mcp 1.6.0 → 1.7.0

data/lib/mcp/server/transports/streamable_http_transport.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "set"
 require_relative "../../result_type"
 require_relative "../../transport"
 
@@ -48,6 +49,20 @@ module MCP
         # pass `max_listen_subscriptions: nil` to opt out.
         DEFAULT_MAX_LISTEN_SUBSCRIPTIONS = 1_000
 
+        # Bound on the bytes of resource URIs one `subscriptions/listen` request may name in `resourceSubscriptions`
+        # (the sum of their byte lengths after duplicates are dropped). The URIs are held for the life of the stream,
+        # so without a bound each stream could retain a request body's worth of URIs and the retained total would be
+        # `max_listen_subscriptions` times `max_request_bytes`. 64 KiB names about a thousand ordinary URIs;
+        # pass `max_resource_subscription_bytes: nil` to opt out. The specification sets no limit, nor do the TypeScript
+        # and Python SDKs; this is the same kind of local safety limit as `max_request_bytes`.
+        DEFAULT_MAX_RESOURCE_SUBSCRIPTION_BYTES = 64 * 1024
+
+        # Bound on the number of distinct resource URIs one `subscriptions/listen` request may name. A byte bound does
+        # not tightly bound the memory a stream keeps, since each retained URI carries a fixed per-object cost however
+        # short it is, so the count is bounded as well. Like `MAX_JSON_NESTING`, it is a structural limit applied
+        # whatever `max_resource_subscription_bytes` is, including `nil`.
+        MAX_RESOURCE_SUBSCRIPTION_URIS = 1_024
+
         # Distinguishes "argument omitted, apply the secure default" from an explicit `nil` (opt out of expiry).
         UNSET_IDLE_TIMEOUT = Object.new.freeze
         private_constant :UNSET_IDLE_TIMEOUT
@@ -67,14 +82,27 @@ module MCP
         # https://modelcontextprotocol.io/specification/2025-11-25/basic/lifecycle#timeouts
         DEFAULT_SERVER_TO_CLIENT_REQUEST_TIMEOUT = 600
 
-        # Default upper bound on the JSON-RPC request body. `handle_post` reads the whole
-        # body into memory and parses it, so without a cap a single unauthenticated POST
-        # can allocate gigabytes and OOM the worker. 4 MiB comfortably
-        # fits a typical JSON-RPC request (a 4 MiB JSON string decodes to ~3 MiB of base64
-        # payload); raise `max_request_bytes:` for unusually large payloads. Matches the
-        # TypeScript SDK's 4 MB default.
+        # Default upper bound on the JSON-RPC request body. `handle_post` reads the whole body into memory and parses it,
+        # so without a cap a single unauthenticated POST can allocate gigabytes and OOM the worker. 4 MiB comfortably fits
+        # a typical JSON-RPC request (a 4 MiB JSON string decodes to ~3 MiB of base64 payload); raise `max_request_bytes:`
+        # for unusually large payloads. Matches the TypeScript SDK's 4 MB default.
         DEFAULT_MAX_REQUEST_BYTES = 4 * 1024 * 1024
 
+        # Bound on the body of an `initialize` request in stateful mode. Its `clientInfo` and `capabilities` are
+        # kept for the life of the session, so without a bound of its own each session could retain a whole
+        # `max_request_bytes` body and the retained total would be `max_sessions` times that. An ordinary
+        # `initialize` is under 2 KiB; 64 KiB leaves room for large `experimental` capabilities. Pass
+        # `max_initialize_request_bytes: nil` to opt out. The TypeScript and Python SDKs keep the initialize
+        # data whole with no bound of their own; this is the same kind of local safety limit as `max_request_bytes`.
+        DEFAULT_MAX_INITIALIZE_REQUEST_BYTES = 64 * 1024
+
+        # Bound on the number of JSON values (objects, arrays, keys, and scalars) in the `params` of an `initialize`
+        # request in stateful mode. A byte bound alone does not tightly bound the memory a session keeps: a body of
+        # many small values parses into far more objects than its size suggests, so the parsed structure is bounded
+        # as well. Like `MAX_JSON_NESTING`, it is a structural limit applied whatever `max_initialize_request_bytes`
+        # is, including `nil`. An ordinary `initialize` holds a few dozen values.
+        MAX_INITIALIZE_PARAMS_VALUES = 1_024
+
         # Conservative bound on JSON nesting depth, so a deeply nested body cannot exhaust
         # the stack or amplify parse cost (complements the byte cap).
         MAX_JSON_NESTING = 64
@@ -122,9 +150,19 @@ module MCP
         #   ownership is not enforced.
         # @param max_request_bytes [Integer] upper bound in bytes on a POST request body; larger
         #   requests are rejected with HTTP 413. Defaults to 4 MiB.
+        # @param max_initialize_request_bytes [Integer, nil] upper bound in bytes on the body of an `initialize`
+        #   request in stateful mode, whose `clientInfo` and `capabilities` the session keeps; a larger one is
+        #   rejected with HTTP 413 before any session is created. Defaults to `DEFAULT_MAX_INITIALIZE_REQUEST_BYTES`
+        #   (64 KiB), and `nil` disables this bound, leaving `max_request_bytes` as the only cap on the body; `params`
+        #   holding more than `MAX_INITIALIZE_PARAMS_VALUES` JSON values are rejected the same way either way.
+        #   Neither applies in stateless mode, which retains nothing.
         # @param max_listen_subscriptions [Integer, nil] cap on concurrent `subscriptions/listen`
         #   streams; a listen request past the cap is rejected with HTTP 503, and `nil` disables
         #   the cap.
+        # @param max_resource_subscription_bytes [Integer, nil] bound on the total byte length of the distinct
+        #   resource URIs one `subscriptions/listen` request names in `resourceSubscriptions`; a request over
+        #   the bound is rejected with HTTP 400 and JSON-RPC `-32602`.
+        #   Defaults to `DEFAULT_MAX_RESOURCE_SUBSCRIPTION_BYTES` (64 KiB), and `nil` disables the bound.
         # @param listen_keepalive_interval [Numeric, nil] seconds between SSE keepalive comment frames
         #   on a `subscriptions/listen` stream; the periodic write frees the stream's slot when the peer
         #   has gone away. Defaults to `DEFAULT_LISTEN_KEEPALIVE_INTERVAL` (15); pass `nil` to disable
@@ -149,7 +187,9 @@ module MCP
           dns_rebinding_protection: true,
           session_request_validator: nil,
           max_request_bytes: DEFAULT_MAX_REQUEST_BYTES,
+          max_initialize_request_bytes: DEFAULT_MAX_INITIALIZE_REQUEST_BYTES,
           max_listen_subscriptions: DEFAULT_MAX_LISTEN_SUBSCRIPTIONS,
+          max_resource_subscription_bytes: DEFAULT_MAX_RESOURCE_SUBSCRIPTION_BYTES,
           listen_keepalive_interval: DEFAULT_LISTEN_KEEPALIVE_INTERVAL,
           serve_subscriptions_listen: true,
           server_to_client_request_timeout: DEFAULT_SERVER_TO_CLIENT_REQUEST_TIMEOUT
@@ -169,8 +209,13 @@ module MCP
           @allowed_origins = Array(allowed_origins).map(&:downcase).freeze
           @pending_responses = {}
 
-          # Maps a `subscriptions/listen` request id to
-          # `{ stream: stream_object, filter: honored_subscription_filter, active: boolean, write_mutex: Mutex }` (SEP-2575).
+          # Maps a key the transport mints for each `subscriptions/listen` stream to
+          # `{ request_id: listen_request_id, stream: stream_object, filter: honored_list_changed_flags,
+          # resource_uris: Set_of_honored_resource_uris, active: boolean, write_mutex: Mutex,
+          # keepalive_wakeup: ConditionVariable }` (SEP-2575). The request id is the client's,
+          # unique only among that client's own in-flight requests, so it stamps `subscriptionId` but cannot serve as the key:
+          # two clients may pick the same one. Whoever removes an entry signals `keepalive_wakeup` under `@mutex`,
+          # so the stream's keepalive thread ends with its slot instead of sleeping out its interval.
           # In-process only; a multi-worker deployment needs an external event bus to fan notifications out across processes,
           # which is a follow-up.
           @listen_subscriptions = {}
@@ -208,12 +253,25 @@ module MCP
 
           @max_request_bytes = max_request_bytes
 
+          if !max_initialize_request_bytes.nil? && !(max_initialize_request_bytes.is_a?(Integer) && max_initialize_request_bytes > 0)
+            raise ArgumentError, "max_initialize_request_bytes must be a positive Integer or nil"
+          end
+
+          # The bound guards what stateful sessions retain; stateless mode keeps none.
+          @max_initialize_request_bytes = stateless ? nil : max_initialize_request_bytes
+
           if !max_listen_subscriptions.nil? && !(max_listen_subscriptions.is_a?(Integer) && max_listen_subscriptions > 0)
             raise ArgumentError, "max_listen_subscriptions must be a positive Integer or nil"
           end
 
           @max_listen_subscriptions = max_listen_subscriptions
 
+          if !max_resource_subscription_bytes.nil? && !(max_resource_subscription_bytes.is_a?(Integer) && max_resource_subscription_bytes > 0)
+            raise ArgumentError, "max_resource_subscription_bytes must be a positive Integer or nil"
+          end
+
+          @max_resource_subscription_bytes = max_resource_subscription_bytes
+
           if !listen_keepalive_interval.nil? && !(listen_keepalive_interval.is_a?(Numeric) && listen_keepalive_interval > 0)
             raise ArgumentError, "listen_keepalive_interval must be a positive number or nil"
           end
@@ -846,6 +904,14 @@ module MCP
             return invalid_request_response("Invalid Request: subscriptions/listen requires an id")
           end
 
+          # The id is echoed in every message of the stream, so one that cannot be written back as JSON
+          # (a String holding bytes that are not valid UTF-8 parses, but does not generate) is refused here,
+          # while the refusal can still answer with a null id, rather than surfacing as a failed write after
+          # the stream has been registered.
+          unless json_encodable?(request_id)
+            return invalid_request_response("Invalid Request: subscriptions/listen id must be valid UTF-8")
+          end
+
           begin
             if RequestEnvelope.modern?(params)
               RequestEnvelope.parse!(params, request: params)
@@ -872,6 +938,15 @@ module MCP
             )
           end
 
+          if (problem = resource_subscriptions_problem(filter))
+            return json_rpc_error_response(
+              status: 400,
+              code: JsonRpcHandler::ErrorCode::INVALID_PARAMS,
+              message: "Invalid params: subscriptions/listen #{problem}",
+              id: request_id,
+            )
+          end
+
           # Best-effort cap check before committing to the SSE response; the registration inside
           # `listen_sse_body` re-checks atomically for the race between two concurrent listens
           # crossing the cap together.
@@ -879,7 +954,43 @@ module MCP
             return too_many_listen_subscriptions_response(request_id)
           end
 
-          [200, SSE_HEADERS.dup, listen_sse_body(request_id, honored_filter(filter))]
+          honored = honored_filter(filter)
+
+          # The acknowledgement echoes the honored filter, whose resource URIs are client-supplied strings,
+          # so it is encoded before the stream is committed to: a URI that cannot be written as JSON is
+          # refused with a 400 instead of failing the first write after the stream was registered.
+          unless (acknowledgement = listen_acknowledgement_json(request_id, honored))
+            return json_rpc_error_response(
+              status: 400,
+              code: JsonRpcHandler::ErrorCode::INVALID_PARAMS,
+              message: "Invalid params: subscriptions/listen `notifications` must be valid UTF-8",
+              id: request_id,
+            )
+          end
+
+          [200, SSE_HEADERS.dup, listen_sse_body(request_id, honored, acknowledgement)]
+        end
+
+        # The `notifications/subscriptions/acknowledged` frame for a listen stream as JSON, or `nil` when
+        # the request id or the honored filter holds a string JSON cannot encode.
+        def listen_acknowledgement_json(request_id, honored)
+          {
+            jsonrpc: "2.0",
+            method: Methods::NOTIFICATIONS_SUBSCRIPTIONS_ACKNOWLEDGED,
+            params: {
+              notifications: honored,
+              _meta: { RequestEnvelope::SUBSCRIPTION_ID_META_KEY.to_sym => request_id },
+            },
+          }.to_json
+        rescue JSON::GeneratorError
+          nil
+        end
+
+        def json_encodable?(value)
+          value.to_json
+          true
+        rescue JSON::GeneratorError
+          false
         end
 
         def listen_subscriptions_full?
@@ -925,95 +1036,128 @@ module MCP
         # the legacy GET stream (`create_sse_body`).
         #
         # Registration and activation are split on purpose: the entry is inserted inactive
-        # (reserving the id and the cap slot atomically), the acknowledgement is written outside the lock,
+        # (reserving the cap slot atomically), the acknowledgement is written outside the registry lock,
         # and only then does the entry become eligible for delivery. A concurrent notification between
         # the insert and the acknowledgement write skips the inactive entry,
         # enforcing the SEP-2575 rule that no notification precedes the acknowledgement.
-        def listen_sse_body(request_id, honored)
+        #
+        # The acknowledgement write holds the stream's write mutex, which `teardown_listen_subscriptions` also takes
+        # before it marks an entry closed. The two therefore cannot interleave: the acknowledgement either lands
+        # before the result, or, if the transport closed first, is not written at all and the stream just closes,
+        # so no stream ever carries a result ahead of its acknowledgement.
+        #
+        # The entry is keyed by an identifier minted here, not by the request id: that id is unique only among
+        # the requesting client's own in-flight requests, and two clients that pick the same one must each get
+        # their stream, stamped with the id they sent.
+        def listen_sse_body(request_id, honored, acknowledgement)
           ListenStreamBody.new do |stream|
-            rejected = false
+            subscription_key = SecureRandom.uuid
+            subscription = nil
+            # The entry keeps the list-changed flags of the honored filter and the URIs as a frozen Set, both built ahead of the registry lock:
+            # delivery looks each notification's URI up in constant time, so neither the matching cost nor the lock hold grows with
+            # the number of URIs a stream named. The entry does not keep the Array the acknowledgement echoes; that one lives only as long as
+            # the host keeps this response body.
+            entry_filter = honored.reject { |name, _value| name == :resourceSubscriptions }
+            resource_uris = Set.new(honored[:resourceSubscriptions] || []).freeze
+
             @mutex.synchronize do
-              if @listen_subscriptions.key?(request_id) ||
-                  (@max_listen_subscriptions && @listen_subscriptions.size >= @max_listen_subscriptions)
-                rejected = true
-              else
-                @listen_subscriptions[request_id] = { stream: stream, filter: honored, active: false, write_mutex: Mutex.new }
+              unless @max_listen_subscriptions && @listen_subscriptions.size >= @max_listen_subscriptions
+                subscription = {
+                  request_id: request_id, stream: stream, filter: entry_filter, resource_uris: resource_uris, active: false,
+                  write_mutex: Mutex.new, keepalive_wakeup: ConditionVariable.new,
+                }
+                @listen_subscriptions[subscription_key] = subscription
               end
             end
 
-            if rejected
+            if subscription.nil?
               close_stream_safely(stream)
             else
-              acknowledgement = {
-                jsonrpc: "2.0",
-                method: Methods::NOTIFICATIONS_SUBSCRIPTIONS_ACKNOWLEDGED,
-                params: {
-                  notifications: honored,
-                  _meta: { RequestEnvelope::SUBSCRIPTION_ID_META_KEY.to_sym => request_id },
-                },
-              }
-
               begin
-                send_to_stream(stream, acknowledgement)
-                activate_listen_subscription(request_id)
-                start_listen_keepalive_thread(request_id)
+                acknowledged = subscription[:write_mutex].synchronize do
+                  next false if subscription[:closed]
+
+                  send_to_stream(stream, acknowledgement)
+
+                  # Set on the entry itself, not through the registry: a concurrent close may already have cleared the registry
+                  # while its result write waits on this mutex, and that write must still find the stream acknowledged.
+                  # Set under the registry lock as well, since that is the lock the delivery snapshot reads the flag under.
+                  # This is the one place a write mutex is held while the registry lock is taken; it stays deadlock-free only
+                  # as long as no path takes a write mutex inside `@mutex.synchronize`, so resolve entries under `@mutex`,
+                  # release it, then write.
+                  @mutex.synchronize { subscription[:active] = true }
+
+                  true
+                end
+
+                if acknowledged
+                  start_listen_keepalive_thread(subscription_key, request_id)
+                else
+                  close_removed_listen_stream(subscription)
+                end
               rescue *STREAM_WRITE_ERRORS
-                remove_listen_subscription(request_id)
-                close_stream_safely(stream)
+                remove_listen_subscription(subscription_key)
+                close_removed_listen_stream(subscription)
               end
             end
           end
         end
 
-        # Marks a listen subscription eligible for delivery once its acknowledgement write has completed.
-        # The entry may already be gone when the transport closed concurrently.
-        def activate_listen_subscription(request_id)
-          @mutex.synchronize do
-            subscription = @listen_subscriptions[request_id]
-            subscription[:active] = true if subscription
-          end
-        end
-
         # Periodically writes an SSE keepalive comment frame to a listen stream so a silently dropped
         # connection is detected and its slot freed, rather than held until the next fan-out write.
         # Mirrors the legacy GET stream's `start_keepalive_thread`; a comment frame (not a data frame)
         # cannot corrupt an interleaved notification's JSON.
-        def start_listen_keepalive_thread(request_id)
+        #
+        # The wait between pings is a condition variable wait under `@mutex`, not a plain sleep:
+        # the presence check and the wait happen under the same lock that removals signal from,
+        # so a removal cannot slip in between them and a thread waiting out its interval wakes
+        # at once when its entry goes, whichever path removed it. A thread already past the wait,
+        # in a ping, finishes that write first and then finds its entry gone.
+        def start_listen_keepalive_thread(subscription_key, request_id)
           return unless @listen_keepalive_interval
 
           Thread.new do
-            while listen_subscription_active?(request_id)
-              sleep(@listen_keepalive_interval)
-              send_listen_keepalive_ping(request_id)
+            loop do
+              registered = @mutex.synchronize do
+                subscription = @listen_subscriptions[subscription_key]
+                next false unless subscription
+
+                subscription[:keepalive_wakeup].wait(@mutex, @listen_keepalive_interval)
+
+                @listen_subscriptions.key?(subscription_key)
+              end
+              break unless registered
+
+              send_listen_keepalive_ping(subscription_key)
             end
           rescue *STREAM_WRITE_ERRORS
             # The peer went away; the ensure frees the slot. A dropped listen stream is the normal
             # way this loop ends, so it is not reported.
           rescue StandardError => e
+            # The request id is taken from the caller rather than the registry: a delivery failure may have
+            # removed the entry already, and the report should still name the stream.
             MCP.configuration.exception_reporter.call(e, { subscription_id: request_id })
           ensure
-            stream = @mutex.synchronize do
-              subscription = @listen_subscriptions.delete(request_id)
-              subscription && subscription[:stream]
-            end
-            close_stream_safely(stream) if stream
+            # Through the helper, so the entry is marked closed here as it is for every other removal.
+            subscription = remove_listen_subscription(subscription_key)
+            close_removed_listen_stream(subscription) if subscription
           end
         end
 
-        def listen_subscription_active?(request_id)
-          @mutex.synchronize { @listen_subscriptions.key?(request_id) }
-        end
+        # Resolves the entry under the registry lock, then writes outside it so a stalled reader cannot
+        # block every other subscription on `@mutex`. The write itself holds the stream's write mutex,
+        # like notification delivery and the closing result: the comment frame then cannot land between
+        # the bytes of a notification or after the closing result, and once teardown has marked
+        # the entry closed the ping is skipped. A write error propagates to end the keepalive loop.
+        def send_listen_keepalive_ping(subscription_key)
+          subscription = @mutex.synchronize { @listen_subscriptions[subscription_key] }
+          return unless subscription
 
-        # Resolves the stream under the lock, then writes outside it so a stalled reader cannot block
-        # every other subscription on `@mutex`. A write error propagates to end the keepalive loop.
-        def send_listen_keepalive_ping(request_id)
-          stream = @mutex.synchronize do
-            subscription = @listen_subscriptions[request_id]
-            subscription && subscription[:stream]
-          end
-          return unless stream
+          subscription[:write_mutex].synchronize do
+            next if subscription[:closed]
 
-          send_ping_to_stream(stream)
+            send_ping_to_stream(subscription[:stream])
+          end
         end
 
         # Per SEP-2575, the server MUST NOT send notification types the client has not requested,
@@ -1028,12 +1172,36 @@ module MCP
 
           subscriptions = filter[:resourceSubscriptions]
           if capability_flag?(capabilities, :resources, :subscribe) && subscriptions.is_a?(Array) && !subscriptions.empty?
-            honored[:resourceSubscriptions] = subscriptions
+            honored[:resourceSubscriptions] = subscriptions.uniq
           end
 
           honored
         end
 
+        # Checks a listen filter's `resourceSubscriptions` against the schema, which types it as an optional array of strings,
+        # so a member that is present but `null` is refused like any other non-array; against `MAX_RESOURCE_SUBSCRIPTION_URIS`;
+        # and against `max_resource_subscription_bytes`, returning the problem to report or `nil`. Duplicates are dropped before
+        # the bounds are measured, since they are dropped before storage too. The checks run whether or not the server declares
+        # the `subscribe` capability: a request that violates the schema is invalid regardless of what would be honored,
+        # and the bounds are limits on the request itself, like `max_request_bytes`, not on what the server would retain from it.
+        def resource_subscriptions_problem(filter)
+          return unless filter.key?(:resourceSubscriptions)
+
+          subscriptions = filter[:resourceSubscriptions]
+          unless subscriptions.is_a?(Array) && subscriptions.all? { |uri| uri.is_a?(String) }
+            return "`resourceSubscriptions` must be an array of strings"
+          end
+
+          distinct = subscriptions.uniq
+          if distinct.size > MAX_RESOURCE_SUBSCRIPTION_URIS
+            return "`resourceSubscriptions` exceeds #{MAX_RESOURCE_SUBSCRIPTION_URIS} URIs"
+          end
+          return unless @max_resource_subscription_bytes
+          return if distinct.sum(&:bytesize) <= @max_resource_subscription_bytes
+
+          "`resourceSubscriptions` exceeds #{@max_resource_subscription_bytes} bytes"
+        end
+
         # Reads a nested capability flag tolerating both symbol and string keys, since user-supplied capability hashes arrive
         # in either form. The flag that promises delivery (`listChanged` / `subscribe`) decides honoring, the same derivation
         # `Server#discover` uses for its era-aware capability stripping; the mere presence of the primitive's capability is not enough.
@@ -1051,28 +1219,20 @@ module MCP
           field = LISTEN_FILTER_FIELDS[method]
           return if field.nil? && method != Methods::NOTIFICATIONS_RESOURCES_UPDATED
 
-          # The matching snapshot is taken under `@mutex`, but stream writes happen outside it:
-          # a slow or stalled subscriber must not block the transport, matching the legacy delivery paths.
-          matched = @mutex.synchronize do
-            @listen_subscriptions.filter_map do |request_id, subscription|
-              # An inactive entry has not finished writing its acknowledgement yet;
-              # delivering to it would put a notification ahead of the acknowledgement.
-              next unless subscription[:active]
-
-              hit = if field
-                subscription[:filter][field]
-              else
-                uris = subscription[:filter][:resourceSubscriptions]
-                uri = params.is_a?(Hash) ? params[:uri] || params["uri"] : nil
-                uris.is_a?(Array) && uris.include?(uri)
-              end
+          # Only the snapshot of active entries is taken under `@mutex`, one pass over the entries as before;
+          # the matching and the stream writes happen outside it, so neither the number of URIs the streams named
+          # nor a slow or stalled subscriber can hold the transport's lock, matching the legacy delivery paths.
+          # An inactive entry has not finished writing its acknowledgement yet;
+          # delivering to it would put a notification ahead of the acknowledgement.
+          candidates = @mutex.synchronize { @listen_subscriptions.select { |_key, subscription| subscription[:active] } }
 
-              [request_id, subscription] if hit
-            end
+          uri = params.is_a?(Hash) ? params[:uri] || params["uri"] : nil
+          matched = candidates.select do |_key, subscription|
+            field ? subscription[:filter][field] : subscription[:resource_uris].include?(uri)
           end
 
-          matched.each do |request_id, subscription|
-            meta = { RequestEnvelope::SUBSCRIPTION_ID_META_KEY.to_sym => request_id }
+          matched.each do |subscription_key, subscription|
+            meta = { RequestEnvelope::SUBSCRIPTION_ID_META_KEY.to_sym => subscription[:request_id] }
             notification_params = (params || {}).merge(_meta: meta)
             notification = { jsonrpc: "2.0", method: method, params: notification_params }
 
@@ -1089,16 +1249,36 @@ module MCP
             rescue *STREAM_WRITE_ERRORS => e
               MCP.configuration.exception_reporter.call(
                 e,
-                { subscription_id: request_id, error: "Failed to send notification" },
+                { subscription_id: subscription[:request_id], error: "Failed to send notification" },
               )
-              remove_listen_subscription(request_id)
-              close_stream_safely(subscription[:stream])
+              remove_listen_subscription(subscription_key)
+              close_removed_listen_stream(subscription)
             end
           end
         end
 
-        def remove_listen_subscription(request_id)
-          @mutex.synchronize { @listen_subscriptions.delete(request_id) }
+        def remove_listen_subscription(subscription_key)
+          @mutex.synchronize do
+            subscription = @listen_subscriptions.delete(subscription_key)
+            if subscription
+              # Marked closed as teardown does, so a delivery or keepalive that took the entry before the removal skips it under
+              # the write mutex instead of writing to a stream being closed. The flag is set without taking the write mutex,
+              # which must never be taken inside `@mutex`: a write that checks the flag from here on skips, and one already
+              # past its check lands before the stream closes, since `close_removed_listen_stream` waits for the write mutex.
+              subscription[:closed] = true
+              subscription[:keepalive_wakeup].signal
+            end
+
+            subscription
+          end
+        end
+
+        # Closes a subscription's stream while excluding concurrent writes. The write mutex, taken here outside
+        # `@mutex`, makes the close wait for a write already past its `closed` check, so that write completes or fails
+        # before the stream is closed, and a write that takes the mutex afterwards sees `closed` and skips. Teardown
+        # gets the same ordering by setting `closed` under the write mutex itself.
+        def close_removed_listen_stream(subscription)
+          subscription[:write_mutex].synchronize { close_stream_safely(subscription[:stream]) }
         end
 
         # Graceful teardown (SEP-2575): each open listen stream receives its `SubscriptionsListenResult` response
@@ -1107,26 +1287,35 @@ module MCP
           removed = @mutex.synchronize do
             subscriptions = @listen_subscriptions.dup
             @listen_subscriptions.clear
+
+            subscriptions.each_value do |subscription|
+              subscription[:keepalive_wakeup].signal
+            end
+
             subscriptions
           end
 
-          removed.each do |request_id, subscription|
+          removed.each_value do |subscription|
             # Marking the entry closed and writing the result under the stream's write mutex orders
-            # this against in-flight deliveries: each one either lands before the result or observes
-            # `closed` and skips, keeping the graceful result the stream's final message.
+            # this against in-flight deliveries and against the acknowledgement write: each one either lands
+            # before the result or observes `closed` and skips, keeping the graceful result the stream's final message.
             subscription[:write_mutex].synchronize do
               subscription[:closed] = true
 
+              # A stream whose acknowledgement was never written gets no result either: SEP-2575 makes
+              # the acknowledgement the first message, so the stream closes abruptly and the client re-sends.
+              next unless subscription[:active]
+
               begin
                 send_to_stream(subscription[:stream], {
                   jsonrpc: "2.0",
-                  id: request_id,
+                  id: subscription[:request_id],
                   result: {
                     # `SubscriptionsListenResult` is served at the transport layer and never
                     # passes through the dispatch path, so the REQUIRED 2026-07-28 `resultType` is
                     # stamped at its construction site.
                     resultType: ResultType::COMPLETE,
-                    _meta: { RequestEnvelope::SUBSCRIPTION_ID_META_KEY.to_sym => request_id },
+                    _meta: { RequestEnvelope::SUBSCRIPTION_ID_META_KEY.to_sym => subscription[:request_id] },
                   },
                 })
               rescue *STREAM_WRITE_ERRORS
@@ -1242,6 +1431,16 @@ module MCP
           end
 
           if initialize_request?(body)
+            # Checked before a session exists: the body's `clientInfo` and `capabilities` are what the session would keep,
+            # so an oversized `initialize` is refused outright instead of being stored and capped later.
+            if @max_initialize_request_bytes && body_string.bytesize > @max_initialize_request_bytes
+              return initialize_too_large_response(body[:id], "body exceeds #{@max_initialize_request_bytes} bytes")
+            end
+
+            if !@stateless && json_values_exceed?(body[:params], MAX_INITIALIZE_PARAMS_VALUES)
+              return initialize_too_large_response(body[:id], "params exceed #{MAX_INITIALIZE_PARAMS_VALUES} JSON values")
+            end
+
             if !@stateless && session_id
               # An `initialize` request carrying an `Mcp-Session-Id` header is either a duplicate
               # initialization attempt against a live session, or a retry against an unknown/expired
@@ -1470,6 +1669,45 @@ module MCP
           )
         end
 
+        def initialize_too_large_response(request_id, reason)
+          json_rpc_error_response(
+            status: 413,
+            code: JsonRpcHandler::ErrorCode::INVALID_REQUEST,
+            message: "Payload too large: initialize request #{reason}",
+            id: request_id,
+          )
+        end
+
+        # Counts the JSON values in `value` (every object, array, object key, and scalar) and reports whether
+        # they exceed `limit`. The walk is iterative. Every value still queued is at least one more value,
+        # so `count + pending.size` never overstates the total, and a container is refused before its members are
+        # queued if they would take that sum past the limit; the walk therefore stops as soon as the limit is
+        # certain to be passed and never queues more than `limit` values, whatever the shape of the input.
+        def json_values_exceed?(value, limit)
+          count = 0
+          pending = [value]
+
+          until pending.empty?
+            current = pending.pop
+            count += 1
+
+            case current
+            when Hash
+              count += current.size
+              return true if count + pending.size + current.size > limit
+
+              pending.concat(current.values)
+            when Array
+              return true if count + pending.size + current.size > limit
+
+              pending.concat(current)
+            end
+            return true if count + pending.size > limit
+          end
+
+          false
+        end
+
         def parse_request_body(body_string)
           # `max_nesting` bounds parse depth; a too-deep body raises `JSON::NestingError`,
           # a subclass of `JSON::ParserError`, so it is caught below as a parse error.

data/lib/mcp/server.rb

@@ -181,8 +181,13 @@ module MCP
       Methods::RESOURCES_READ,
     ].freeze
 
-    attr_accessor :description, :icons, :name, :title, :version, :website_url, :instructions, :tools, :prompts, :resource_templates, :server_context, :configuration, :capabilities, :transport, :logging_message_notification
-    attr_reader :resources, :page_size, :client_capabilities, :ttl_ms, :cache_scope, :request_state_security
+    attr_accessor :description, :name, :title, :version, :website_url, :instructions, :tools, :prompts, :resource_templates, :server_context, :configuration, :capabilities, :transport, :logging_message_notification
+    attr_reader :icons, :resources, :page_size, :client_capabilities, :ttl_ms, :cache_scope, :request_state_security
+
+    # Replaces the icons advertised in `serverInfo`; a Hash is converted through `Icon.from`.
+    def icons=(value)
+      @icons = Icon.from_list(value)
+    end
 
     def initialize(
       description: nil,
@@ -207,7 +212,7 @@ module MCP
       transport: nil
     )
       @description = description
-      @icons = icons
+      @icons = Icon.from_list(icons)
       @name = name
       @title = title
       @version = version

data/lib/mcp/tool.rb

@@ -86,7 +86,7 @@ module MCP
         if value == NOT_SET
           @icons_value
         else
-          @icons_value = value
+          @icons_value = Icon.from_list(value)
         end
       end
 

data/lib/mcp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MCP
-  VERSION = "1.6.0"
+  VERSION = "1.7.0"
 end