@goke/mcp 0.0.12 → 0.1.0

package/dist/index.d.ts

@@ -9,7 +9,6 @@
  *
  * - **Auto-discovery**: Fetches all tools from the MCP server and creates CLI commands
  * - **Caching**: Tools are cached for 1 hour to avoid reconnecting on every invocation
- * - **Session reuse**: MCP session IDs are cached to skip initialization handshake
  * - **Type-aware parsing**: Handles string, number, boolean, object, and array arguments
  * - **JSON schema support**: Generates CLI options from tool input schemas
  * - **OAuth support**: Automatic OAuth authentication on 401 errors (lazy auth)
@@ -41,11 +40,12 @@
  */
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import type { Goke } from "goke";
+export { startOAuthFlow } from "./auth.js";
 import type { McpOAuthConfig } from "./types.js";
 export { addCliToolsToMcp, createMcpAction } from "./cli-to-mcp.js";
 export type { AddCliToolsToMcpOptions, CreateMcpActionOptions } from "./cli-to-mcp.js";
 export type { Transport };
-export type { McpOAuthConfig, McpOAuthState } from "./types.js";
+export type { McpOAuthConfig, McpOAuthState, StartOAuthFlowOptions, OAuthFlowResult } from "./types.js";
 export interface CachedMcpTools {
     tools: Array<{
         name: string;
@@ -53,7 +53,6 @@ export interface CachedMcpTools {
         inputSchema?: unknown;
     }>;
     timestamp: number;
-    sessionId?: string;
 }
 export interface AddMcpCommandsOptions {
     cli: Goke;
@@ -75,12 +74,14 @@ export interface AddMcpCommandsOptions {
     getMcpUrl?: () => string | undefined;
     /**
      * Returns a transport to connect to the MCP server, or null if not configured.
-     * If null is returned, no MCP tool commands will be registered.
-     * @param sessionId - Optional session ID from cache to reuse existing session
-     *
-     * @deprecated Use getMcpUrl + oauth instead for simpler setup
+     * Use this for stdio servers or any setup `getMcpUrl` cannot express.
+     */
+    getMcpTransport?: () => Transport | null | Promise<Transport | null>;
+    /**
+     * Argv used to decide whether to skip live discovery.
+     * Defaults to `process.argv.slice(2)`.
      */
-    getMcpTransport?: (sessionId?: string) => Transport | null | Promise<Transport | null>;
+    argv?: string[];
     /**
      * Extra headers for MCP HTTP requests (for example `Authorization`).
      * Used with `getMcpUrl`. Ignored when `getMcpTransport` is set.
@@ -115,7 +116,6 @@ export interface AddMcpCommandsOptions {
  * Adds MCP tool commands to a goke CLI instance.
  *
  * Tools are cached for 1 hour to avoid connecting on every CLI invocation.
- * Session ID is also cached to skip MCP initialization handshake.
  *
  * OAuth is lazy - authentication only happens when a 401 error occurs.
  * After successful auth, the operation is automatically retried.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGvF,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAErC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEvF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAEtD;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;CACxD;AA4ID;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiNlF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGvF,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAExG,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAErC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAErE;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAEtD;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;CACxD;AAwJD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkNlF"}

package/dist/index.js

@@ -9,7 +9,6 @@
  *
  * - **Auto-discovery**: Fetches all tools from the MCP server and creates CLI commands
  * - **Caching**: Tools are cached for 1 hour to avoid reconnecting on every invocation
- * - **Session reuse**: MCP session IDs are cached to skip initialization handshake
  * - **Type-aware parsing**: Handles string, number, boolean, object, and array arguments
  * - **JSON schema support**: Generates CLI options from tool input schemas
  * - **OAuth support**: Automatic OAuth authentication on 401 errors (lazy auth)
@@ -45,6 +44,7 @@ import { wrapJsonSchema } from "goke";
 import yaml from "js-yaml";
 import { FileOAuthProvider } from "./oauth-provider.js";
 import { startOAuthFlow, isAuthRequiredError } from "./auth.js";
+export { startOAuthFlow } from "./auth.js";
 export { addCliToolsToMcp, createMcpAction } from "./cli-to-mcp.js";
 const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 /**
@@ -131,7 +131,16 @@ function isHelpOrMetaArgv(argv) {
         return true;
     return argv.some((arg) => arg === "--help" || arg === "-h" || arg === "--version" || arg === "-v");
 }
-function createTransportWithAuth(url, sessionId, oauthState, oauth, headers) {
+function matchesRegisteredCommand({ argv, cli }) {
+    const parts = argv.filter((arg) => !arg.startsWith("-"));
+    return cli.commands.some((cmd) => {
+        if (!cmd.name)
+            return false;
+        const nameParts = cmd.name.split(" ");
+        return nameParts.every((part, i) => parts[i] === part);
+    });
+}
+function createTransportWithAuth({ url, oauthState, oauth, headers, }) {
     let authProvider;
     if (oauth && oauthState?.tokens) {
         authProvider = new FileOAuthProvider({
@@ -148,7 +157,6 @@ function createTransportWithAuth(url, sessionId, oauthState, oauth, headers) {
     }
     const hasHeaders = headers && Object.keys(headers).length > 0;
     return new StreamableHTTPClientTransport(url, {
-        sessionId,
         authProvider,
         requestInit: hasHeaders ? { headers } : undefined,
     });
@@ -157,16 +165,13 @@ function createTransportWithAuth(url, sessionId, oauthState, oauth, headers) {
  * Adds MCP tool commands to a goke CLI instance.
  *
  * Tools are cached for 1 hour to avoid connecting on every CLI invocation.
- * Session ID is also cached to skip MCP initialization handshake.
  *
  * OAuth is lazy - authentication only happens when a 401 error occurs.
  * After successful auth, the operation is automatically retried.
  */
 export async function addMcpCommands(options) {
-    const { cli, commandPrefix = "", clientName = "mcp-cli-client", getMcpUrl, getMcpTransport, getHeaders, oauth, loadCache, saveCache, } = options;
-    // Helper to get transport - supports both old and new API
-    const getTransport = async (sessionId) => {
-        // New API: getMcpUrl + oauth
+    const { cli, commandPrefix = "", clientName = "mcp-cli-client", getMcpUrl, getMcpTransport, getHeaders, oauth, loadCache, saveCache, argv = process.argv.slice(2), } = options;
+    const getTransport = async () => {
         if (getMcpUrl) {
             const mcpUrl = getMcpUrl();
             if (!mcpUrl) {
@@ -174,11 +179,15 @@ export async function addMcpCommands(options) {
             }
             const url = new URL(mcpUrl);
             const oauthState = oauth?.load();
-            return createTransportWithAuth(url, sessionId, oauthState, oauth, getHeaders?.());
+            return createTransportWithAuth({
+                url,
+                oauthState,
+                oauth,
+                headers: getHeaders?.(),
+            });
         }
-        // Legacy API: getMcpTransport
         if (getMcpTransport) {
-            return getMcpTransport(sessionId);
+            return getMcpTransport();
         }
         return null;
     };
@@ -209,12 +218,15 @@ export async function addMcpCommands(options) {
     // Try to use cached tools first (fast path - no network)
     const cachedTools = loadCache();
     const isCacheValid = cachedTools && (Date.now() - cachedTools.timestamp) < CACHE_TTL_MS;
-    const helpOrMeta = isHelpOrMetaArgv(process.argv.slice(2));
+    const skipLiveDiscovery = isHelpOrMetaArgv(argv) || matchesRegisteredCommand({ argv, cli });
     let tools;
-    let cachedSessionId;
     if (isCacheValid && cachedTools) {
         tools = cachedTools.tools;
-        cachedSessionId = cachedTools.sessionId;
+    }
+    else if (skipLiveDiscovery) {
+        if (cachedTools) {
+            tools = cachedTools.tools;
+        }
     }
     else {
         const transport = await getTransport();
@@ -224,7 +236,6 @@ export async function addMcpCommands(options) {
                 await client.connect(transport);
                 const result = await client.listTools();
                 tools = result.tools;
-                const sessionId = transport.sessionId;
                 saveCache({
                     tools: tools.map((t) => ({
                         name: t.name,
@@ -232,12 +243,10 @@ export async function addMcpCommands(options) {
                         inputSchema: t.inputSchema,
                     })),
                     timestamp: Date.now(),
-                    sessionId,
                 });
-                cachedSessionId = sessionId;
             }
             catch (err) {
-                const shouldAuth = isAuthRequiredError(err) && oauth && getMcpUrl && !helpOrMeta;
+                const shouldAuth = isAuthRequiredError(err) && oauth && getMcpUrl && !skipLiveDiscovery;
                 if (shouldAuth) {
                     const mcpUrl = getMcpUrl();
                     if (mcpUrl) {
@@ -247,7 +256,7 @@ export async function addMcpCommands(options) {
                         }
                     }
                 }
-                if (!helpOrMeta) {
+                if (!skipLiveDiscovery) {
                     console.error(`Failed to connect to MCP server: ${err instanceof Error ? err.message : err}`);
                 }
             }
@@ -257,7 +266,6 @@ export async function addMcpCommands(options) {
         }
         if (!tools && cachedTools) {
             tools = cachedTools.tools;
-            cachedSessionId = cachedTools.sessionId;
         }
     }
     if (!tools) {
@@ -302,7 +310,7 @@ export async function addMcpCommands(options) {
             // Goke already coerced all values via schemas — just extract the relevant keys
             const parsedArgs = extractToolArguments(cliOptions, inputSchema);
             const executeWithRetry = async (isRetry = false) => {
-                const transport = await getTransport(isRetry ? undefined : cachedSessionId);
+                const transport = await getTransport();
                 if (!transport) {
                     console.error("MCP transport not available. Run login command first.");
                     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goke/mcp",
-  "version": "0.0.12",
+  "version": "0.1.0",
   "type": "module",
   "description": "Dynamically generate CLI commands from MCP server tools",
   "repository": {
@@ -40,7 +40,7 @@
   "author": "Tommaso De Rossi, morse <beats.by.morse@gmail.com>",
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "js-yaml": "^4.1.1"
   },
   "peerDependencies": {
@@ -51,7 +51,7 @@
     "@types/node": "^22.19.7",
     "vitest": "^3.1.0",
     "zod": "^4.3.6",
-    "goke": "^6.12.1"
+    "goke": "^6.15.1"
   },
   "scripts": {
     "clean": "rm -rf dist",

package/src/__test__/add-mcp-commands-help.test.ts

@@ -1,6 +1,10 @@
 // First-run help and stale-cache behavior for addMcpCommands.
+import http from 'node:http'
 import { describe, expect, it } from 'vitest'
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'
+import { Server } from '@modelcontextprotocol/sdk/server/index.js'
 import { goke } from 'goke'
+import { addCliToolsToMcp } from '../cli-to-mcp.js'
 import { addMcpCommands, type CachedMcpTools } from '../index.js'
 
 const staleCache = (over: Partial<CachedMcpTools> = {}): CachedMcpTools => ({
@@ -15,39 +19,57 @@ const staleCache = (over: Partial<CachedMcpTools> = {}): CachedMcpTools => ({
   ...over,
 })
 
-async function withArgv<T>(argv: string[], fn: () => Promise<T>) {
-  const previous = process.argv
-  process.argv = ['node', 'testcli', ...argv]
-  try {
-    return await fn()
-  } finally {
-    process.argv = previous
+function captureErrors() {
+  const errors: string[] = []
+  const error = console.error
+  console.error = (...args: unknown[]) => {
+    errors.push(args.map(String).join(' '))
+  }
+  return {
+    errors,
+    restore() {
+      console.error = error
+    },
   }
 }
 
+function listen401() {
+  const server = http.createServer((_req, res) => {
+    res.writeHead(401, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ error: 'unauthorized' }))
+  })
+  return new Promise<{ url: string; close: () => Promise<void> }>((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      const addr = server.address()
+      if (!addr || typeof addr === 'string') throw new Error('no port')
+      resolve({
+        url: `http://127.0.0.1:${addr.port}/mcp`,
+        close: () => new Promise((done) => server.close(() => done())),
+      })
+    })
+  })
+}
+
 describe('addMcpCommands first-run help', () => {
   it('lets --help run when there is no token and no cache', async () => {
-    const errors: string[] = []
-    const error = console.error
-    console.error = (...args: unknown[]) => {
-      errors.push(args.map(String).join(' '))
-    }
-
+    const io = captureErrors()
     const cli = goke('testcli')
     cli.command('config', 'Save token').action(() => {})
 
-    await withArgv(['--help'], async () => {
+    try {
       await addMcpCommands({
         cli,
+        argv: ['--help'],
         getMcpTransport: () => null,
         loadCache: () => undefined,
         saveCache: () => {},
       })
-    })
-    console.error = error
+    } finally {
+      io.restore()
+    }
 
     const help = cli.helpText()
-    expect(errors.join('\n')).not.toMatch(/Failed to connect/)
+    expect(io.errors.join('\n')).not.toMatch(/Failed to connect/)
     expect(help).toMatch(/config/)
     expect(help).not.toMatch(/find_bookmarks/)
   })
@@ -55,32 +77,28 @@ describe('addMcpCommands first-run help', () => {
   it('registers stale cached tools when live fetch is impossible', async () => {
     const cli = goke('testcli')
 
-    await withArgv(['--help'], async () => {
-      await addMcpCommands({
-        cli,
-        getMcpTransport: () => null,
-        loadCache: () => staleCache(),
-        saveCache: () => {},
-      })
+    await addMcpCommands({
+      cli,
+      argv: ['--help'],
+      getMcpTransport: () => null,
+      loadCache: () => staleCache(),
+      saveCache: () => {},
     })
 
     expect(cli.helpText()).toMatch(/find_bookmarks/)
   })
 
   it('does not start OAuth when --help gets a 401', async () => {
+    const server = await listen401()
     const authUrls: string[] = []
-    const errors: string[] = []
-    const error = console.error
-    console.error = (...args: unknown[]) => {
-      errors.push(args.map(String).join(' '))
-    }
-
+    const io = captureErrors()
     const cli = goke('testcli')
 
-    await withArgv(['--help'], async () => {
+    try {
       await addMcpCommands({
         cli,
-        getMcpUrl: () => 'http://127.0.0.1:1/mcp',
+        argv: ['--help'],
+        getMcpUrl: () => server.url,
         oauth: {
           clientName: 'test',
           load: () => undefined,
@@ -92,11 +110,97 @@ describe('addMcpCommands first-run help', () => {
         loadCache: () => undefined,
         saveCache: () => {},
       })
-    })
-    console.error = error
+    } finally {
+      io.restore()
+      await server.close()
+    }
 
     expect(authUrls).toEqual([])
-    expect(errors.join('\n')).not.toMatch(/Authentication required/)
+    expect(io.errors.join('\n')).not.toMatch(/Authentication required/)
     expect(cli.helpText()).toMatch(/Usage/)
   })
+
+  it('does not connect for an already registered command', async () => {
+    let transportCalls = 0
+    const cli = goke('testcli')
+    cli.command('config', 'Save token').action(() => {})
+
+    await addMcpCommands({
+      cli,
+      argv: ['config', '--token', 'x'],
+      getMcpTransport: () => {
+        transportCalls += 1
+        return null
+      },
+      loadCache: () => undefined,
+      saveCache: () => {},
+    })
+
+    expect(transportCalls).toBe(0)
+  })
+
+  it('does not pass a session id into getMcpTransport', async () => {
+    const sessionIds: Array<string | undefined> = []
+    const cli = goke('testcli')
+
+    await addMcpCommands({
+      cli,
+      argv: ['find_bookmarks'],
+      getMcpTransport: (sessionId?: string) => {
+        sessionIds.push(sessionId)
+        return null
+      },
+      loadCache: () => ({
+        tools: [
+          {
+            name: 'find_bookmarks',
+            description: 'Find bookmarks',
+            inputSchema: { type: 'object', properties: {} },
+          },
+        ],
+        timestamp: Date.now(),
+        sessionId: 'should-not-be-reused',
+      }),
+      saveCache: () => {},
+    })
+
+    const command = cli.commands.find((entry) => entry.name === 'find_bookmarks')
+    try {
+      await command?.commandAction?.({})
+    } catch {
+      // transport is null, so the action exits
+    }
+
+    expect(sessionIds).toEqual([undefined])
+  })
+
+  it('caches tools without a session id', async () => {
+    const saved: CachedMcpTools[] = []
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
+    const serverCli = goke('server-cli')
+    serverCli.command('ping', 'Ping').action(() => 'pong')
+
+    const server = new Server({ name: 'test-server', version: '1.0.0' }, { capabilities: {} })
+    addCliToolsToMcp({ cli: serverCli, server })
+    await server.connect(serverTransport)
+
+    const cli = goke('testcli')
+    try {
+      await addMcpCommands({
+        cli,
+        argv: ['ping'],
+        getMcpTransport: () => clientTransport,
+        loadCache: () => undefined,
+        saveCache: (cache) => {
+          if (cache) saved.push(cache)
+        },
+      })
+    } finally {
+      await server.close()
+    }
+
+    expect(saved).toHaveLength(1)
+    expect(saved[0]?.tools.map((tool) => tool.name)).toEqual(['ping'])
+    expect(saved[0]).not.toHaveProperty('sessionId')
+  })
 })

package/src/__test__/http-multi-tenant.test.ts

@@ -3,8 +3,8 @@
  *
  * Proves that one goke cli exposed over the MCP streamable-HTTP
  * transport can serve multiple concurrent users with fully isolated
- * state (in-memory fs + cwd + env) — no shared host process stdio,
- * no cross-tenant leaks.
+ * state (in-memory fs + cwd + env). Isolation comes from the
+ * `x-tenant-id` header on each POST, not from `Mcp-Session-Id`.
  *
  * Wiring choices worth calling out:
  *
@@ -18,15 +18,14 @@
  *     into pure request/response JSON. GET SSE opens are answered
  *     with `405`, which the client treats as "server does not offer
  *     SSE" and moves on (see `_startOrAuthSse` in the SDK client).
- *   - Each session gets its own cli **clone** via
+ *   - Each HTTP POST gets a fresh transport with
+ *     `sessionIdGenerator: undefined` and a cli **clone** via
  *     `baseCli.clone({ cwd, env, fs })`. The clone inherits the
  *     command tree but owns its own `{ cwd, env, fs }`, which is
  *     what `runCliTool` forwards into every action through
  *     `ctx.process.*` / `ctx.fs`.
  */
 
-import { randomUUID } from "node:crypto";
-import { Buffer } from "node:buffer";
 import path from "node:path";
 
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -34,7 +33,6 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { Server as McpLowLevelServer } from "@modelcontextprotocol/sdk/server/index.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import type { FetchLike } from "@modelcontextprotocol/sdk/shared/transport.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { goke, type Goke, type GokeFs } from "goke";
 import { describe, expect, it } from "vitest";
 import { z } from "zod";
@@ -94,7 +92,7 @@ class InMemoryFs implements GokeFs {
  * One cli definition, reused across tenants. Commands read / write
  * through `ctx.fs` and resolve paths against `ctx.process.cwd`, so
  * the *same* code runs per tenant but talks to a tenant-specific
- * filesystem when invoked via the session-scoped clone below.
+ * filesystem when invoked via the per-request clone below.
  */
 function buildBaseCli(): Goke {
   const cli = goke("notes-app");
@@ -122,9 +120,8 @@ function buildBaseCli(): Goke {
 // ─── In-process multi-tenant fetch ────────────────────────────────
 
 /**
- * Per-tenant state resolved from the `x-tenant-id` header on a
- * session-initialization request. Each tenant gets its own cwd,
- * env, and in-memory fs.
+ * Per-tenant state resolved from the `x-tenant-id` header on each
+ * request. Each tenant gets its own cwd, env, and in-memory fs.
  */
 interface TenantState {
   cwd: string;
@@ -133,28 +130,27 @@ interface TenantState {
 }
 
 /**
- * Build a `FetchLike` that routes MCP streamable-HTTP traffic into
- * in-process session-scoped `WebStandardStreamableHTTPServerTransport`
- * instances. One transport + one cli clone per session. Each session
- * is keyed by `mcp-session-id`; initialization requests pick a tenant
- * via the `x-tenant-id` header.
- *
- * Returns both the custom fetch and the transports map so tests can
- * inspect session state if needed.
+ * Build a `FetchLike` that serves MCP streamable-HTTP traffic with a
+ * fresh transport + cli clone on every POST. Tenant identity comes
+ * from `x-tenant-id`. There is no `mcp-session-id` map.
  */
 function createMultiTenantFetch(options: {
   baseCli: Goke;
   resolveTenant: (tenantId: string) => TenantState;
 }): {
   fetch: FetchLike;
-  transports: Map<string, WebStandardStreamableHTTPServerTransport>;
+  sessionHeaders: string[];
 } {
   const { baseCli, resolveTenant } = options;
-  const transports = new Map<string, WebStandardStreamableHTTPServerTransport>();
+  const sessionHeaders: string[] = [];
 
   const customFetch: FetchLike = async (url, init) => {
     const method = (init?.method ?? "GET").toUpperCase();
     const headers = new Headers(init?.headers);
+    const sessionHeader = headers.get("mcp-session-id");
+    if (sessionHeader) {
+      sessionHeaders.push(sessionHeader);
+    }
 
     // Pure request/response mode: tell the client there's no SSE
     // available on GET. `_startOrAuthSse` in the SDK client treats
@@ -177,35 +173,11 @@ function createMultiTenantFetch(options: {
       }
     }
 
-    // Rebuild a plain Request with the same method + headers. The
-    // transport reads accept/content-type from here and uses
-    // `parsedBody` for the actual JSON-RPC payload.
     const request = new Request(url.toString(), {
       method,
       headers,
     });
 
-    const sessionId = headers.get("mcp-session-id");
-
-    // Existing session: route to its transport.
-    if (sessionId && transports.has(sessionId)) {
-      return transports.get(sessionId)!.handleRequest(request, { parsedBody });
-    }
-
-    // New session: must be an initialize POST.
-    if (method !== "POST" || !isInitializeRequest(parsedBody)) {
-      return new Response(
-        JSON.stringify({
-          jsonrpc: "2.0",
-          error: { code: -32000, message: "Bad Request: No valid session ID provided" },
-          id: null,
-        }),
-        { status: 400, headers: { "content-type": "application/json" } },
-      );
-    }
-
-    // Resolve the tenant from the custom header, build a cli clone
-    // with its cwd/env/fs, and spin up a session-scoped MCP server.
     const tenantId = headers.get("x-tenant-id");
     if (!tenantId) {
       return new Response("missing x-tenant-id header", { status: 401 });
@@ -225,29 +197,18 @@ function createMultiTenantFetch(options: {
     addCliToolsToMcp({ cli: tenantCli, server: mcpServer });
 
     const transport = new WebStandardStreamableHTTPServerTransport({
-      sessionIdGenerator: () => randomUUID(),
-      // Pure request/response — no SSE streaming to clean up.
+      sessionIdGenerator: undefined,
       enableJsonResponse: true,
-      onsessioninitialized: (sid) => {
-        transports.set(sid, transport);
-      },
-      onsessionclosed: (sid) => {
-        transports.delete(sid);
-      },
     });
 
-    transport.onclose = () => {
-      const sid = transport.sessionId;
-      if (sid) {
-        transports.delete(sid);
-      }
-    };
-
     await mcpServer.connect(transport);
-    return transport.handleRequest(request, { parsedBody });
+    const response = await transport.handleRequest(request, { parsedBody });
+    await transport.close();
+    await mcpServer.close();
+    return response;
   };
 
-  return { fetch: customFetch, transports };
+  return { fetch: customFetch, sessionHeaders };
 }
 
 // ─── Tests ────────────────────────────────────────────────────────
@@ -267,7 +228,7 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
       fs: new InMemoryFs(),
     });
 
-    const { fetch: tenantFetch } = createMultiTenantFetch({
+    const { fetch: tenantFetch, sessionHeaders } = createMultiTenantFetch({
       baseCli,
       resolveTenant: (id) => {
         const tenant = tenants.get(id);
@@ -297,7 +258,7 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
       return client;
     }
 
-    return { tenants, connectTenant };
+    return { tenants, connectTenant, sessionHeaders };
   }
 
   function firstTextBlock(result: Awaited<ReturnType<Client["callTool"]>>): string {
@@ -305,8 +266,8 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
     return content.find((block) => block.type === "text")?.text ?? "";
   }
 
-  it("routes each session to its own cli clone with tenant-specific cwd/env/fs", async () => {
-    const { tenants, connectTenant } = setupScenario();
+  it("routes each request to its own cli clone with tenant-specific cwd/env/fs", async () => {
+    const { tenants, connectTenant, sessionHeaders } = setupScenario();
 
     const aliceClient = await connectTenant("tenant-a");
     const bobClient = await connectTenant("tenant-b");
@@ -320,8 +281,8 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
       expect(bobTools).toEqual(["load", "save"]);
 
       // Both tenants write a file called `notes.txt` with different
-      // content. Since each session uses its own cli clone (with
-      // its own cwd + fs), the writes land in separate Maps.
+      // content. Since each request clones the cli with that tenant's
+      // cwd + fs, the writes land in separate Maps.
       const aliceSave = await aliceClient.callTool({
         name: "save",
         arguments: { filename: "notes.txt", content: "alice-secret" },
@@ -359,6 +320,7 @@ describe("remote MCP over streamable HTTP with multi-tenant in-memory fs", () =>
       expect([...tenantBFs.files.keys()]).toEqual(["/workspace-b/notes.txt"]);
       expect(tenantAFs.files.get("/workspace-a/notes.txt")).toBe("alice-secret");
       expect(tenantBFs.files.get("/workspace-b/notes.txt")).toBe("bob-secret");
+      expect(sessionHeaders).toEqual([]);
     } finally {
       await aliceClient.close();
       await bobClient.close();