@cyanheads/pubmed-mcp-server 1.1.4 → 1.2.2

package/dist/mcp-server/transports/httpTransport.js

@@ -1,10 +1,15 @@
 /**
- * @fileoverview Handles the setup and management of the Streamable HTTP MCP transport using Hono.
- * Implements the MCP Specification 2025-03-26 for Streamable HTTP.
- * This includes creating a Hono server, configuring middleware (CORS, Authentication),
- * defining request routing for the single MCP endpoint (POST/GET/DELETE),
- * managing server-side sessions, handling Server-Sent Events (SSE) for streaming,
- * and binding to a network port with retry logic for port conflicts.
+ * @fileoverview Configures and starts the Streamable HTTP MCP transport using Hono.
+ * This module integrates the `@modelcontextprotocol/sdk`'s `StreamableHTTPServerTransport`
+ * into a Hono web server. Its responsibilities include:
+ * - Creating a Hono server instance.
+ * - Applying and configuring middleware for CORS, rate limiting, and authentication (JWT/OAuth).
+ * - Defining the routes (`/mcp` endpoint for POST, GET, DELETE) to handle the MCP lifecycle.
+ * - Orchestrating session management by mapping session IDs to SDK transport instances.
+ * - Implementing port-binding logic with automatic retry on conflicts.
+ *
+ * The underlying implementation of the MCP Streamable HTTP specification, including
+ * Server-Sent Events (SSE) for streaming, is handled by the SDK's transport class.
  *
  * Specification Reference:
  * https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-03-26/basic/transports.mdx#streamable-http
@@ -20,83 +25,18 @@ import { randomUUID } from "node:crypto";
 import { config } from "../../config/index.js";
 import { BaseErrorCode, McpError } from "../../types-global/errors.js";
 import { logger, rateLimiter, requestContextService, } from "../../utils/index.js";
-import { initializeAuthMiddleware, mcpAuthMiddleware, } from "./authentication/authMiddleware.js";
-import { oauthMiddleware } from "./authentication/oauthMiddleware.js";
-/**
- * The port number for the HTTP transport, configured via `MCP_HTTP_PORT` environment variable.
- * Defaults to 3010 if not specified (default is managed by the config module).
- * @constant {number} HTTP_PORT
- * @private
- */
+import { jwtAuthMiddleware, oauthMiddleware, } from "./auth/index.js";
+import { httpErrorHandler } from "./httpErrorHandler.js";
 const HTTP_PORT = config.mcpHttpPort;
-/**
- * The host address for the HTTP transport, configured via `MCP_HTTP_HOST` environment variable.
- * Defaults to '127.0.0.1' if not specified (default is managed by the config module).
- * MCP Spec Security Note: Recommends binding to localhost for local servers to minimize exposure.
- * @private
- */
 const HTTP_HOST = config.mcpHttpHost;
-/**
- * The single HTTP endpoint path for all MCP communication, as required by the MCP specification.
- * This endpoint supports POST, GET, DELETE, and OPTIONS methods.
- * @constant {string} MCP_ENDPOINT_PATH
- * @private
- */
 const MCP_ENDPOINT_PATH = "/mcp";
-/**
- * Maximum number of attempts to find an available port if the initial `HTTP_PORT` is in use.
- * The server will try ports sequentially: `HTTP_PORT`, `HTTP_PORT + 1`, ..., up to `MAX_PORT_RETRIES`.
- * @constant {number} MAX_PORT_RETRIES
- * @private
- */
 const MAX_PORT_RETRIES = 15;
-/**
- * Stores active `StreamableHTTPServerTransport` instances from the SDK, keyed by their session ID.
- * This is essential for routing subsequent HTTP requests (GET, DELETE, non-initialize POST)
- * to the correct stateful session transport instance.
- *
- * @scalability Note: This is an in-memory store. For horizontal scaling across
- * multiple processes or machines, this state would need to be moved to a shared,
- * distributed store like Redis or a database.
- *
- * @type {Record<string, StreamableHTTPServerTransport>}
- * @private
- */
-const httpTransports = {};
-/**
- * Stores the last activity timestamp for each session, keyed by session ID.
- * Used for garbage collecting stale/abandoned sessions.
- *
- * @scalability Note: This is an in-memory store. Like `httpTransports`, this
- * would need to be moved to a distributed store for multi-instance deployments.
- *
- * @type {Record<string, number>}
- * @private
- */
-const sessionActivity = {};
-/**
- * The timeout period in milliseconds for inactive sessions. If a session has no
- * activity for this duration, it will be considered stale and garbage collected.
- * Defaults to 30 minutes.
- * @constant {number} SESSION_TIMEOUT_MS
- * @private
- */
-const SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
-/**
- * The interval in milliseconds at which the session garbage collector runs to
- * clean up stale sessions. Defaults to 1 minute.
- * @constant {number} SESSION_GC_INTERVAL_MS
- * @private
- */
-const SESSION_GC_INTERVAL_MS = 60 * 1000; // 1 minute
-/**
- * Proactively checks if a specific network port is already in use.
- * @param port - The port number to check.
- * @param host - The host address to check the port on.
- * @param parentContext - Logging context from the caller.
- * @returns A promise that resolves to `true` if the port is in use, or `false` otherwise.
- * @private
- */
+// The transports map will store active sessions, keyed by session ID.
+// NOTE: This is an in-memory session store, which is a known limitation for scalability.
+// It will not work in a multi-process (clustered) or serverless environment.
+// For a scalable deployment, this would need to be replaced with a distributed
+// store like Redis or Memcached.
+const transports = {};
 async function isPortInUse(port, host, parentContext) {
     const checkContext = requestContextService.createRequestContext({
         ...parentContext,
@@ -104,137 +44,65 @@ async function isPortInUse(port, host, parentContext) {
         port,
         host,
     });
-    logger.debug(`Proactively checking port usability...`, checkContext);
     return new Promise((resolve) => {
         const tempServer = http.createServer();
         tempServer
             .once("error", (err) => {
-            if (err.code === "EADDRINUSE") {
-                logger.debug(`Proactive check: Port confirmed in use (EADDRINUSE).`, checkContext);
-                resolve(true);
-            }
-            else {
-                logger.debug(`Proactive check: Non-EADDRINUSE error encountered: ${err.message}`, { ...checkContext, errorCode: err.code });
-                resolve(false);
-            }
+            resolve(err.code === "EADDRINUSE");
         })
             .once("listening", () => {
-            logger.debug(`Proactive check: Port is available.`, checkContext);
             tempServer.close(() => resolve(false));
         })
             .listen(port, host);
     });
 }
-/**
- * Attempts to start the HTTP server, retrying on incrementing ports if `EADDRINUSE` occurs.
- *
- * @param app - The Hono application instance.
- * @param initialPort - The initial port number to try.
- * @param host - The host address to bind to.
- * @param maxRetries - Maximum number of additional ports to attempt.
- * @param parentContext - Logging context from the caller.
- * @returns A promise that resolves with the Node.js `http.Server` instance the server successfully bound to.
- * @throws {Error} If binding fails after all retries or for a non-EADDRINUSE error.
- * @private
- */
 function startHttpServerWithRetry(app, initialPort, host, maxRetries, parentContext) {
     const startContext = requestContextService.createRequestContext({
         ...parentContext,
         operation: "startHttpServerWithRetry",
-        initialPort,
-        host,
-        maxRetries,
     });
-    logger.debug(`Attempting to start HTTP server...`, startContext);
     return new Promise(async (resolve, reject) => {
-        let lastError = null;
         for (let i = 0; i <= maxRetries; i++) {
             const currentPort = initialPort + i;
-            const attemptContext = requestContextService.createRequestContext({
+            const attemptContext = {
                 ...startContext,
                 port: currentPort,
                 attempt: i + 1,
-                maxAttempts: maxRetries + 1,
-            });
-            logger.debug(`Attempting port ${currentPort} (${attemptContext.attempt}/${attemptContext.maxAttempts})`, attemptContext);
+            };
             if (await isPortInUse(currentPort, host, attemptContext)) {
-                logger.warning(`Proactive check detected port ${currentPort} is in use, retrying...`, attemptContext);
-                lastError = new Error(`EADDRINUSE: Port ${currentPort} detected as in use by proactive check.`);
-                await new Promise((res) => setTimeout(res, 100));
+                logger.warning(`Port ${currentPort} is in use, retrying...`, attemptContext);
                 continue;
             }
             try {
                 const serverInstance = serve({ fetch: app.fetch, port: currentPort, hostname: host }, (info) => {
                     const serverAddress = `http://${info.address}:${info.port}${MCP_ENDPOINT_PATH}`;
-                    logger.info(`HTTP transport successfully listening on host ${host} at ${serverAddress}`, { ...attemptContext, address: serverAddress });
-                    // Display user-friendly startup message only after server is confirmed listening
-                    let serverAddressLog = serverAddress;
-                    let productionNote = "";
-                    if (config.environment === "production") {
-                        serverAddressLog = `https://${info.address}:${info.port}${MCP_ENDPOINT_PATH}`;
-                        productionNote = ` (via HTTPS, ensure reverse proxy is configured)`;
-                    }
+                    logger.info(`HTTP transport listening at ${serverAddress}`, {
+                        ...attemptContext,
+                        address: serverAddress,
+                    });
                     if (process.stdout.isTTY) {
-                        console.log(`\n🚀 MCP Server running in HTTP mode at: ${serverAddressLog}${productionNote}\n   (MCP Spec: 2025-03-26 Streamable HTTP Transport)\n`);
+                        console.log(`\n🚀 MCP Server running at: ${serverAddress}\n`);
                     }
                 });
                 resolve(serverInstance);
                 return;
             }
             catch (err) {
-                lastError = err;
-                logger.debug(`Listen error on port ${currentPort}: Code=${err.code}, Message=${err.message}`, { ...attemptContext, errorCode: err.code, errorMessage: err.message });
-                if (err.code === "EADDRINUSE") {
-                    logger.warning(`Port ${currentPort} already in use (EADDRINUSE), retrying...`, attemptContext);
-                    await new Promise((res) => setTimeout(res, 100));
-                }
-                else {
-                    logger.error(`Failed to bind to port ${currentPort} due to non-EADDRINUSE error: ${err.message}`, { ...attemptContext, error: err.message });
+                if (err.code !== "EADDRINUSE") {
                     reject(err);
                     return;
                 }
             }
         }
-        logger.error(`Failed to bind to any port after ${maxRetries + 1} attempts. Last error: ${lastError?.message}`, { ...startContext, error: lastError?.message });
-        reject(lastError ||
-            new Error("Failed to bind to any port after multiple retries."));
+        reject(new Error("Failed to bind to any port after multiple retries."));
     });
 }
-/**
- * Sets up and starts the Streamable HTTP transport layer for the MCP server.
- *
- * @param createServerInstanceFn - An asynchronous factory function that returns a new `McpServer` instance.
- * @param parentContext - Logging context from the main server startup process.
- * @returns A promise that resolves with the Node.js `http.Server` instance when the HTTP server is successfully listening.
- * @throws {Error} If the server fails to start after all port retries.
- */
 export async function startHttpTransport(createServerInstanceFn, parentContext) {
-    initializeAuthMiddleware(); // Explicitly initialize auth middleware config
     const app = new Hono();
     const transportContext = requestContextService.createRequestContext({
         ...parentContext,
-        transportType: "HTTP",
         component: "HttpTransportSetup",
     });
-    logger.debug("Setting up Hono app for HTTP transport...", transportContext);
-    // Start the session garbage collector
-    setInterval(() => {
-        const now = Date.now();
-        const gcContext = requestContextService.createRequestContext({
-            operation: "SessionGarbageCollector",
-        });
-        logger.debug("Running session garbage collector...", gcContext);
-        for (const sessionId in sessionActivity) {
-            if (now - sessionActivity[sessionId] > SESSION_TIMEOUT_MS) {
-                logger.info(`Session ${sessionId} timed out due to inactivity. Cleaning up.`, { ...gcContext, sessionId });
-                const transport = httpTransports[sessionId];
-                if (transport) {
-                    transport.close(); // This will trigger the onclose handler to delete it from httpTransports
-                }
-                delete sessionActivity[sessionId];
-            }
-        }
-    }, SESSION_GC_INTERVAL_MS);
     app.use("*", cors({
         origin: config.mcpAllowedOrigins || [],
         allowMethods: ["GET", "POST", "DELETE", "OPTIONS"],
@@ -247,260 +115,94 @@ export async function startHttpTransport(createServerInstanceFn, parentContext)
         credentials: true,
     }));
     app.use("*", async (c, next) => {
-        const securityContext = requestContextService.createRequestContext({
-            ...transportContext,
-            operation: "securityMiddleware",
-            path: c.req.path,
-            method: c.req.method,
-            origin: c.req.header("origin"),
-        });
-        logger.debug(`Applying security middleware...`, securityContext);
         c.res.headers.set("X-Content-Type-Options", "nosniff");
-        c.res.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-        c.res.headers.set("Content-Security-Policy", "default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self'; img-src 'self'; media-src 'self'; frame-src 'none'; font-src 'self'; connect-src 'self'");
-        logger.debug("Security middleware passed.", securityContext);
         await next();
     });
     app.use(MCP_ENDPOINT_PATH, async (c, next) => {
-        const xff = c.req.header("x-forwarded-for");
-        const clientIp = xff ? xff.split(",")[0].trim() : "unknown_ip";
-        const rateLimitKey = clientIp || c.req.header("host") || "unknown_ip_for_rate_limit";
+        // NOTE (Security): The 'x-forwarded-for' header is used for rate limiting.
+        // This is only secure if the server is run behind a trusted proxy that
+        // correctly sets or validates this header.
+        const clientIp = c.req.header("x-forwarded-for")?.split(",")[0].trim() || "unknown_ip";
         const context = requestContextService.createRequestContext({
             operation: "httpRateLimitCheck",
-            ipAddress: rateLimitKey,
-            method: c.req.method,
-            path: c.req.path,
+            ipAddress: clientIp,
         });
-        try {
-            rateLimiter.check(rateLimitKey, context);
-            logger.debug("Rate limit check passed.", context);
-            await next();
-        }
-        catch (error) {
-            if (error instanceof McpError &&
-                error.code === BaseErrorCode.RATE_LIMITED) {
-                logger.warning(`Rate limit exceeded for IP: ${rateLimitKey}`, {
-                    ...context,
-                    errorMessage: error.message,
-                    details: error.details,
-                });
-                return c.json({
-                    jsonrpc: "2.0",
-                    error: { code: -32000, message: "Too Many Requests" },
-                    id: (await c.req.json().catch(() => ({})))?.id || null,
-                }, 429);
-            }
-            else {
-                logger.error("Unexpected error in rate limit middleware", {
-                    ...context,
-                    error: error instanceof Error ? error.message : String(error),
-                });
-                throw error;
-            }
-        }
+        // Let the centralized error handler catch rate limit errors
+        rateLimiter.check(clientIp, context);
+        await next();
     });
-    // Use the appropriate authentication middleware based on config
     if (config.mcpAuthMode === "oauth") {
         app.use(MCP_ENDPOINT_PATH, oauthMiddleware);
     }
     else {
-        app.use(MCP_ENDPOINT_PATH, mcpAuthMiddleware);
+        app.use(MCP_ENDPOINT_PATH, jwtAuthMiddleware);
     }
+    // Centralized Error Handling
+    app.onError(httpErrorHandler);
     app.post(MCP_ENDPOINT_PATH, async (c) => {
-        const basePostContext = requestContextService.createRequestContext({
+        const postContext = requestContextService.createRequestContext({
             ...transportContext,
             operation: "handlePost",
-            method: "POST",
-            path: c.req.path,
-            origin: c.req.header("origin"),
         });
         const body = await c.req.json();
-        logger.debug(`Received POST request on ${MCP_ENDPOINT_PATH}`, {
-            ...basePostContext,
-            headers: c.req.header(),
-            bodyPreview: JSON.stringify(body).substring(0, 100),
-        });
         const sessionId = c.req.header("mcp-session-id");
-        logger.debug(`Extracted session ID: ${sessionId}`, {
-            ...basePostContext,
-            sessionId,
-        });
-        let transport = sessionId ? httpTransports[sessionId] : undefined;
-        if (transport && sessionId) {
-            sessionActivity[sessionId] = Date.now(); // Update activity timestamp
-        }
-        logger.debug(`Found existing transport for session ID: ${!!transport}`, {
-            ...basePostContext,
-            sessionId,
-        });
-        const isInitReq = isInitializeRequest(body);
-        logger.debug(`Is InitializeRequest: ${isInitReq}`, {
-            ...basePostContext,
-            sessionId,
-        });
-        const requestId = body?.id || null;
-        try {
-            if (isInitReq) {
-                if (transport) {
-                    logger.warning("Received InitializeRequest on an existing session ID. Closing old session and creating new.", { ...basePostContext, sessionId });
-                    await transport.close();
-                    // onclose handler will delete from httpTransports and sessionActivity
-                }
-                logger.info("Handling Initialize Request: Creating new session...", {
-                    ...basePostContext,
+        let transport = sessionId
+            ? transports[sessionId]
+            : undefined;
+        if (isInitializeRequest(body)) {
+            // If a transport already exists for a session, it's a re-initialization.
+            if (transport) {
+                logger.warning("Re-initializing existing session.", {
+                    ...postContext,
                     sessionId,
                 });
-                transport = new StreamableHTTPServerTransport({
-                    sessionIdGenerator: () => {
-                        const newId = randomUUID();
-                        logger.debug(`Generated new session ID: ${newId}`, basePostContext);
-                        return newId;
-                    },
-                    onsessioninitialized: (newId) => {
-                        logger.debug(`Session initialized callback triggered for ID: ${newId}`, { ...basePostContext, newSessionId: newId });
-                        httpTransports[newId] = transport;
-                        sessionActivity[newId] = Date.now(); // Initialize activity timestamp
-                        logger.info(`HTTP Session created: ${newId}`, {
-                            ...basePostContext,
-                            newSessionId: newId,
-                        });
-                    },
-                });
-                transport.onclose = () => {
-                    const closedSessionId = transport.sessionId;
-                    if (closedSessionId) {
-                        logger.debug(`onclose handler triggered for session ID: ${closedSessionId}`, { ...basePostContext, closedSessionId });
-                        delete httpTransports[closedSessionId];
-                        delete sessionActivity[closedSessionId]; // Clean up activity tracker
-                        logger.info(`HTTP Session closed: ${closedSessionId}`, {
-                            ...basePostContext,
-                            closedSessionId,
-                        });
-                    }
-                    else {
-                        logger.debug("onclose handler triggered for transport without session ID (likely init failure).", basePostContext);
-                    }
-                };
-                logger.debug("Creating McpServer instance for new session...", basePostContext);
-                const server = await createServerInstanceFn();
-                logger.debug("Connecting McpServer to new transport...", basePostContext);
-                await server.connect(transport);
-                logger.debug("McpServer connected to transport.", basePostContext);
-            }
-            else if (!transport) {
-                logger.warning("Invalid or missing session ID for non-initialize POST request.", { ...basePostContext, sessionId });
-                return c.json({
-                    jsonrpc: "2.0",
-                    error: { code: -32004, message: "Invalid or expired session ID" },
-                    id: requestId,
-                }, 404);
+                await transport.close(); // This will trigger the onclose handler.
             }
-            const currentSessionId = transport.sessionId;
-            logger.debug(`Processing POST request content for session ${currentSessionId}...`, { ...basePostContext, sessionId: currentSessionId, isInitReq });
-            const response = await transport.handleRequest(c.env.incoming, c.env.outgoing, body);
-            logger.debug(`Finished processing POST request content for session ${currentSessionId}.`, { ...basePostContext, sessionId: currentSessionId });
-            return response;
-        }
-        catch (err) {
-            const errorSessionId = transport?.sessionId || sessionId;
-            logger.error("Error handling POST request", {
-                ...basePostContext,
-                sessionId: errorSessionId,
-                isInitReq,
-                error: err instanceof Error ? err.message : String(err),
-                stack: err instanceof Error ? err.stack : undefined,
-            });
-            if (isInitReq && transport && !transport.sessionId) {
-                logger.debug("Cleaning up transport after initialization failure.", {
-                    ...basePostContext,
-                    sessionId: errorSessionId,
-                });
-                await transport.close().catch((closeErr) => logger.error("Error closing transport after init failure", {
-                    ...basePostContext,
-                    sessionId: errorSessionId,
-                    closeError: closeErr,
-                }));
-            }
-            return c.json({
-                jsonrpc: "2.0",
-                error: {
-                    code: -32603,
-                    message: "Internal server error during POST handling",
+            // Create a new transport for a new session.
+            const newTransport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: (newId) => {
+                    transports[newId] = newTransport;
+                    logger.info(`HTTP Session created: ${newId}`, {
+                        ...postContext,
+                        newSessionId: newId,
+                    });
                 },
-                id: requestId,
-            }, 500);
+            });
+            // Set up cleanup logic for when the transport is closed.
+            newTransport.onclose = () => {
+                const closedSessionId = newTransport.sessionId;
+                if (closedSessionId && transports[closedSessionId]) {
+                    delete transports[closedSessionId];
+                    logger.info(`HTTP Session closed: ${closedSessionId}`, {
+                        ...postContext,
+                        closedSessionId,
+                    });
+                }
+            };
+            // Connect the new transport to a new server instance.
+            const server = await createServerInstanceFn();
+            await server.connect(newTransport);
+            transport = newTransport;
+        }
+        else if (!transport) {
+            // If it's not an initialization request and no transport was found, it's an error.
+            throw new McpError(BaseErrorCode.NOT_FOUND, "Invalid or expired session ID.");
         }
+        // Pass the request to the transport to handle.
+        return await transport.handleRequest(c.env.incoming, c.env.outgoing, body);
     });
-    const handleSessionReq = async (c) => {
-        const method = c.req.method;
-        const baseSessionReqContext = requestContextService.createRequestContext({
-            ...transportContext,
-            operation: `handle${method}`,
-            method,
-            path: c.req.path,
-            origin: c.req.header("origin"),
-        });
-        logger.debug(`Received ${method} request on ${MCP_ENDPOINT_PATH}`, {
-            ...baseSessionReqContext,
-            headers: c.req.header(),
-        });
+    // A reusable handler for GET and DELETE requests which operate on existing sessions.
+    const handleSessionRequest = async (c) => {
         const sessionId = c.req.header("mcp-session-id");
-        logger.debug(`Extracted session ID: ${sessionId}`, {
-            ...baseSessionReqContext,
-            sessionId,
-        });
-        const transport = sessionId ? httpTransports[sessionId] : undefined;
-        if (transport && sessionId) {
-            sessionActivity[sessionId] = Date.now(); // Update activity timestamp
-        }
-        logger.debug(`Found existing transport for session ID: ${!!transport}`, {
-            ...baseSessionReqContext,
-            sessionId,
-        });
+        const transport = sessionId ? transports[sessionId] : undefined;
         if (!transport) {
-            logger.warning(`Session not found for ${method} request`, {
-                ...baseSessionReqContext,
-                sessionId,
-            });
-            return c.json({
-                jsonrpc: "2.0",
-                error: { code: -32004, message: "Session not found or expired" },
-                id: null,
-            }, 404);
-        }
-        try {
-            logger.debug(`Delegating ${method} request to transport for session ${sessionId}...`, { ...baseSessionReqContext, sessionId });
-            const response = await transport.handleRequest(c.env.incoming, c.env.outgoing);
-            logger.info(`Successfully handled ${method} request for session ${sessionId}`, { ...baseSessionReqContext, sessionId });
-            return response;
-        }
-        catch (err) {
-            logger.error(`Error handling ${method} request for session ${sessionId}`, {
-                ...baseSessionReqContext,
-                sessionId,
-                error: err instanceof Error ? err.message : String(err),
-                stack: err instanceof Error ? err.stack : undefined,
-            });
-            return c.json({
-                jsonrpc: "2.0",
-                error: { code: -32603, message: "Internal Server Error" },
-                id: null,
-            }, 500);
+            throw new McpError(BaseErrorCode.NOT_FOUND, "Session not found or expired.");
         }
+        // Let the transport handle the streaming (GET) or termination (DELETE) request.
+        return await transport.handleRequest(c.env.incoming, c.env.outgoing);
     };
-    app.get(MCP_ENDPOINT_PATH, handleSessionReq);
-    app.delete(MCP_ENDPOINT_PATH, handleSessionReq);
-    logger.debug("Creating HTTP server instance...", transportContext);
-    try {
-        logger.debug("Attempting to start HTTP server with retry logic...", transportContext);
-        const serverInstance = await startHttpServerWithRetry(app, config.mcpHttpPort, config.mcpHttpHost, MAX_PORT_RETRIES, transportContext);
-        return serverInstance;
-    }
-    catch (err) {
-        logger.fatal("HTTP server failed to start after multiple port retries.", {
-            ...transportContext,
-            error: err instanceof Error ? err.message : String(err),
-        });
-        throw err;
-    }
+    app.get(MCP_ENDPOINT_PATH, handleSessionRequest);
+    app.delete(MCP_ENDPOINT_PATH, handleSessionRequest);
+    return startHttpServerWithRetry(app, HTTP_PORT, HTTP_HOST, MAX_PORT_RETRIES, transportContext);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/pubmed-mcp-server",
-  "version": "1.1.4",
+  "version": "1.2.2",
   "description": "A Model Context Protocol (MCP) server enabling AI agents to intelligently search, retrieve, and analyze biomedical literature from PubMed via NCBI E-utilities. Built on the mcp-ts-template for robust, production-ready performance.",
   "main": "dist/index.js",
   "files": [
@@ -33,37 +33,30 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.14.4",
-    "@modelcontextprotocol/sdk": "^1.12.1",
-    "@node-oauth/oauth2-server": "^5.2.0",
-    "@types/jsonwebtoken": "^9.0.9",
-    "@types/node": "^24.0.1",
+    "@modelcontextprotocol/sdk": "^1.13.0",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^24.0.3",
     "@types/sanitize-html": "^2.16.0",
-    "@types/validator": "13.15.1",
-    "axios": "^1.9.0",
-    "canvas": "^3.1.0",
-    "chalk": "^5.4.1",
-    "chrono-node": "^2.8.2",
-    "cli-table3": "^0.6.5",
+    "@types/validator": "13.15.2",
+    "axios": "^1.10.0",
+    "chrono-node": "^2.8.3",
     "dotenv": "^16.5.0",
-    "express": "^5.1.0",
     "fast-xml-parser": "^5.2.5",
-    "hono": "^4.7.11",
-    "ignore": "^7.0.5",
+    "hono": "^4.8.2",
     "jose": "^6.0.11",
     "jsonwebtoken": "^9.0.2",
-    "openai": "^5.3.0",
+    "openai": "^5.6.0",
     "partial-json": "^0.1.7",
     "sanitize-html": "^2.17.0",
     "tiktoken": "^1.0.21",
     "ts-node": "^10.9.2",
     "typescript": "^5.8.3",
     "validator": "13.15.15",
-    "vega": "^6.1.2",
-    "vega-lite": "^6.1.0",
+    "chart.js": "^4.5.0",
+    "chartjs-node-canvas": "^5.0.0",
     "winston": "^3.17.0",
-    "winston-daily-rotate-file": "^5.0.0",
-    "yargs": "^18.0.0",
-    "zod": "^3.25.64"
+    "winston-transport": "^4.9.0",
+    "zod": "^3.25.67"
   },
   "keywords": [
     "mcp",
@@ -103,7 +96,6 @@
     "node": ">=16.0.0"
   },
   "devDependencies": {
-    "@types/express": "^5.0.3",
     "@types/js-yaml": "^4.0.9",
     "js-yaml": "^4.1.0",
     "prettier": "^3.5.3",