Hosted Streamable HTTP endpoint returns 404 on session DELETE after successful tool call

[ryanhalphide]

Summary

The hosted Streamable HTTP endpoint returns HTTP 404 when an MCP client attempts to terminate a session with DELETE after a successful tool call.

The tool call itself succeeds, but the client logs an error during shutdown:

ERROR rmcp::transport::streamable_http_client: fail to delete session: unexpected server response: DELETE returned HTTP 404 session_id="<redacted>"

Reproduction

1. Configure the hosted MCP endpoint with a project-scoped, read-only URL:

   https://mcp.supabase.com/mcp?project_ref=<redacted>&read_only=true&features=docs%2Cdatabase%2Cdebugging
   

2. Complete OAuth using read-only scopes:

   organizations:read,projects:read,database:read,analytics:read
   

3. Invoke supabase/list_tables.

4. Allow the client session to close normally.

Observed result

• supabase/list_tables completes successfully.
• The client then sends the session-termination DELETE request.
• The hosted endpoint responds with HTTP 404, producing the error above.

Expected result

Normal session shutdown should not emit an error after a successful tool call. The endpoint should either accept the session-termination request or otherwise handle unsupported termination without returning a misleading 404.

Environment

• Hosted endpoint: https://mcp.supabase.com/mcp
• Client: OpenAI Codex CLI
• Reproduced on Codex 0.151.0 and current 0.152.1
• Transport implementation in the client log: rmcp::transport::streamable_http_client
• Platform: macOS arm64

No project reference, OAuth token, session token, table names, or row data is included here.

Impact

This does not currently block Supabase MCP tool calls, but it creates false failure noise in MCP health checks and makes successful sessions appear unhealthy.