# Fix: GET on the MCP endpoint answers fast (not a held-open hang)

> Web-audit fix skill for the `mcp-get-fast-fail` check (MCP & API, SHOULD).

## Goal

Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.

## Fix

Answer a `GET` on the MCP endpoint promptly; this check fails only when the connection is
held open. A streamable-HTTP `GET` routed into the transport opens the server-to-client SSE
notification stream, and a stateless server (nothing to push) parks that connection until the
caller times out. Answer one of two ways instead: fast-fail non-`POST` at the router with
`405 Method Not Allowed` and an `Allow: POST` header; or serve a documented surface on `GET`
(a human- and agent-readable docs page, or a redirect to your `.well-known` MCP server card)
so the `GET` returns content rather than a rejection. Any prompt, completed response passes
(a fast-fail status, or a documented `2xx`/redirect); only a held-open hang or a `5xx` fails.

## Resources

- [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)

## Copy-paste prompt

Paste this into your coding agent, replacing the Issue line with the Result line from [your audit](https://anc.dev/web-audit):

```text
Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang
Issue: <the audit's finding for this check>
Fix: Answer a `GET` on the MCP endpoint promptly; this check fails only when the connection is held open. A streamable-HTTP `GET` routed into the transport opens the server-to-client SSE notification stream, and a stateless server (nothing to push) parks that connection until the caller times out. Answer one of two ways instead: fast-fail non-`POST` at the router with `405 Method Not Allowed` and an `Allow: POST` header; or serve a documented surface on `GET` (a human- and agent-readable docs page, or a redirect to your `.well-known` MCP server card) so the `GET` returns content rather than a rejection. Any prompt, completed response passes (a fast-fail status, or a documented `2xx`/redirect); only a held-open hang or a `5xx` fails.
Skill: https://anc.dev/web-audit/skill/mcp-get-fast-fail
Docs: https://modelcontextprotocol.io/specification/2025-06-18/basic/transports
```

## Verify

Re-run the audit at [https://anc.dev/web-audit](https://anc.dev/web-audit) or call the `audit_website` MCP tool; the `mcp-get-fast-fail` check should report `pass`.