servers using SSE transport, the gateway incorrectly uses /rpc endpoint instead of the MCP-spec-compliant /message endpoint. Additionally, SSE event parsing only handles data: (with space) format, breaking compatibility with some SSE providers.

Issue 1: SSE endpoint should be /message, not /rpc

Background

The MCP SSE transport specification uses:

• GET /sse - to establish the SSE connection
• POST /message - to send JSON-RPC messages

The codebase correctly implements this in sse_transport.py:336:

endpoint_url = f"{self._base_url}/message?session_id={self._session_id}"

However, when forwarding requests to federated SSE gateways, the code incorrectly uses /rpc.

Affected Files

gateway_service.py (lines 2223, 2283, 2385):

# Current (incorrect for SSE transport)
response = await self._http_client.post(urljoin(gateway.url, "/rpc"), json=request, headers=headers)

The Gateway model has a transport field that indicates SSE vs StreamableHTTP, but this is not checked when constructing the endpoint URL.

session_registry.py (line 1408):

# Current (incorrect for SSE transport)
rpc_url = root_url + "/rpc"

Expected Fix

Check gateway.transport and use /message for SSE transport, /rpc for HTTP/StreamableHTTP:

if gateway.transport.upper() == "SSE":
    parsed = urlparse(gateway.url)
    message_url = urlunparse((parsed.scheme, parsed.netloc, "/message", "", "", ""))
else:
    message_url = urljoin(gateway.url, "/rpc")

Issue 2: SSE data: parsing should handle both formats

Background

The SSE specification (RFC 8895) allows both:

• data: value (with space after colon)
• data:value (no space after colon)

Affected File

translate.py (lines 1676-1677, 1746-1747):

# Current (only handles space format)
if line.startswith("data: "):
    data = line[6:]  # Remove "data: " prefix

Expected Fix

Handle both formats:

if line.startswith("data:"):
    data = line[5:].lstrip()  # Remove "data:" and any leading whitespace

Impact

• Federated SSE servers may fail to receive forwarded requests
• SSE events from providers that omit the space after data: are silently dropped