Session-lifecycle bookkeeping logs at info, spamming multiple log lines per request on stateless streamable HTTP

[tjhop]

Describe the bug
Found this while working on adding stateless HTTP support to the Prometheus MCP server

TL;DR: the current implementation of the new 2026-07-28 spec, and the stateless HTTP support specifically, are spamming logs with in-actionable session bookkeeping.

Summary:
The server's internal slog records for session bookkeeping (server connecting, server session connected, server session disconnected, session initialized, client log level set) all log at Info. These logs were reasonable when they were added and HTTP was stateful since they were per-session events. Now though, they're per-request:

• Stateless streamable HTTP mints a session per POST: every single request replays the connect/disconnect lifecycle.
• 2026-07-28 clients carry _meta on every request, so setLevel runs, logging client log level set once per request, on every transport (stdio included), even when the client set no level at all (the record fires with level="").

The result:
A server running at a normal info log level gets four lines of pure bookkeeping for every tool call, and this is before it logs anything of its own.

To Reproduce
Steps to reproduce the behavior:
go-sdk v1.7.0, stateless streamable HTTP, one client connect plus one tools/call:

package main

import (
	"context"
	"fmt"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"os"

	"github.com/modelcontextprotocol/go-sdk/mcp"
)

func main() {
	logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{
		Level: slog.LevelInfo,
		ReplaceAttr: func(groups []string, a slog.Attr) slog.Attr {
			if a.Key == slog.TimeKey && len(groups) == 0 {
				return slog.Attr{} // drop timestamps for a stable transcript
			}
			return a
		},
	}))

	server := mcp.NewServer(&mcp.Implementation{Name: "probe-server", Version: "0.0.1"}, &mcp.ServerOptions{
		Logger: logger,
	})
	mcp.AddTool(server, &mcp.Tool{Name: "echo", Description: "echo"}, func(ctx context.Context, req *mcp.CallToolRequest, input struct{}) (*mcp.CallToolResult, any, error) {
		return &mcp.CallToolResult{Content: []mcp.Content{&mcp.TextContent{Text: "ok"}}}, nil, nil
	})

	handler := mcp.NewStreamableHTTPHandler(func(*http.Request) *mcp.Server { return server }, &mcp.StreamableHTTPOptions{
		Stateless: true,
	})
	httpServer := httptest.NewServer(handler)
	defer httpServer.Close()

	ctx := context.Background()
	client := mcp.NewClient(&mcp.Implementation{Name: "probe-client", Version: "0.0.1"}, nil)
	session, err := client.Connect(ctx, &mcp.StreamableClientTransport{Endpoint: httpServer.URL}, nil)
	if err != nil {
		panic(err)
	}
	defer session.Close()

	fmt.Println("--- one tools/call ---")
	if _, err := session.CallTool(ctx, &mcp.CallToolParams{Name: "echo"}); err != nil {
		panic(err)
	}
	fmt.Println("--- end of tools/call ---")
}

Expected behavior
To see the debug logs in my debug stream 🙃

Logs

Output from repro ^

level=INFO msg="server connecting"
level=INFO msg="server session connected" session_id=""
level=INFO msg="client log level set" level=""
level=INFO msg="server session disconnected" session_id=""
--- one tools/call ---
level=INFO msg="server connecting"
level=INFO msg="server session connected" session_id=""
level=INFO msg="client log level set" level=""
level=INFO msg="server session disconnected" session_id=""
--- end of tools/call ---

Additional context
That's four info lines per request, none of which carry information an admin can act on. At any real request rate, these events dominate the log stream. Note also client log level set firing with level="" — the client never asked for anything.

On stdio the amplification is smaller but still per-request -- the client log level set event triggers on every request it sends.

These log events were added in #501 with the reasoning "to improve debuggability", so let's demote them to debug where they belong.