fix(server): honor logging/setLevel when sendLoggingMessage omits sessionId

The logging/setLevel handler stores the level under the transport's
session id, but sendLoggingMessage(params) looked it up under an undefined
key. On session-bearing transports (Streamable HTTP, SSE) the client's
level was therefore ignored and every message was sent, while the same
call filtered correctly on stdio. Default the lookup to the connected
transport's session id.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: 2sumtech

.changeset/logging-level-default-session.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/server': patch
+---
+
+Make `sendLoggingMessage(params)` honor the level a client set with `logging/setLevel` on session-bearing transports. The `logging/setLevel` handler stores the level under the transport's session id, but `sendLoggingMessage` looked it up under the `sessionId` argument, which is `undefined` when omitted, as in the documented example. On Streamable HTTP and SSE every message was sent regardless of the client's level, while the same call filtered correctly on stdio. When no `sessionId` is passed, the lookup now uses the connected transport's session id. Passing one explicitly works as before.

packages/server/src/server/server.ts

@@ -435,8 +435,11 @@ export class Server extends Protocol<ServerContext> {
     private readonly LOG_LEVEL_SEVERITY = new Map(LoggingLevelSchema.options.map((level, index) => [level, index]));
 
     // Is a message with the given level ignored in the log level set for the given session id?
+    // Without an explicit session id, use the connected transport's: `logging/setLevel` stored
+    // the level under it, so on Streamable HTTP or SSE `sendLoggingMessage(params)` would
+    // otherwise skip the filter the client asked for.
     private isMessageIgnored = (level: LoggingLevel, sessionId?: string): boolean => {
-        const currentLevel = this._loggingLevels.get(sessionId);
+        const currentLevel = this._loggingLevels.get(sessionId ?? this.transport?.sessionId);
         return currentLevel ? this.LOG_LEVEL_SEVERITY.get(level)! < this.LOG_LEVEL_SEVERITY.get(currentLevel)! : false;
     };
 

test/integration/test/server.test.ts

@@ -1956,6 +1956,33 @@ test('should respect log level for transport with sessionId', async () => {
     expect(clientTransport.onmessage).toHaveBeenCalled();
 });
 
+test('should respect log level for transport with sessionId when sendLoggingMessage omits sessionId', async () => {
+    // Session-bearing transports (Streamable HTTP, SSE) store the level set by
+    // logging/setLevel under the transport's session id. The documented call
+    // `sendLoggingMessage(params)` must honor it, as it does on stdio.
+    const server = new Server({ name: 'test server', version: '1.0' }, { capabilities: { logging: {} } });
+    const client = new Client({ name: 'test client', version: '1.0' });
+
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    clientTransport.sessionId = 'test-session-id';
+    serverTransport.sessionId = 'test-session-id';
+
+    await Promise.all([client.connect(clientTransport), server.connect(serverTransport)]);
+    await client.setLoggingLevel('warning');
+
+    const received: string[] = [];
+    clientTransport.onmessage = message => {
+        if ('method' in message && message.method === 'notifications/message') {
+            received.push(message.params?.level as string);
+        }
+    };
+
+    await server.sendLoggingMessage({ level: 'debug', data: 'Debug message' });
+    await server.sendLoggingMessage({ level: 'warning', data: 'Warning message' });
+
+    expect(received).toEqual(['warning']);
+});
+
 describe('createMcpExpressApp', () => {
     test('should create an Express app', () => {
         const app = createMcpExpressApp();