@mcp-ts/sdk 2.4.2 → 2.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-ts/sdk",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "publishConfig": {
     "access": "public"
   },

package/src/bin/mcp-ts.ts

@@ -82,13 +82,13 @@ async function initSupabase() {
             console.log('   npx supabase db push');
             console.log('\n3. Add your Supabase credentials to .env:');
             console.log('   SUPABASE_URL=https://<your-project-id>.supabase.co');
-            console.log('   SUPABASE_SERVICE_ROLE_KEY=<your-service-role-key>');
-            console.log('\n⚠️  Important: Use the service_role key (not the anon key) for server-side storage.');
-            console.log('   The service_role key bypasses RLS policies and is required for mcp-ts to work correctly.');
-            console.log('   Find it in: Supabase Dashboard -> Project Settings -> API -> service_role');
+            console.log('   SUPABASE_SECRET_KEY=<your-secret-key>');
+            console.log('\n⚠️  Important: Use the secret key (not the anon key) for server-side storage.');
+            console.log('   The secret key bypasses RLS policies and is required for mcp-ts to work correctly.');
+            console.log('   Find it in: Supabase Dashboard -> Project Settings -> API -> Secret key');
         } else if (files.length > 0) {
             console.log('\n👍 All migration files are already present in your project.');
-            console.log('   Ensure SUPABASE_SERVICE_ROLE_KEY (not SUPABASE_ANON_KEY) is set in your .env');
+            console.log('   Ensure SUPABASE_SECRET_KEY (not SUPABASE_ANON_KEY) is set in your .env');
         } else {
             console.log('⚠️  No migration files found to copy.');
         }

package/src/server/mcp/multi-session-client.ts

@@ -152,6 +152,19 @@ export class MultiSessionClient implements ToolClientProvider {
         return this.clients;
     }
 
+    /**
+     * Removes and disconnects a single session by ID.
+     *
+     * @returns `true` if the session was found and removed, `false` if not found.
+     */
+    async removeSession(sessionId: string): Promise<boolean> {
+        const idx = this.clients.findIndex(c => c.getSessionId() === sessionId);
+        if (idx === -1) return false;
+        const [client] = this.clients.splice(idx, 1);
+        await client.disconnect();
+        return true;
+    }
+
     /**
      * Gracefully disconnects all active MCP clients and clears the internal list.
      *

package/src/server/mcp/oauth-client.ts

@@ -257,7 +257,6 @@ export class MCPClient {
           const hasSessionHeader = init?.headers && new Headers(init.headers as HeadersInit).has('mcp-session-id');
 
           if (response.status === 404 && hasSessionHeader) {
-            this.client = null;
             throw new Error("MCP_SESSION_EXPIRED: Downstream session was not found on the server.");
           }
 
@@ -791,7 +790,9 @@ export class MCPClient {
         params: {},
       };
 
-      const result = await this.client.request(request, ListToolsResultSchema);
+      const result = await this.withRetry(() =>
+        this.client!.request(request, ListToolsResultSchema)
+      );
 
       if (this.serverId) {
         this._onConnectionEvent.fire({
@@ -837,7 +838,9 @@ export class MCPClient {
     };
 
     try {
-      const result = await this.client.request(request, CallToolResultSchema);
+      const result = await this.withRetry(() =>
+        this.client!.request(request, CallToolResultSchema)
+      );
 
       this._onObservabilityEvent.fire({
         type: 'mcp:client:tool_call',
@@ -897,7 +900,9 @@ export class MCPClient {
         params: {},
       };
 
-      const result = await this.client.request(request, ListPromptsResultSchema);
+      const result = await this.withRetry(() =>
+        this.client!.request(request, ListPromptsResultSchema)
+      );
 
       this.emitStateChange('READY');
       this.emitProgress(`Discovered ${result.prompts.length} prompts`);
@@ -931,7 +936,9 @@ export class MCPClient {
       },
     };
 
-    return await this.client.request(request, GetPromptResultSchema);
+    return await this.withRetry(() =>
+      this.client!.request(request, GetPromptResultSchema)
+    );
   }
 
   /**
@@ -952,7 +959,9 @@ export class MCPClient {
         params: {},
       };
 
-      const result = await this.client.request(request, ListResourcesResultSchema);
+      const result = await this.withRetry(() =>
+        this.client!.request(request, ListResourcesResultSchema)
+      );
 
       this.emitStateChange('READY');
       this.emitProgress(`Discovered ${result.resources.length} resources`);
@@ -984,7 +993,34 @@ export class MCPClient {
       },
     };
 
-    return await this.client.request(request, ReadResourceResultSchema);
+    return await this.withRetry(() =>
+      this.client!.request(request, ReadResourceResultSchema)
+    );
+  }
+
+  /**
+   * Wraps an MCP request with automatic transport-session recovery.
+   *
+   * When the downstream MCP server rejects the request with a 404 indicating
+   * the transport session has expired, this method tears down the stale SDK
+   * client and transport, calls {@link reconnect} to negotiate a fresh session,
+   * and retries the request once.
+   *
+   * Non-transient errors (network failures, auth errors, etc.) propagate as-is.
+   */
+  private async withRetry<T>(fn: () => Promise<T>): Promise<T> {
+    try {
+      return await fn();
+    } catch (error) {
+      if (!(error instanceof Error && error.message.includes('MCP_SESSION_EXPIRED'))) throw error;
+      if (this.client) {
+        try { await this.client.close(); } catch {}
+        this.transport = null;
+        this.client = null;
+      }
+      await this.reconnect();
+      return await fn();
+    }
   }
 
   /**
@@ -1000,6 +1036,12 @@ export class MCPClient {
       throw new Error('OAuth provider not initialized');
     }
 
+    // Close the client initialize() may have created — we need a fresh
+    // client that will negotiate a new transport session.
+    if (this.client) {
+      try { await this.client.close(); } catch {}
+    }
+
     this.client = new Client(
       {
         name: MCP_CLIENT_NAME,

package/src/server/storage/index.ts

@@ -141,13 +141,13 @@ async function createStorage(): Promise<SessionStore> {
 
     if (type === 'supabase') {
         const url = process.env.SUPABASE_URL;
-        const key = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY;
+        const key = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY;
         
         if (!url || !key) {
-            console.warn('[mcp-ts][Storage] Explicit selection "supabase" requires SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.');
+            console.warn('[mcp-ts][Storage] Explicit selection "supabase" requires SUPABASE_URL and SUPABASE_SECRET_KEY.');
         } else {
-            if (!process.env.SUPABASE_SERVICE_ROLE_KEY) {
-                console.warn('[mcp-ts][Storage] ⚠️  Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SERVICE_ROLE_KEY" is recommended.');
+            if (!process.env.SUPABASE_SECRET_KEY) {
+                console.warn('[mcp-ts][Storage] ⚠️  Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SECRET_KEY" is recommended.');
             }
             try {
                 const { createClient } = await import('@supabase/supabase-js');
@@ -210,14 +210,14 @@ async function createStorage(): Promise<SessionStore> {
         return await initializeStorage(new SqliteStorage({ path: process.env.MCP_TS_STORAGE_SQLITE_PATH }));
     }
 
-    if (process.env.SUPABASE_URL && (process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY)) {
+    if (process.env.SUPABASE_URL && (process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY)) {
         try {
             const { createClient } = await import('@supabase/supabase-js');
             const url = process.env.SUPABASE_URL;
-            const key = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY!;
+            const key = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY!;
             
-            if (!process.env.SUPABASE_SERVICE_ROLE_KEY) {
-                console.warn('[mcp-ts][Storage] ⚠️ Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SERVICE_ROLE_KEY" is recommended.');
+            if (!process.env.SUPABASE_SECRET_KEY) {
+                console.warn('[mcp-ts][Storage] ⚠️ Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SECRET_KEY" is recommended.');
             }
 
             const client = createClient(url, key);