fix: return HTTP 404 for unknown session IDs instead of 400

Per the MCP specification (2025-11-25), when a server receives a
request with an unknown or expired session ID, it MUST return HTTP
404 Not Found instead of 400 Bad Request. This signals to the client
that it should reinitialize the session.

Github-Issue: #1727

Author: max-rousseau

src/mcp/server/streamable_http_manager.py

@@ -172,7 +172,9 @@ async def _handle_stateless_request(
         )
 
         # Start server in a new task
-        async def run_stateless_server(*, task_status: TaskStatus[None] = anyio.TASK_STATUS_IGNORED):
+        async def run_stateless_server(
+            *, task_status: TaskStatus[None] = anyio.TASK_STATUS_IGNORED
+        ):
             async with http_transport.connect() as streams:
                 read_stream, write_stream = streams
                 task_status.started()
@@ -215,7 +217,10 @@ async def _handle_stateful_request(
         request_mcp_session_id = request.headers.get(MCP_SESSION_ID_HEADER)
 
         # Existing session case
-        if request_mcp_session_id is not None and request_mcp_session_id in self._server_instances:  # pragma: no cover
+        if (
+            request_mcp_session_id is not None
+            and request_mcp_session_id in self._server_instances
+        ):  # pragma: no cover
             transport = self._server_instances[request_mcp_session_id]
             logger.debug("Session already exists, handling request directly")
             await transport.handle_request(scope, receive, send)
@@ -239,7 +244,9 @@ async def _handle_stateful_request(
                 logger.info(f"Created new transport with session ID: {new_session_id}")
 
                 # Define the server runner
-                async def run_server(*, task_status: TaskStatus[None] = anyio.TASK_STATUS_IGNORED) -> None:
+                async def run_server(
+                    *, task_status: TaskStatus[None] = anyio.TASK_STATUS_IGNORED
+                ) -> None:
                     async with http_transport.connect() as streams:
                         read_stream, write_stream = streams
                         task_status.started()
@@ -259,15 +266,18 @@ async def run_server(*, task_status: TaskStatus[None] = anyio.TASK_STATUS_IGNORE
                             # Only remove from instances if not terminated
                             if (  # pragma: no branch
                                 http_transport.mcp_session_id
-                                and http_transport.mcp_session_id in self._server_instances
+                                and http_transport.mcp_session_id
+                                in self._server_instances
                                 and not http_transport.is_terminated
                             ):
                                 logger.info(
                                     "Cleaning up crashed session "
                                     f"{http_transport.mcp_session_id} from "
                                     "active instances."
                                 )
-                                del self._server_instances[http_transport.mcp_session_id]
+                                del self._server_instances[
+                                    http_transport.mcp_session_id
+                                ]
 
                 # Assert task group is not None for type checking
                 assert self._task_group is not None
@@ -277,9 +287,10 @@ async def run_server(*, task_status: TaskStatus[None] = anyio.TASK_STATUS_IGNORE
                 # Handle the HTTP request and return the response
                 await http_transport.handle_request(scope, receive, send)
         else:  # pragma: no cover
-            # Invalid session ID
+            # Unknown or expired session ID - return 404 per MCP spec
+            # This tells the client to reinitialize
             response = Response(
-                "Bad Request: No valid session ID provided",
-                status_code=HTTPStatus.BAD_REQUEST,
+                "Session not found",
+                status_code=HTTPStatus.NOT_FOUND,
             )
             await response(scope, receive, send)