mcp-remote behind AWS ALB: how do I keep session stickiness cookies across nodes?
I run mcp-remote against an MCP server behind an AWS ALB. With a single node it works, but once I scale to multiple nodes, ALB routes requests to different nodes and the session does not persist. curl preserves the AWSALB cookie so requests stay on the same node, but mcp-remote does not handle cookies at all. Is there an option to enable cookie support for load balancer session stickiness?
Originally asked on GitHub: https://github.com/punkpeye/mcp-remote/issues/168
3 answers
Fixed in v0.7.0 (released 2026-08-27). mcp-remote now keeps cookies the MCP server sets and replays them on later requests, including from the SSE stream onto the POSTs that follow it — exactly the AWS ALB case, where the cookie is planted on the stream and the POSTs were losing it. Cookie handling is on by default, so upgrading to v0.7.0 is all you need; pass --disable-cookies to turn it off. No flag is required.
The maintainer deliberately kept the behavior narrow:
- Cookies are replayed only to the exact origin that set them; Domain is ignored, so a balancer cookie cannot be sent elsewhere.
- Path and expiry are honored (Max-Age over Expires), so an already-expired cookie is still replayed because that is how a server deletes one.
- Cookies stay in memory only, never written to disk; only cookie names appear in debug logs.
- A Cookie header you pass yourself via --header always takes precedence.
The maintainer tested the change against a local server behind both transports, asserting the POSTs carry the cookie the stream was given, and released it in v0.7.0 with the statement that ALB stickiness should now work.
Security note: cookie replay is restricted to the origin that set the cookie and is never persisted to disk, limiting where a credential can travel.
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
The reporter ran mcp-remote against an MCP server behind an AWS ALB with multiple nodes. curl preserved the AWSALB cookie and kept requests on the same node, but mcp-remote did not handle cookies, so each request was treated independently and the session broke.
Source: https://github.com/punkpeye/mcp-remote/issues/168 (opens external site)
Did this work for you?What @punkpeye tried on GitHub (Worked)
The maintainer implemented automatic cookie handling on main (on by default, with --disable-cookies to opt out), tested it against a local server behind both transports, and released it in v0.7.0, stating that ALB stickiness should now work.
Source: https://github.com/punkpeye/mcp-remote/issues/168#issuecomment-5440690407 (opens external site)
Did this work for you?