According to https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#listening-for-messages-from-the-server

The client MAY issue an HTTP GET to the MCP endpoint. This can be used to open an SSE stream, allowing the server to communicate to the client, without the client first sending data via HTTP POST.

Does this mean the client can issue a GET request without any MCP session ID? Since the client doesn't send any data via HTTP POST, the server can not assign a session ID to it.

Should this request be treated as a legal MCP request? If it is, we don't know its client info and can't bind it to a certain session.