fix(streamable-http): mirror the transport's 405 shape (Allow header + body)

cubic-dev-ai flagged that the manager's manager-layer 405 for
PUT/PATCH/OPTIONS/HEAD without a session-id was missing the RFC 7231
``Allow`` header and diverged from the transport's response body. That
breaks clients / middleware that rely on the standard 405 metadata to
learn which methods are allowed on the resource.

The manager now mirrors ``StreamableHTTPServerTransport._handle_unsupported_request``
exactly:

  * Body: JSON-RPC error with message ``"Method Not Allowed"`` (previously
    ``"Method Not Allowed (PUT)"`` — a divergence).
  * Headers: ``Content-Type: application/json`` + ``Allow: GET, POST, DELETE``.

The 400 branch for GET/DELETE is unchanged.

The parametrized regression test now also asserts the ``Allow`` header
value for every 405 row (PUT/PATCH/OPTIONS/HEAD).

Author: raphaelOhana

src/mcp/server/streamable_http_manager.py

@@ -298,6 +298,12 @@ async def _handle_stateful_request(
                 # so the correct response for a missing session is 400 — matching
                 # the transport's existing "Missing session ID" wording. Anything
                 # else is a genuinely unsupported method, so 405 is more accurate.
+                # Both branches mirror the shape produced by
+                # ``StreamableHTTPServerTransport._create_error_response`` /
+                # ``_handle_unsupported_request`` so clients see the same
+                # JSON-RPC body and headers (including the RFC 7231 ``Allow``
+                # advertisement for 405) whether the rejection happens here or
+                # in the transport layer.
                 if request.method in ("GET", "DELETE"):
                     error_body = JSONRPCError(
                         jsonrpc="2.0",
@@ -313,12 +319,15 @@ async def _handle_stateful_request(
                     error_body = JSONRPCError(
                         jsonrpc="2.0",
                         id="server-error",
-                        error=ErrorData(code=INVALID_REQUEST, message=f"Method Not Allowed ({request.method})"),
+                        error=ErrorData(code=INVALID_REQUEST, message="Method Not Allowed"),
                     )
                     response = Response(
                         content=error_body.model_dump_json(by_alias=True, exclude_none=True),
                         status_code=405,
-                        media_type="application/json",
+                        headers={
+                            "Content-Type": "application/json",
+                            "Allow": "GET, POST, DELETE",
+                        },
                     )
                 await response(scope, receive, send)
                 return

tests/server/test_streamable_http_manager.py

@@ -469,6 +469,19 @@ async def mock_receive():  # pragma: no cover
         assert error_data["error"]["code"] == INVALID_REQUEST
         assert expected_message_substring in error_data["error"]["message"]
 
+        # RFC 7231: a 405 response must advertise the allowed methods via the
+        # ``Allow`` header. The manager's 405 mirrors the transport's shape
+        # (``Allow: GET, POST, DELETE``) exactly so downstream clients get
+        # identical metadata whether the rejection happens here or one layer
+        # deeper.
+        if expected_status == 405:
+            response_headers = {
+                name.decode().lower(): value.decode() for name, value in response_start.get("headers", [])
+            }
+            assert response_headers.get("allow") == "GET, POST, DELETE", (
+                f"405 response must include RFC 7231 Allow header — got headers={response_headers}"
+            )
+
 
 @pytest.mark.anyio
 async def test_bad_host_header_rejected_before_session_allocation():