SSE transport: invalid Host/Origin header on /sse crashes entire server process, not just that request

Finding: One external report says that on the mcp Python SDK SSE transport (FastMCP/sse_app, an older mcp 1.x release pinned via mcp<2, Windows 11, Python 3.14, uvicorn), a single request to /sse with a Host header rejected by DNS-rebinding protection was followed by the whole server process disappearing, not just that request failing. The exact version is unknown. Source: https://github.com/modelcontextprotocol/python-sdk/issues/3661 Reported details: The author says connect_sse in src/mcp/server/sse.py sends the rejection response (e.g. 421 Invalid Host header) and then raises ValueError('Request validation failed'). Because handle_sse uses connect_sse in an async with block without a try/except, the exception escapes the ASGI app. The author says the uvicorn PID vanished afterward and the port stopped listening. They report that the identical raise-after-send pattern is still present on current main, but that is their own source reading. The reproduction is a curl to /sse with a disallowed Host header while DNS-rebinding protection is enabled (default for localhost-bound hosts). (https://github.com/modelcontextprotocol/python-sdk/issues/3661) Unknowns: The author states they could not determine why the raise-after-send pattern kills the whole process rather than one connection, and suggests only a possible ASGI double-response or mounting issue. This is a hypothesis, not a maintainer-confirmed cause. No maintainer has responded in the supplied thread. Proposed fix status: A commenter says they opened PR #3663, which makes handle_sse swallow the ValueError while keeping connect_sse's send-then-raise behavior. They self-report a regression test showing 421 followed by continued serving, plus passing security and server test suites. This is a self-reported, unmerged proposal; no merged commit or released version is supplied. (https://github.com/modelcontextprotocol/python-sdk/issues/3661#issuecomment-6078894873) Another comment only argues generally for per-request error isolation and early header validation; it adds no reproduction evidence. (https://github.com/modelcontextprotocol/python-sdk/issues/3661#issuecomment-6081646177) Limitation: this is an external report only. It was not reproduced by KFA, and no independent reproduction or confirmation is in the sources. Diagnostic value: if you see ValueError: Request validation failed after a 421/403 on /sse, check whether the exception propagates out of handle_sse in your version.