Pass app and security_settings explicitly to handle_modern_request

Drops the StreamableHTTPSessionManager dependency from the experimental
module; the handler only needs the lowlevel Server and the
TransportSecuritySettings.

Claude-Session: https://claude.ai/code/session_017S3aJaxEHeMvftp6whnHWK

Author: maxisbey

src/mcp/server/_experimental/streamable_http_modern.py

@@ -25,7 +25,7 @@
 from starlette.types import Receive, Scope, Send
 
 from mcp.server.runner import ServerRunner, otel_middleware
-from mcp.server.transport_security import TransportSecurityMiddleware
+from mcp.server.transport_security import TransportSecurityMiddleware, TransportSecuritySettings
 from mcp.shared.dispatcher import CallOptions, OnNotify, OnRequest
 from mcp.shared.exceptions import MCPError, NoBackChannelError
 from mcp.shared.message import MessageMetadata, ServerMessageMetadata
@@ -42,7 +42,7 @@
 )
 
 if TYPE_CHECKING:
-    from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
+    from mcp.server.lowlevel.server import Server
 
 logger = logging.getLogger(__name__)
 
@@ -157,7 +157,8 @@ async def handle(self, req: JSONRPCRequest, on_request: OnRequest) -> JSONRPCRes
 
 
 async def handle_modern_request(
-    manager: StreamableHTTPSessionManager,
+    app: Server[Any],
+    security_settings: TransportSecuritySettings | None,
     scope: Scope,
     receive: Receive,
     send: Send,
@@ -169,7 +170,7 @@ async def handle_modern_request(
     """
     request = Request(scope, receive)
 
-    security = TransportSecurityMiddleware(manager.security_settings)
+    security = TransportSecurityMiddleware(security_settings)
     err = await security.validate_request(request, is_post=(request.method == "POST"))
     if err is not None:
         await err(scope, receive, send)
@@ -196,9 +197,9 @@ async def handle_modern_request(
 
     dispatcher = SingleExchangeDispatcher(request)
     # TODO: per-request lifespan re-entry matches stateless_http=True today; revisit in #2893.
-    async with manager.app.lifespan(manager.app) as lifespan_state:
+    async with app.lifespan(app) as lifespan_state:
         runner = ServerRunner(
-            server=manager.app,
+            server=app,
             dispatcher=dispatcher,
             lifespan_state=lifespan_state,
             has_standalone_channel=False,

src/mcp/server/streamable_http_manager.py

@@ -155,7 +155,7 @@ async def handle_request(self, scope: Scope, receive: Receive, send: Send) -> No
         # (per SEP-2575) is a follow-up. 2025 paths below remain unchanged.
         pv = next((v.decode("latin-1") for k, v in scope["headers"] if k == b"mcp-protocol-version"), None)
         if pv == "2026-07-28":
-            await handle_modern_request(self, scope, receive, send)
+            await handle_modern_request(self.app, self.security_settings, scope, receive, send)
             return
 
         # Dispatch to the appropriate handler