Unable to communicate with tableau mcp over http mode

[orathee]

I am using below code to start an app but always get 400 bad request with Invalid or missing session ID error. I am using PAT and http to start the server.

@asynccontextmanager
async def lifespan(app: FastAPI):
    global agent
    logger.info("Starting up application...")

    try:
        # 🚀 Generate a unique session ID for this connection
        session_id = str(uuid.uuid4())
        
        # 🚀 Pass the session ID exactly where the Express server expects it
        custom_headers = {
            "x-session-id": session_id,
            "mcp-session-id": session_id
        }
        
        logger.info(f"Connecting to MCP Server at: {BASE_MCP_URL}")
        logger.info(f"Using Headers: {custom_headers}")

        # 🚀 Pass the headers into the sse_client
        async with sse_client(BASE_MCP_URL, headers=custom_headers) as (read, write):
            async with ClientSession(read, write) as client_session:

                await client_session.initialize()

                # Load MCP tools
                raw_tools  = await load_mcp_tools(client_session)

                filtered_tools = [t for t in raw_tools if t.name in ALLOWED_TOOLS]

                mcp_tools = build_hardened_tools(filtered_tools)

                # =========================
                # Azure OpenAI LLM
                # =========================
                llm = AzureChatOpenAI(
                    azure_endpoint=AZURE_ENDPOINT,
                    api_key=AZURE_API_KEY,
                    azure_deployment=AZURE_DEPLOYMENT,
                    api_version=AZURE_API_VERSION,
                    temperature=0,
                )

                checkpointer = InMemorySaver()

                agent = create_react_agent(
                    model=llm,
                    tools=mcp_tools,
                    prompt=AGENT_SYSTEM_PROMPT,
                    checkpointer=checkpointer,
                )

                yield

    except Exception as e:
        logger.error(f"Failed to initialize agent: {e}", exc_info=True)
        raise

Can someone help ?

[anyoung-tableau]

The client shouldn't create the session ID. The server creates the session ID and returns it to the client on the MCP-Session-Id header. The client should then include this session id on the MCP-Session-Id header in subsequent requests. Please refer to the MCP Session Management spec.

You can also disable session management by setting the DISABLE_SESSION_MANAGEMENT environment variable to true.

[orathee]

Thanks @anyoung-tableau for the clarification. I don't want to disable session management. Went through the documentation and now I am using streamable_http client instead of sse which solved the issue.

[orathee]

On another note. MCP server is ready now and connected to tableau cloud. The final challenge is how to implement RLS. I have rls filter defined in datasource and applied as datasource filter using the username() function. How do i pass the username from client app to tableau extract datasource. Without RLS we can't use it widely organization wide

1. Can I use the connected apps with Oauth 2.0 Trust instead of Direct Trust.
2. Or only oauth has to be used
3. Is there any Step by Step documentation/tutorial/video available that can help to apply the RLS

This is show stopper for us.

[anyoung-tableau]

1. Full Cloud support for OAuth is rolling out in the 2026.2 release of Tableau. We are aiming to include support for RLS with this release, but it may arrive slightly later. Until then, you still can enable OAuth with RLS support but only when the MCP server is accessed locally (e.g. http://127.0.01:3927/tableau-mcp).
2. OAuth is the preferred method. There is also a mode called Passthrough Auth where the user's Tableau access token can be provided directly on the request and Tableau MCP will "pass it through" to Tableau, enforcing RLS.
3. We are working on putting together a guide. There is one for Tableau Server customers in PR @W-21732161: Add deployment guide for Tableau Server customers #277 and we'll have one for Cloud customers as we roll out 2026.2.