@j0hanz/fetch-url-mcp 1.12.9 → 1.12.11

package/README.md

@@ -540,6 +540,8 @@ You get text content back by default. If output validation passes, the response
 
 To opt into progress updates, include `_meta.progressToken` in the tool call. The token may be a string or number. The server may then emit monotonic `notifications/progress` updates, and task mode reuses the same token until the task reaches a terminal state.
 
+To run the tool in task mode, include `_meta["modelcontextprotocol.io/task"] = { "taskId": "<client-id>", "keepAlive": <ms> }`. `tasks/result` returns output only after the task reaches `completed`. Task-linked progress notifications, task summaries, and final results include `_meta["modelcontextprotocol.io/related-task"] = { "taskId": "<client-id>" }`.
+
 ```json
 {
   "method": "tools/call",

package/dist/http/auth.d.ts

@@ -1,14 +1,9 @@
 import { InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
 import type { IncomingMessage, ServerResponse } from 'node:http';
-interface RequestContextLike {
-    readonly req: IncomingMessage;
-    readonly res: ServerResponse;
-    readonly url: URL;
-    readonly method: string | undefined;
-}
+import type { RequestContext } from './native.js';
 declare class CorsPolicy {
-    handle(ctx: RequestContextLike): boolean;
+    handle(ctx: RequestContext): boolean;
 }
 export declare const corsPolicy: CorsPolicy;
 declare class InsufficientScopeError extends InvalidTokenError {
@@ -17,7 +12,7 @@ declare class InsufficientScopeError extends InvalidTokenError {
 }
 export declare function isInsufficientScopeError(error: unknown): error is InsufficientScopeError;
 declare class HostOriginPolicy {
-    validate(ctx: RequestContextLike): boolean;
+    validate(ctx: RequestContext): boolean;
     private resolveHostHeader;
     private resolveRequestOrigin;
     private resolveOrigin;
@@ -57,7 +52,7 @@ declare class AuthService {
 }
 export declare function applyUnauthorizedAuthHeaders(req: IncomingMessage, res: ServerResponse): void;
 export declare function applyInsufficientScopeAuthHeaders(req: IncomingMessage, res: ServerResponse, requiredScopes: readonly string[], message?: string): void;
-export declare function buildProtectedResourceMetadataDocument(req: IncomingMessage): {
+export declare function buildProtectedResourceMetadataDocument(): {
     resource: string;
     resource_metadata: string;
     authorization_servers: string[];

package/dist/http/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAElB,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAG/E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAajE,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAyCD,cAAM,UAAU;IAId,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO;CAuBzC;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC;AAS3C,cAAM,sBAAuB,SAAQ,iBAAiB;IAElD,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE;gBAAjC,cAAc,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,SAAuB;CAKjC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,sBAAsB,CAEjC;AAwCD,cAAM,gBAAgB;IACpB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO;IA6B1C,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,oBAAoB;IAqB5B,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,MAAM;CAoBf;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC;AAMvD,wBAAgB,2BAA2B,IAAI,IAAI,CAyBlD;AAMD,eAAO,MAAM,4BAA4B,eAAe,CAAC;AACzD,eAAO,MAAM,+BAA+B,aAE1C,CAAC;AAEH,UAAU,8BAA8B;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAUD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CA2DT;AAED,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAQD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,GAAG,SAAS,GACzB,MAAM,GAAG,IAAI,CAWf;AAiBD,cAAM,WAAW;IACf,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEjC;IAEF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0C;IAEvE,YAAY,CAChB,GAAG,EAAE,eAAe,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC;IAwBpB,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,sBAAsB;IA6B9B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,mBAAmB;IA+B3B,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,yBAAyB;YA0BnB,oBAAoB;IAiClC,OAAO,CAAC,0BAA0B;IAmBlC,OAAO,CAAC,oBAAoB;YAiBd,uBAAuB;IA2DrC,OAAO,CAAC,iBAAiB;CAa1B;AA+BD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,IAAI,CAUN;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,SAA+C,GACrD,IAAI,CAYN;AAED,wBAAgB,sCAAsC,CAAC,GAAG,EAAE,eAAe,GAAG;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAgBA;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKzE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAElB,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAG/E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAajE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAwClD,cAAM,UAAU;IAId,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;CAuBrC;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC;AAS3C,cAAM,sBAAuB,SAAQ,iBAAiB;IAElD,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE;gBAAjC,cAAc,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,SAAuB;CAKjC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,sBAAsB,CAEjC;AAwCD,cAAM,gBAAgB;IACpB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;IA6BtC,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,oBAAoB;IAqB5B,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,MAAM;CAoBf;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC;AAMvD,wBAAgB,2BAA2B,IAAI,IAAI,CA6BlD;AAMD,eAAO,MAAM,4BAA4B,eAAe,CAAC;AACzD,eAAO,MAAM,+BAA+B,aAE1C,CAAC;AAEH,UAAU,8BAA8B;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAUD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAqDT;AAED,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAQD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,GAAG,SAAS,GACzB,MAAM,GAAG,IAAI,CAWf;AAiBD,cAAM,WAAW;IACf,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEjC;IAEF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0C;IAEvE,YAAY,CAChB,GAAG,EAAE,eAAe,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC;IAwBpB,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,sBAAsB;IA6B9B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,mBAAmB;IA+B3B,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,yBAAyB;YA0BnB,oBAAoB;IAiClC,OAAO,CAAC,0BAA0B;IAmBlC,OAAO,CAAC,oBAAoB;YAiBd,uBAAuB;IA2DrC,OAAO,CAAC,iBAAiB;CAa1B;AAyBD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,IAAI,CAUN;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,SAA+C,GACrD,IAAI,CAYN;AAED,wBAAgB,sCAAsC,IAAI;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAgBA;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKzE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/http/auth.js

@@ -2,8 +2,9 @@ import { InvalidTokenError, ServerError, } from '@modelcontextprotocol/sdk/serve
 import { randomBytes } from 'node:crypto';
 import { config } from '../lib/config.js';
 import { logDebug, Loggers, logWarn } from '../lib/core.js';
+import { sendJsonRpcError } from '../lib/mcp-interop.js';
 import { normalizeHost } from '../lib/net/index.js';
-import { composeAbortSignal, hmacSha256Hex, isObject, parseUrlOrNull, timingSafeEqualUtf8, } from '../lib/utils.js';
+import { composeAbortSignal, hmacSha256Hex, isObject, timingSafeEqualUtf8, } from '../lib/utils.js';
 function setNoStoreHeaders(res) {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('Cache-Control', 'no-store');
@@ -19,10 +20,8 @@ function sendEmpty(res, status) {
     res.setHeader('Content-Length', '0');
     res.end();
 }
-function sendError(res, _code, message, status = 400, 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars -- kept for call-site compatibility
-_id) {
-    sendJson(res, status, { error: message });
+function sendError(res, code, message, status = 400, id) {
+    sendJsonRpcError(res, status, code, message, id ?? null);
 }
 function getHeaderValue(req, name) {
     const value = req.headers[name];
@@ -136,7 +135,7 @@ class HostOriginPolicy {
             return null;
         const isEncrypted = Reflect.get(req.socket, 'encrypted') === true;
         const scheme = isEncrypted ? 'https' : 'http';
-        const parsed = parseUrlOrNull(`${scheme}://${hostHeader}`);
+        const parsed = URL.parse(`${scheme}://${hostHeader}`);
         if (!parsed)
             return null;
         const normalizedHost = normalizeHost(parsed.host);
@@ -151,7 +150,7 @@ class HostOriginPolicy {
     resolveOrigin(origin) {
         if (origin === 'null')
             return null;
-        const parsed = parseUrlOrNull(origin);
+        const parsed = URL.parse(origin);
         if (!parsed)
             return null;
         const scheme = parsed.protocol === 'https:' ? 'https' : 'http';
@@ -200,6 +199,9 @@ export function assertHttpModeConfiguration() {
     if (config.auth.mode === 'oauth' && !config.auth.issuerUrl) {
         throw Error('OAuth mode requires OAUTH_ISSUER_URL to serve RFC9728 metadata');
     }
+    if (config.auth.mode === 'oauth' && !config.auth.introspectionUrl) {
+        throw Error('OAuth mode requires OAUTH_INTROSPECTION_URL');
+    }
     if (config.auth.mode === 'static' && config.auth.staticTokens.length === 0) {
         throw Error('Static auth requires ACCESS_TOKENS or API_KEY to be configured');
     }
@@ -222,11 +224,6 @@ export function ensureMcpProtocolVersion(req, res, options) {
     const version = resolveMcpProtocolVersion(req);
     const path = URL.parse(req.url ?? '', 'http://localhost')?.pathname;
     if (!version) {
-        // Tolerate missing header on sessioned requests (expectedVersion set)
-        // to avoid breaking older clients that don't send it yet.
-        if (options?.expectedVersion) {
-            return true;
-        }
         logWarn('MCP protocol version rejected', { reason: 'missing_header', path }, 'http');
         sendError(res, -32600, 'Please include the MCP-Protocol-Version header in your request.');
         return false;
@@ -507,16 +504,11 @@ class AuthService {
         }
     }
 }
-function resolvePublicOrigin(req) {
-    const host = getHeaderValue(req, 'host');
-    if (host) {
-        const protocol = config.server.https.enabled ? 'https' : 'http';
-        return `${protocol}://${host}`;
-    }
+function resolvePublicOrigin() {
     return config.auth.resourceUrl.origin;
 }
-function buildRequestScopedProtectedResourceUrls(req) {
-    const origin = resolvePublicOrigin(req);
+function buildRequestScopedProtectedResourceUrls() {
+    const origin = resolvePublicOrigin();
     return {
         resource: new URL('/mcp', `${origin}/`).href,
         resourceMetadata: new URL(resolveResourceMetadataPath(), `${origin}/`).href,
@@ -525,13 +517,13 @@ function buildRequestScopedProtectedResourceUrls(req) {
 function resolveResourceMetadataPath() {
     return '/.well-known/oauth-protected-resource/mcp';
 }
-function buildResourceMetadataUrl(req) {
-    return buildRequestScopedProtectedResourceUrls(req).resourceMetadata;
+function buildResourceMetadataUrl() {
+    return buildRequestScopedProtectedResourceUrls().resourceMetadata;
 }
 export function applyUnauthorizedAuthHeaders(req, res) {
     if (!isOAuthMetadataEnabled())
         return;
-    const resourceMetadata = buildResourceMetadataUrl(req);
+    const resourceMetadata = buildResourceMetadataUrl();
     const challengeParts = [`resource_metadata="${resourceMetadata}"`];
     if (config.auth.requiredScopes.length > 0) {
         challengeParts.push(`scope="${config.auth.requiredScopes.join(' ')}"`);
@@ -541,7 +533,7 @@ export function applyUnauthorizedAuthHeaders(req, res) {
 export function applyInsufficientScopeAuthHeaders(req, res, requiredScopes, message = 'Additional authorization scope is required') {
     if (!isOAuthMetadataEnabled())
         return;
-    const resourceMetadata = buildResourceMetadataUrl(req);
+    const resourceMetadata = buildResourceMetadataUrl();
     const challengeParts = [
         'error="insufficient_scope"',
         `scope="${requiredScopes.join(' ')}"`,
@@ -550,8 +542,8 @@ export function applyInsufficientScopeAuthHeaders(req, res, requiredScopes, mess
     ];
     res.setHeader('WWW-Authenticate', `Bearer ${challengeParts.join(', ')}`);
 }
-export function buildProtectedResourceMetadataDocument(req) {
-    const urls = buildRequestScopedProtectedResourceUrls(req);
+export function buildProtectedResourceMetadataDocument() {
+    const urls = buildRequestScopedProtectedResourceUrls();
     if (!config.auth.issuerUrl) {
         const error = new ServerError('OAuth issuer URL is required for protected resource metadata');
         throw error;

package/dist/http/native.d.ts

@@ -21,7 +21,7 @@ export interface AuthenticatedContext extends RequestContext {
 }
 export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
 export declare function sendEmpty(res: ServerResponse, status: number): void;
-export declare function sendError(res: ServerResponse, _code: number, message: string, status?: number, _id?: JsonRpcId | null): void;
+export declare function sendError(res: ServerResponse, code: number, message: string, status?: number, id?: JsonRpcId | null): void;
 export declare function getHeaderValue(req: IncomingMessage, name: string): string | null;
 export declare function getMcpSessionId(req: IncomingMessage): string | null;
 export declare function findDuplicateSingleValueHeader(req: IncomingMessage): string | null;
@@ -45,7 +45,10 @@ export declare class JsonBodyError extends Error {
 export declare function isJsonBodyError(error: unknown): error is JsonBodyError;
 export declare const DEFAULT_BODY_LIMIT_BYTES: number;
 declare class JsonBodyReader {
+    private validateContentLength;
     read(req: IncomingMessage, limit?: number, signal?: AbortSignal): Promise<unknown>;
+    private setupAbortListener;
+    private cleanupAbortListener;
     private readBody;
     private collectChunks;
     private normalizeChunk;

package/dist/http/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/http/native.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAM/E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,KAAK,MAAM,IAAI,WAAW,EAE3B,MAAM,YAAY,CAAC;AASpB,OAAO,EAeL,KAAK,YAAY,EAIlB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,uBAAuB,CAAC;AAgD/B,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,CAAC;AAyFjD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,IAAI,EAAE,QAAQ,CAAC;CAChB;AAWD,wBAAgB,QAAQ,CACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,IAAI,CAKN;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAInE;AAED,wBAAgB,SAAS,CACvB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,SAAM,EAEZ,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,GACrB,IAAI,CAEN;AAMD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAIf;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAKnE;AAkBD,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,eAAe,GACnB,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAOvD;AAMD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG;IAC9D,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAwCA;AAgBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAwBpE;AAMD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,GAAG,IAAI,CAgBvB;AAMD,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EAC5C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,6BAA6B,GAC3C,SAAS,CA4CX;AAMD,KAAK,iBAAiB,GAAG,mBAAmB,GAAG,cAAc,GAAG,aAAa,CAAC;AAE9E,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBAErB,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAED,eAAO,MAAM,wBAAwB,QAAc,CAAC;AAMpD,cAAM,cAAc;IACZ,IAAI,CACR,GAAG,EAAE,eAAe,EACpB,KAAK,SAA2B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC;YAgCL,QAAQ;YA0CR,aAAa;IAqD3B,OAAO,CAAC,cAAc;CAOvB;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC;AAEnD,UAAU,iBAAiB;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,6BAA6B,CAAC;CAC1C;AAED,UAAU,sBAAsB;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAoCD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,oCAAoC,CACxD,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAEnE;AAaD,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAqKD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAKnE;AAiCD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAEpE;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,OAAO,GACnB,OAAO,CAOT;AAi2CD,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CA2DD"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/http/native.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAS/E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,KAAK,MAAM,IAAI,WAAW,EAE3B,MAAM,YAAY,CAAC;AASpB,OAAO,EAgBL,KAAK,YAAY,EAIlB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,uBAAuB,CAAC;AA4C/B,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,CAAC;AA+FjD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,IAAI,EAAE,QAAQ,CAAC;CAChB;AAWD,wBAAgB,QAAQ,CACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,IAAI,CAKN;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAInE;AAED,wBAAgB,SAAS,CACvB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,SAAM,EACZ,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,GACpB,IAAI,CAEN;AAMD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAIf;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAKnE;AAkBD,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,eAAe,GACnB,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAOvD;AAMD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG;IAC9D,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAwCA;AAgBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAwBpE;AAMD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,GAAG,IAAI,CAgBvB;AAMD,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EAC5C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,6BAA6B,GAC3C,SAAS,CA4CX;AAMD,KAAK,iBAAiB,GAAG,mBAAmB,GAAG,cAAc,GAAG,aAAa,CAAC;AAE9E,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBAErB,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAED,eAAO,MAAM,wBAAwB,QAAc,CAAC;AAMpD,cAAM,cAAc;IAClB,OAAO,CAAC,qBAAqB;IAUvB,IAAI,CACR,GAAG,EAAE,eAAe,EACpB,KAAK,SAA2B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC;IAqBnB,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,oBAAoB;YAYd,QAAQ;YAuBR,aAAa;IAqD3B,OAAO,CAAC,cAAc;CAOvB;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC;AAEnD,UAAU,iBAAiB;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,6BAA6B,CAAC;CAC1C;AAED,UAAU,sBAAsB;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA8CD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,oCAAoC,CACxD,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAEnE;AAaD,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAqKD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAKnE;AAiCD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAEpE;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,OAAO,GACnB,OAAO,CAOT;AAk4CD,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAkED"}

package/dist/http/native.js

@@ -1,5 +1,5 @@
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { ErrorCode, isInitializeRequest, } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'node:crypto';
 import { once } from 'node:events';
 import { readFileSync } from 'node:fs';
@@ -11,17 +11,20 @@ import process from 'node:process';
 import { Writable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { config, enableHttpMode, serverVersion } from '../lib/config.js';
-import { composeCloseHandlers, createSessionStore, createSlotTracker, ensureSessionCapacity, logDebug, logError, Loggers, logInfo, logWarn, registerMcpSessionOwnerKey, registerMcpSessionServer, reserveSessionSlot, resolveMcpSessionIdByServer, runWithRequestContext, startSessionCleanupLoop, unregisterMcpSessionServer, unregisterMcpSessionServerByServer, } from '../lib/core.js';
+import { composeCloseHandlers, createSessionStore, createSlotTracker, ensureSessionCapacity, logDebug, logError, Loggers, logInfo, logWarn, registerMcpSessionOwnerKey, registerMcpSessionServer, reserveSessionSlot, resolveMcpSessionIdByServer, runWithRequestContext, runWithTraceContext, startSessionCleanupLoop, unregisterMcpSessionServer, unregisterMcpSessionServerByServer, } from '../lib/core.js';
 import { getErrorMessage, toError } from '../lib/error/index.js';
-import { acceptsEventStream, acceptsJsonAndEventStream, isMcpRequestBody, } from '../lib/mcp-interop.js';
+import { acceptsEventStream, acceptsJsonAndEventStream, isMcpRequestBody, sendJsonRpcError, } from '../lib/mcp-interop.js';
 import { createDefaultBlockList, normalizeIpForBlockList, } from '../lib/net/index.js';
 import { isObject } from '../lib/utils.js';
 import { createMcpServerForHttpSession } from '../server.js';
 import { buildAuthenticatedOwnerKey } from '../tasks/index.js';
 import { getTransformPoolStats } from '../transform/index.js';
-import { applyInsufficientScopeAuthHeaders, applyUnauthorizedAuthHeaders, assertHttpModeConfiguration, authService, buildAuthFingerprint, buildProtectedResourceMetadataDocument, corsPolicy, DEFAULT_MCP_PROTOCOL_VERSION, ensureMcpProtocolVersion, hostOriginPolicy, isInsufficientScopeError, isOAuthMetadataEnabled, isProtectedResourceMetadataPath, SUPPORTED_MCP_PROTOCOL_VERSIONS, } from './auth.js';
-import { createRateLimitManagerImpl, } from './rate-limit.js';
+import { applyInsufficientScopeAuthHeaders, applyUnauthorizedAuthHeaders, assertHttpModeConfiguration, authService, buildAuthFingerprint, buildProtectedResourceMetadataDocument, corsPolicy, ensureMcpProtocolVersion, hostOriginPolicy, isInsufficientScopeError, isOAuthMetadataEnabled, isProtectedResourceMetadataPath, SUPPORTED_MCP_PROTOCOL_VERSIONS, } from './auth.js';
+import { RateLimiter } from './rate-limit.js';
 const DROP_LOG_INTERVAL_MS = 10_000;
+const MISSING_SESSION_ID_MESSAGE = "We couldn't find a session ID for your request. Please ensure you have an active session.";
+const SESSION_NOT_INITIALIZED_MESSAGE = "Your session hasn't been initialized yet. Please wait a moment and try again.";
+const SESSION_NOT_FOUND_MESSAGE = "We couldn't find your session. It might have expired or been closed.";
 function abortControllerBestEffort(controller) {
     if (!controller.signal.aborted)
         controller.abort();
@@ -93,10 +96,8 @@ export function sendEmpty(res, status) {
     res.setHeader('Content-Length', '0');
     res.end();
 }
-export function sendError(res, _code, message, status = 400, 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars -- kept for call-site compat
-_id) {
-    sendJson(res, status, { error: message });
+export function sendError(res, code, message, status = 400, id) {
+    sendJsonRpcError(res, status, code, message, id ?? null);
 }
 // ---------------------------------------------------------------------------
 // Request helpers
@@ -305,18 +306,20 @@ function isRequestReadAborted(req) {
     return req.destroyed && !req.complete;
 }
 class JsonBodyReader {
+    validateContentLength(req, limit) {
+        const contentLengthHeader = getHeaderValue(req, 'content-length');
+        if (!contentLengthHeader)
+            return;
+        const contentLength = Number.parseInt(contentLengthHeader, 10);
+        if (Number.isFinite(contentLength) && contentLength > limit) {
+            throw new JsonBodyError('payload-too-large', 'Payload too large');
+        }
+    }
     async read(req, limit = DEFAULT_BODY_LIMIT_BYTES, signal) {
         const contentType = getHeaderValue(req, 'content-type');
         if (!contentType?.includes('application/json'))
             return undefined;
-        const contentLengthHeader = getHeaderValue(req, 'content-length');
-        if (contentLengthHeader) {
-            const contentLength = Number.parseInt(contentLengthHeader, 10);
-            if (Number.isFinite(contentLength) && contentLength > limit) {
-                const error = new JsonBodyError('payload-too-large', 'Payload too large');
-                throw error;
-            }
-        }
+        this.validateContentLength(req, limit);
         if (signal?.aborted || isRequestReadAborted(req)) {
             const error = new JsonBodyError('read-failed', 'Request aborted');
             throw error;
@@ -328,24 +331,35 @@ class JsonBodyReader {
             return JSON.parse(body);
         }
         catch (err) {
-            const error = new JsonBodyError('invalid-json', getErrorMessage(err));
-            throw error;
+            throw new JsonBodyError('invalid-json', getErrorMessage(err));
         }
     }
-    async readBody(req, limit, signal) {
-        const abortListener = signal != null
-            ? () => {
-                destroyRequestBestEffort(req);
-            }
-            : null;
-        if (signal != null && abortListener) {
-            if (signal.aborted) {
-                abortListener();
-            }
-            else {
-                signal.addEventListener('abort', abortListener, { once: true });
-            }
+    setupAbortListener(req, signal) {
+        if (signal == null)
+            return null;
+        const listener = () => {
+            destroyRequestBestEffort(req);
+        };
+        if (signal.aborted) {
+            listener();
+        }
+        else {
+            signal.addEventListener('abort', listener, { once: true });
         }
+        return listener;
+    }
+    cleanupAbortListener(signal, listener) {
+        if (!signal || !listener)
+            return;
+        try {
+            signal.removeEventListener('abort', listener);
+        }
+        catch {
+            // Best-effort cleanup.
+        }
+    }
+    async readBody(req, limit, signal) {
+        const abortListener = this.setupAbortListener(req, signal);
         try {
             const { chunks, size } = await this.collectChunks(req, limit, signal);
             if (chunks.length === 0)
@@ -360,14 +374,7 @@ class JsonBodyReader {
             return text;
         }
         finally {
-            if (signal && abortListener) {
-                try {
-                    signal.removeEventListener('abort', abortListener);
-                }
-                catch {
-                    // Best-effort cleanup.
-                }
-            }
+            this.cleanupAbortListener(signal, abortListener);
         }
     }
     async collectChunks(req, limit, signal) {
@@ -429,7 +436,7 @@ function unregisterSessionTaskScope(server) {
     unregisterMcpSessionServer(sessionId);
     return sessionId;
 }
-async function closeSessionResources(session, options) {
+function buildCloseTasks(session, options) {
     const closeTasks = [];
     if (options.closeTransportReason) {
         closeTasks.push(closeTransportBestEffort(session.transport, options.closeTransportReason));
@@ -437,6 +444,10 @@ async function closeSessionResources(session, options) {
     if (options.closeServerReason) {
         closeTasks.push(closeMcpServerBestEffort(session.server, options.closeServerReason));
     }
+    return closeTasks;
+}
+async function closeSessionResources(session, options) {
+    const closeTasks = buildCloseTasks(session, options);
     if (options.awaitClose && closeTasks.length > 0) {
         await Promise.all(closeTasks);
     }
@@ -607,19 +618,15 @@ export function sendHealthRouteResponse(store, ctx, authPresent) {
 }
 function resolveRequestedProtocolVersion(body) {
     if (!isObject(body))
-        return DEFAULT_MCP_PROTOCOL_VERSION;
+        return '';
     const { params } = body;
     if (!isObject(params))
-        return DEFAULT_MCP_PROTOCOL_VERSION;
+        return '';
     const { protocolVersion: value } = params;
     if (typeof value !== 'string')
-        return DEFAULT_MCP_PROTOCOL_VERSION;
+        return '';
     const normalized = value.trim();
-    if (normalized.length === 0)
-        return DEFAULT_MCP_PROTOCOL_VERSION;
-    return SUPPORTED_MCP_PROTOCOL_VERSIONS.has(normalized)
-        ? normalized
-        : DEFAULT_MCP_PROTOCOL_VERSION;
+    return normalized;
 }
 function resolveProtocolVersionHeader(req) {
     const header = getHeaderValue(req, 'mcp-protocol-version');
@@ -631,6 +638,15 @@ function resolveProtocolVersionHeader(req) {
 function isInitializedNotification(method) {
     return method === 'notifications/initialized';
 }
+function getBodyMeta(body) {
+    if (!isObject(body))
+        return undefined;
+    const { params } = body;
+    if (!isObject(params))
+        return undefined;
+    const meta = params['_meta'];
+    return isObject(meta) ? meta : undefined;
+}
 function isPingRequest(method) {
     return method === 'ping';
 }
@@ -747,9 +763,7 @@ class McpSessionGateway {
                 status: 406,
                 sessionId,
             });
-            sendJson(ctx.res, 406, {
-                error: 'We need you to use "text/event-stream" for this connection.',
-            });
+            sendError(ctx.res, ErrorCode.InvalidRequest, 'We need you to use "text/event-stream" for this connection.', 406);
             return;
         }
         logDebug('MCP GET received', { sessionId }, Loggers.LOG_HTTP);
@@ -777,9 +791,7 @@ class McpSessionGateway {
                 reason: 'accept_missing_json_or_event_stream',
                 status: 406,
             });
-            sendJson(ctx.res, 406, {
-                error: 'We need the request to accept both "application/json" and "text/event-stream".',
-            });
+            sendError(ctx.res, ErrorCode.InvalidRequest, 'We need the request to accept both "application/json" and "text/event-stream".', 406);
             return null;
         }
         const { body } = ctx;
@@ -843,7 +855,7 @@ class McpSessionGateway {
                     mcpCode: -32600,
                     rpcId: requestId,
                 });
-                sendError(ctx.res, -32600, "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
+                sendError(ctx.res, -32600, MISSING_SESSION_ID_MESSAGE, 400, requestId);
                 return false;
             }
             return true;
@@ -866,7 +878,7 @@ class McpSessionGateway {
             sessionId,
             rpcId: requestId,
         });
-        sendError(ctx.res, -32600, "Your session hasn't been initialized yet. Please wait a moment and try again.", 400, requestId);
+        sendError(ctx.res, -32600, SESSION_NOT_INITIALIZED_MESSAGE, 400, requestId);
         return false;
     }
     async getOrCreateTransport(ctx, requestId) {
@@ -880,40 +892,39 @@ class McpSessionGateway {
             return null;
         return this.createNewSession(ctx, requestId, negotiatedProtocolVersion);
     }
+    rejectInitializeRequest(ctx, requestId, reason, mcpCode, message) {
+        logGatewayRejection({
+            message: 'Rejected MCP initialize request',
+            method: ctx.method,
+            path: ctx.url.pathname,
+            reason,
+            status: 400,
+            mcpCode,
+            rpcId: requestId,
+        });
+        sendError(ctx.res, mcpCode, message, 400, requestId);
+        return null;
+    }
     getInitializeProtocolVersion(ctx, requestId) {
         if (!isMcpRequestBody(ctx.body)) {
-            logGatewayRejection({
-                message: 'Rejected MCP initialize request',
-                method: ctx.method,
-                path: ctx.url.pathname,
-                reason: 'missing_session_id',
-                status: 400,
-                mcpCode: -32600,
-                rpcId: requestId,
-            });
-            sendError(ctx.res, -32600, "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
-            return null;
+            return this.rejectInitializeRequest(ctx, requestId, 'missing_session_id', -32600, MISSING_SESSION_ID_MESSAGE);
         }
         if (!isInitializeRequest(ctx.body)) {
             const invalidInitialize = ctx.body.method === 'initialize';
-            logGatewayRejection({
-                message: 'Rejected MCP initialize request',
-                method: ctx.method,
-                path: ctx.url.pathname,
-                reason: invalidInitialize
-                    ? 'invalid_initialize_request'
-                    : 'missing_session_id',
-                status: 400,
-                mcpCode: invalidInitialize ? -32602 : -32600,
-                rpcId: requestId,
-            });
-            sendError(ctx.res, invalidInitialize ? -32602 : -32600, invalidInitialize
+            return this.rejectInitializeRequest(ctx, requestId, invalidInitialize ? 'invalid_initialize_request' : 'missing_session_id', invalidInitialize ? -32602 : -32600, invalidInitialize
                 ? 'The initialize request format is invalid. Please double-check your parameters.'
-                : "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
-            return null;
+                : MISSING_SESSION_ID_MESSAGE);
         }
         const negotiatedProtocolVersion = resolveRequestedProtocolVersion(ctx.body);
+        if (negotiatedProtocolVersion.length === 0 ||
+            !SUPPORTED_MCP_PROTOCOL_VERSIONS.has(negotiatedProtocolVersion)) {
+            return this.rejectInitializeRequest(ctx, requestId, 'unsupported_protocol_version', -32600, `The protocol version '${negotiatedProtocolVersion || '(missing)'}' isn't supported right now. Please check and try again.`);
+        }
         const headerProtocolVersion = resolveProtocolVersionHeader(ctx.req);
+        if (headerProtocolVersion &&
+            !SUPPORTED_MCP_PROTOCOL_VERSIONS.has(headerProtocolVersion)) {
+            return this.rejectInitializeRequest(ctx, requestId, 'unsupported_protocol_version_header', -32600, `The protocol version '${headerProtocolVersion}' isn't supported right now. Please check and try again.`);
+        }
         if (headerProtocolVersion &&
             headerProtocolVersion !== negotiatedProtocolVersion) {
             logGatewayRejection({
@@ -951,20 +962,30 @@ class McpSessionGateway {
             return null;
         return { sessionId, session };
     }
+    sendMissingSessionId(res, requestId = null) {
+        sendError(res, -32600, MISSING_SESSION_ID_MESSAGE, 400, requestId);
+        return null;
+    }
+    sendSessionNotInitialized(res, requestId = null) {
+        sendError(res, -32600, SESSION_NOT_INITIALIZED_MESSAGE, 400, requestId);
+        return null;
+    }
+    sendSessionUnavailable(res, requestId = null, status = 404) {
+        sendError(res, -32600, SESSION_NOT_FOUND_MESSAGE, status, requestId);
+        return null;
+    }
     getRequiredAuthenticatedSession(ctx, requestId = null, options) {
         const state = this.getOptionalAuthenticatedSession(ctx, requestId);
         if (!state)
             return null;
         const { sessionId, session } = state;
         if (!sessionId || !session) {
-            sendError(ctx.res, -32600, "We couldn't find a session ID for your request. Please ensure you have an active session.", 400, requestId);
-            return null;
+            return this.sendMissingSessionId(ctx.res, requestId);
         }
         if (!this.ensureSessionProtocolVersion(ctx, session))
             return null;
         if (options?.requireInitialized && !session.protocolInitialized) {
-            sendError(ctx.res, -32600, "Your session hasn't been initialized yet. Please wait a moment and try again.", 400, requestId);
-            return null;
+            return this.sendSessionNotInitialized(ctx.res, requestId);
         }
         return { sessionId, session };
     }
@@ -980,7 +1001,7 @@ class McpSessionGateway {
                 sessionId,
                 rpcId: requestId,
             });
-            sendError(res, -32600, "We couldn't find your session. It might have expired or been closed.", 404, requestId);
+            sendError(res, -32600, SESSION_NOT_FOUND_MESSAGE, 404, requestId);
             return null;
         }
         if (!authFingerprint || session.authFingerprint !== authFingerprint) {
@@ -993,8 +1014,7 @@ class McpSessionGateway {
                 sessionId,
                 rpcId: requestId,
             });
-            sendError(res, -32600, "We couldn't find your session. It might have expired or been closed.", 404, requestId);
-            return null;
+            return this.sendSessionUnavailable(res, requestId);
         }
         return session;
     }
@@ -1177,6 +1197,13 @@ class HttpDispatcher {
         this.store = store;
         this.mcpGateway = mcpGateway;
     }
+    sendAuthFailure(ctx, status, message) {
+        if (isMcpRoute(ctx.url.pathname)) {
+            sendError(ctx.res, -32000, message, status);
+            return;
+        }
+        sendJson(ctx.res, status, { error: message });
+    }
     async tryHandleHealthRoute(ctx) {
         if (!shouldHandleHealthRoute(ctx))
             return false;
@@ -1198,7 +1225,7 @@ class HttpDispatcher {
             return false;
         if (!isProtectedResourceMetadataPath(ctx.url.pathname))
             return false;
-        const document = buildProtectedResourceMetadataDocument(ctx.req);
+        const document = buildProtectedResourceMetadataDocument();
         sendJson(ctx.res, 200, document);
         return true;
     }
@@ -1260,11 +1287,11 @@ class HttpDispatcher {
             logWarn('Authentication failed', { message, method: ctx.method, path: ctx.url.pathname }, Loggers.LOG_AUTH);
             if (isInsufficientScopeError(err)) {
                 applyInsufficientScopeAuthHeaders(ctx.req, ctx.res, err.requiredScopes, message);
-                sendError(ctx.res, -32000, message, 403);
+                this.sendAuthFailure(ctx, 403, message);
                 return null;
             }
             applyUnauthorizedAuthHeaders(ctx.req, ctx.res);
-            sendError(ctx.res, -32000, message, 401);
+            this.sendAuthFailure(ctx, 401, message);
             return null;
         }
     }
@@ -1343,7 +1370,7 @@ class HttpRequestPipeline {
                     return;
                 if (!(await this.populateRequestBody(ctx, rawReq)))
                     return;
-                await this.dispatcher.dispatch(ctx);
+                await runWithTraceContext(getBodyMeta(ctx.body), () => this.dispatcher.dispatch(ctx));
             });
         }
         finally {
@@ -1385,9 +1412,6 @@ class HttpRequestPipeline {
             return false;
         }
         if (!this.rateLimiter.check(ctx)) {
-            sendJson(ctx.res, 429, {
-                error: "You're sending requests a bit too quickly. Please slow down and try again.",
-            });
             drainRequest(rawReq);
             return false;
         }
@@ -1502,7 +1526,7 @@ export async function startHttpServer() {
     assertHttpModeConfiguration();
     enableHttpMode();
     resetEventLoopMonitoring();
-    const rateLimiter = createRateLimitManagerImpl(config.rateLimit);
+    const rateLimiter = new RateLimiter(config.rateLimit);
     const sessionStore = createSessionStore(config.server.sessionTtlMs);
     const sessionCleanup = startSessionCleanupLoop(sessionStore, config.server.sessionTtlMs, {
         onEvictSession: (session) => {
@@ -1522,6 +1546,12 @@ export async function startHttpServer() {
     await listen(server, config.server.host, config.server.port);
     const port = resolveListeningPort(server, config.server.port);
     const protocol = config.server.https.enabled ? 'https' : 'http';
+    if (!config.auth.publicBaseUrl) {
+        const resolvedResourceUrl = new URL(config.auth.resourceUrl);
+        resolvedResourceUrl.port = String(port);
+        resolvedResourceUrl.protocol = `${protocol}:`;
+        config.auth.resourceUrl = resolvedResourceUrl;
+    }
     logInfo(`${protocol.toUpperCase()} server listening on port ${port}`, {
         platform: process.platform,
         arch: process.arch,