5.3.18

A client reads Mcp-Session-Id off the initialize response and sends it back on every call after that. WordPress exposes three headers to a cross-origin caller and this was not one of them, so the header went out and could not be read — and the second request failed for want of it. From outside that looks like the server not being an MCP server at all.