@mcpmake/core 0.3.3 → 0.3.4

package/dist/emitter/site-templates/server-main-http.ts.hbs

@@ -74,6 +74,10 @@ let isReady = false;
 
 if (process.env.TRANSPORT === 'http') {
   const port = parseInt(process.env.PORT ?? '3000', 10);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    log('error', 'Invalid PORT value, must be 1-65535', { PORT: process.env.PORT });
+    process.exit(1);
+  }
   const allowedOrigin = process.env.ALLOWED_ORIGIN;
 
   const httpServer = http.createServer(async (req, res) => {
@@ -159,8 +163,10 @@ if (process.env.TRANSPORT === 'http') {
   const shutdown = async () => {
     log('info', 'Shutting down...');
     await closeBrowser();
-    httpServer.close();
-    setTimeout(() => process.exit(0), 5000);
+    // Exit as soon as the server finishes draining; the timer is only a
+    // forced-exit backstop and is unref'd so it never holds the loop open.
+    httpServer.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 5000).unref();
   };
 
   process.on('SIGTERM', shutdown);
@@ -172,8 +178,11 @@ if (process.env.TRANSPORT === 'http') {
   await server.connect(transport);
   isReady = true;
 
-  process.on('SIGTERM', async () => {
+  const shutdown = async () => {
     await closeBrowser();
     process.exit(0);
-  });
+  };
+
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
 }

package/dist/emitter/site-templates/server-main.ts.hbs

@@ -17,7 +17,10 @@ registerAllTools(server, config);
 const transport = new StdioServerTransport();
 await server.connect(transport);
 
-process.on('SIGTERM', async () => {
+const shutdown = async () => {
   await closeBrowser();
   process.exit(0);
-});
+};
+
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);

package/dist/emitter/templates/config.ts.hbs

@@ -2,20 +2,29 @@ export interface AppConfig {
   baseUrl: string;
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
+{{#unless (eq emitApiKeyValue false)}}
   apiKey?: string;
+{{/unless}}
 {{#if (eq in "query")}}
+{{#unless (eq emitApiKeyQueryName false)}}
   /** Query-parameter name the API key is appended under (apiKey-in-query auth). */
   apiKeyQueryName?: string;
+{{/unless}}
 {{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
+{{#unless (eq emitBearer false)}}
   bearerToken?: string;
+{{/unless}}
 {{/if}}
 {{#if (eq type "http-basic")}}
+{{#unless (eq emitBasic false)}}
   basicUsername?: string;
   basicPassword?: string;
+{{/unless}}
 {{/if}}
 {{#if (eq type "oauth2")}}
+{{#unless (eq emitOAuth2 false)}}
   oauth2Token?: string;
   oauth2ClientId?: string;
   oauth2ClientSecret?: string;
@@ -25,6 +34,7 @@ export interface AppConfig {
   /** OAuth scopes requested on token grants. Defaults to the spec-declared
    * scopes; override at runtime with OAUTH2_SCOPES (space-separated). */
   oauth2Scopes: string[];
+{{/unless}}
 {{/if}}
 {{/each}}
   maxRetries: number;
@@ -81,6 +91,7 @@ function loadDefaultHeaders(): Record<string, string> {
 
 {{#each authSchemes}}
 {{#if (eq type "oauth2")}}
+{{#unless (eq emitOAuth2 false)}}
 /**
  * Resolve the OAuth scopes requested on token grants. Defaults to the
  * spec-declared scopes baked in at generation time; `OAUTH2_SCOPES`
@@ -95,16 +106,32 @@ function resolveOAuthScopes(): string[] {
   return {{#if scopes}}{{{json scopes}}}{{else}}[]{{/if}};
 }
 
+{{/unless}}
 {{/if}}
 {{/each}}
+const posInt = (v: string | undefined, d: number): number => {
+  const n = parseInt(v ?? '', 10);
+  return Number.isInteger(n) && n > 0 ? n : d;
+};
+
+/** Like posInt but accepts 0 — useful where 0 is a meaningful "disable" value. */
+const nonNegInt = (v: string | undefined, d: number): number => {
+  const n = parseInt(v ?? '', 10);
+  return Number.isInteger(n) && n >= 0 ? n : d;
+};
+
 export function loadConfig(): AppConfig {
   return {
     baseUrl: resolveBaseUrl(),
 {{#each authSchemes}}
 {{#if (eq type "apiKey")}}
+{{#unless (eq emitApiKeyValue false)}}
     apiKey: process.env.{{envVarName}},
+{{/unless}}
 {{#if (eq in "query")}}
+{{#unless (eq emitApiKeyQueryName false)}}
     apiKeyQueryName: {{{json headerName}}},
+{{/unless}}
 {{/if}}
 {{/if}}
 {{#if (eq type "http-bearer")}}
@@ -124,8 +151,8 @@ export function loadConfig(): AppConfig {
     oauth2Scopes: resolveOAuthScopes(),
 {{/if}}
 {{/each}}
-    maxRetries: parseInt(process.env.MAX_RETRIES ?? '3', 10),
-    requestIntervalMs: parseInt(process.env.REQUEST_INTERVAL_MS ?? '100', 10),
+    maxRetries: nonNegInt(process.env.MAX_RETRIES, 3),
+    requestIntervalMs: nonNegInt(process.env.REQUEST_INTERVAL_MS, 100),
     defaultHeaders: loadDefaultHeaders(),
   };
 }

package/dist/emitter/templates/discovery.ts.hbs

@@ -12,6 +12,13 @@ import { applyJqFilter } from './response-filter.js';
 import type { AppConfig } from './config.js';
 import catalogData from './tool-catalog.json' with { type: 'json' };
 
+interface CatalogParamMapping {
+  /** The key the agent supplies in the tool input. */
+  inputKey: string;
+  /** The original API parameter name sent upstream. */
+  wireName: string;
+}
+
 interface CatalogEntry {
   name: string;
   title: string;
@@ -19,10 +26,15 @@ interface CatalogEntry {
   method: string;
   path: string;
   inputSchema: Record<string, unknown>;
-  pathParams: string[];
-  queryParams: string[];
+  /** Path parameters with inputKey (agent-facing) and wireName (upstream API). */
+  pathParams: CatalogParamMapping[];
+  /** Query parameters with inputKey (agent-facing) and wireName (upstream API). */
+  queryParams: CatalogParamMapping[];
   hasRequestBody: boolean;
   requestBodyContentType: string;
+  /** The MCP input key for the request body (`body`, `requestBody`, etc.).
+   *  Only present when `hasRequestBody` is true. */
+  bodyInputKey?: string;
 }
 
 const catalog: CatalogEntry[] = catalogData as CatalogEntry[];
@@ -157,29 +169,31 @@ export function registerDiscoveryTools(server: McpServer, config: AppConfig): vo
       }
 
       try {
-        // Build URL from path template
+        // Build URL from path template — read args by inputKey, substitute wireName
+        // into the URL template. Handles parameter name collisions (R14-A).
         let url = config.baseUrl + tool.path;
-        for (const param of tool.pathParams) {
-          if (args[param] !== undefined) {
-            url = url.replace(`{${param}}`, encodeURIComponent(String(args[param])));
+        for (const p of tool.pathParams) {
+          if (args[p.inputKey] !== undefined) {
+            url = url.replace(`{${p.wireName}}`, encodeURIComponent(String(args[p.inputKey])));
           }
         }
 
-        // Add query params
+        // Add query params — read args by inputKey, send upstream under wireName (R14-A).
         const queryParams = new URLSearchParams();
-        for (const param of tool.queryParams) {
-          if (args[param] !== undefined) {
-            queryParams.set(param, String(args[param]));
+        for (const p of tool.queryParams) {
+          if (args[p.inputKey] !== undefined) {
+            queryParams.set(p.wireName, String(args[p.inputKey]));
           }
         }
         const qs = queryParams.toString();
         if (qs) url += `?${qs}`;
 
+        const bodyKey = tool.bodyInputKey ?? 'body';
         const response = await executeRequest({
           method: tool.method,
           url,
-          ...(tool.hasRequestBody && args.body
-            ? { body: args.body, contentType: tool.requestBodyContentType }
+          ...(tool.hasRequestBody && args[bodyKey] !== undefined
+            ? { body: args[bodyKey], contentType: tool.requestBodyContentType }
             : {}),
           headers: {},
           config,

package/dist/emitter/templates/http-executor.ts.hbs

@@ -194,9 +194,10 @@ export async function executeRequest(options: RequestOptions): Promise<ApiRespon
       });
 
       if (RETRYABLE_STATUS_CODES.includes(response.status) && attempt < config.maxRetries) {
-        const retryAfter = response.headers.get('Retry-After');
-        const delay = retryAfter
-          ? parseInt(retryAfter, 10) * 1000
+        const retryAfterRaw = response.headers.get('Retry-After');
+        const retryAfterMs = retryAfterRaw ? parseInt(retryAfterRaw, 10) * 1000 : NaN;
+        const delay = Number.isFinite(retryAfterMs)
+          ? Math.min(retryAfterMs, 60_000)
           : 1000 * Math.pow(2, attempt);
         await sleep(delay);
         continue;

package/dist/emitter/templates/oauth.ts.hbs

@@ -86,8 +86,7 @@ async function clientCredentialsGrant(config: OAuthConfig): Promise<TokenRespons
   });
 
   if (!response.ok) {
-    const body = await response.text();
-    throw new Error(`OAuth client credentials failed (${response.status}): ${body}`);
+    throw new Error(`OAuth client credentials failed (${response.status})`);
   }
 
   return response.json() as Promise<TokenResponse>;

package/dist/emitter/templates/readme.md.hbs

@@ -75,14 +75,15 @@ Copy `.env.example` to `.env` and fill in:
 {{#each authEnvVars}}
 | `{{name}}` | {{description}} | {{#if required}}Yes{{else}}No{{/if}} |
 {{/each}}
-| `MAX_RETRIES` | Max retry attempts (default: 3) | No |
-| `REQUEST_INTERVAL_MS` | Min ms between requests (default: 100) | No |
+| `MAX_RETRIES` | Max retry attempts (default: 3; `0` disables retries) | No |
+| `REQUEST_INTERVAL_MS` | Min ms between requests (default: 100; `0` disables throttling) | No |
 | `MCP_ENVIRONMENTS` | JSON map of environment name → base URL (e.g. `{"production":"…","sandbox":"…"}`) | No |
 | `API_ENVIRONMENT` | Selects a named environment from `MCP_ENVIRONMENTS` (falls back to `BASE_URL`) | No |
 | `MCP_TOOLS` | Comma-separated allowlist of tool names to register | No |
 | `MCP_EXCLUDE_TOOLS` | Comma-separated denylist of tool names to skip | No |
 | `MCP_DEFAULT_HEADERS` | JSON object of headers added to every upstream request | No |
 | `MCP_IDEMPOTENCY_AUTO` | `true` to auto-generate an `Idempotency-Key` for mutating requests | No |
+| `MCP_MAX_SSE_CONNECTIONS` | Max concurrent task-streaming SSE connections (default: 500; HTTP transport only) | No |
 
 ### Named environments
 

package/dist/emitter/templates/resources.ts.hbs

@@ -1,4 +1,5 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { executeRequest } from './http.js';
 import type { AppConfig } from './config.js';
 
@@ -7,12 +8,12 @@ export function registerAllResources(server: McpServer, config: AppConfig): void
 {{#if isTemplate}}
   server.resource(
     '{{name}}',
-    '{{uri}}',
+    new ResourceTemplate('{{uri}}', { list: undefined }),
     {
       description: `{{{description}}}`,
       mimeType: 'application/json',
     },
-    async (uri) => {
+    async (uri, variables) => {
 {{{urlBody}}}
       const response = await executeRequest({
         method: 'get',

package/dist/emitter/templates/server-main-http.ts.hbs

@@ -321,157 +321,164 @@ if (transportMode === 'http') {
   }
 
   const httpServer = http.createServer(async (req, res) => {
-    const url = new URL(req.url ?? '/', `http://localhost:${port}`);
-    const method = req.method ?? 'GET';
-
-    /* ── Authentication ─────────────────────────────────────────────
-     * Every endpoint except /health, /ready{{#if hasOAuth}}, and the public
-     * OAuth metadata{{/if}} requires a valid bearer token. With MCP_AUTH_TOKEN
-     * unset the server fails closed (401) unless MCP_ALLOW_UNAUTHENTICATED=true.
-     * This is the in-container line of defense; the hosting backend also
-     * validates before proxying. */
-    const isPublicPath =
-      url.pathname === '/health' ||
-      url.pathname === '/ready'{{#if hasOAuth}} ||
-      url.pathname === '/.well-known/oauth-authorization-server'{{/if}};
-    if (!isPublicPath && !isAuthorized(req, authToken)) {
-      log('error', 'Unauthorized request rejected', { path: url.pathname });
-      res.writeHead(401, {
-        'Content-Type': 'application/json',
-        'WWW-Authenticate': 'Bearer',
-      });
-      res.end(JSON.stringify({ error: 'Unauthorized: missing or invalid bearer token' }));
-      return;
-    }
+    try {
+      const url = new URL(req.url ?? '/', `http://localhost:${port}`);
+      const method = req.method ?? 'GET';
+
+      /* ── Authentication ─────────────────────────────────────────────
+       * Every endpoint except /health, /ready{{#if hasOAuth}}, and the public
+       * OAuth metadata{{/if}} requires a valid bearer token. With MCP_AUTH_TOKEN
+       * unset the server fails closed (401) unless MCP_ALLOW_UNAUTHENTICATED=true.
+       * This is the in-container line of defense; the hosting backend also
+       * validates before proxying. */
+      const isPublicPath =
+        url.pathname === '/health' ||
+        url.pathname === '/ready'{{#if hasOAuth}} ||
+        url.pathname === '/.well-known/oauth-authorization-server'{{/if}};
+      if (!isPublicPath && !isAuthorized(req, authToken)) {
+        log('error', 'Unauthorized request rejected', { path: url.pathname });
+        res.writeHead(401, {
+          'Content-Type': 'application/json',
+          'WWW-Authenticate': 'Bearer',
+        });
+        res.end(JSON.stringify({ error: 'Unauthorized: missing or invalid bearer token' }));
+        return;
+      }
 
-    /* ── Routing-header observability (SEP-2243, additive) ─────────── */
-    const mcpMethod = req.headers['mcp-method'];
-    const mcpName = req.headers['mcp-name'];
-    if (mcpMethod || mcpName) {
-      log('info', 'mcp-meta-headers', { mcpMethod, mcpName, path: url.pathname });
-    }
+      /* ── Routing-header observability (SEP-2243, additive) ─────────── */
+      const mcpMethod = req.headers['mcp-method'];
+      const mcpName = req.headers['mcp-name'];
+      if (mcpMethod || mcpName) {
+        log('info', 'mcp-meta-headers', { mcpMethod, mcpName, path: url.pathname });
+      }
 
 {{#if hasOAuth}}
-    /* ── OAuth Authorization Server Metadata (RFC 8414) ─────────────
-     * Public discovery endpoint (the 2026-07-28 auth changes clarify
-     * .well-known discovery; DCR is retained, not replaced). */
-    if (url.pathname === '/.well-known/oauth-authorization-server') {
-      if (method !== 'GET') {
-        res.writeHead(405, { Allow: 'GET' });
-        res.end();
-        return;
-      }
-      const authorizationUrl = config.oauth2AuthorizationUrl;
-      const tokenUrl = config.oauth2TokenUrl;
-      if (!authorizationUrl || !tokenUrl) {
-        sendJson(res, 503, { error: 'OAuth is not configured' });
+      /* ── OAuth Authorization Server Metadata (RFC 8414) ─────────────
+       * Public discovery endpoint (the 2026-07-28 auth changes clarify
+       * .well-known discovery; DCR is retained, not replaced). */
+      if (url.pathname === '/.well-known/oauth-authorization-server') {
+        if (method !== 'GET') {
+          res.writeHead(405, { Allow: 'GET' });
+          res.end();
+          return;
+        }
+        const authorizationUrl = config.oauth2AuthorizationUrl;
+        const tokenUrl = config.oauth2TokenUrl;
+        if (!authorizationUrl || !tokenUrl) {
+          sendJson(res, 503, { error: 'OAuth is not configured' });
+          return;
+        }
+        const proto = req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+        const issuer = allowedOrigin ?? `${proto}://${req.headers.host ?? 'localhost'}`;
+        sendJson(
+          res,
+          200,
+          getAuthServerMetadata(
+            {
+              clientId: config.oauth2ClientId ?? '',
+              clientSecret: config.oauth2ClientSecret,
+              authorizationUrl,
+              tokenUrl,
+              scopes: config.oauth2Scopes,
+              redirectUri: config.oauth2RedirectUri ?? '',
+            },
+            issuer,
+          ),
+        );
         return;
       }
-      const proto = req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-      const issuer = allowedOrigin ?? `${proto}://${req.headers.host ?? 'localhost'}`;
-      sendJson(
-        res,
-        200,
-        getAuthServerMetadata(
-          {
-            clientId: config.oauth2ClientId ?? '',
-            clientSecret: config.oauth2ClientSecret,
-            authorizationUrl,
-            tokenUrl,
-            scopes: config.oauth2Scopes,
-            redirectUri: config.oauth2RedirectUri ?? '',
-          },
-          issuer,
-        ),
-      );
-      return;
-    }
 
 {{/if}}
 {{#if hasAsyncTools}}
-    /* ── Task management REST routes (retained during the grace period) ── */
-    if (handleTaskSse(req, res, url)) return;
-    if (handleTaskRoutes(req, res, url)) return;
+      /* ── Task management REST routes (retained during the grace period) ── */
+      if (handleTaskSse(req, res, url)) return;
+      if (handleTaskRoutes(req, res, url)) return;
 
 {{/if}}
-    if (url.pathname === '/mcp') {
-      /* Origin validation (DNS-rebinding protection per MCP spec) */
-      const origin = req.headers.origin;
-      if (allowedOrigin) {
-        if (origin && origin !== allowedOrigin) {
-          log('error', 'Origin rejected', { origin, allowedOrigin });
+      if (url.pathname === '/mcp') {
+        /* Origin validation (DNS-rebinding protection per MCP spec) */
+        const origin = req.headers.origin;
+        if (allowedOrigin) {
+          if (origin && origin !== allowedOrigin) {
+            log('error', 'Origin rejected', { origin, allowedOrigin });
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: invalid origin' }));
+            return;
+          }
+        } else if (origin) {
+          /* No allowlist configured but Origin header present — reject cross-origin requests */
+          log('error', 'Cross-origin request rejected (ALLOWED_ORIGIN not set)', { origin });
           res.writeHead(403, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ error: 'Forbidden: invalid origin' }));
+          res.end(JSON.stringify({ error: 'Forbidden: ALLOWED_ORIGIN not configured' }));
           return;
         }
-      } else if (origin) {
-        /* No allowlist configured but Origin header present — reject cross-origin requests */
-        log('error', 'Cross-origin request rejected (ALLOWED_ORIGIN not set)', { origin });
-        res.writeHead(403, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Forbidden: ALLOWED_ORIGIN not configured' }));
-        return;
-      }
 
-      /* POST carries a JSON-RPC body: peek for server/discover + tasks/* and
-       * forward the parsed body to the transport. GET/DELETE (SSE stream /
-       * session teardown) pass straight through. */
-      if (method === 'POST') {
-        const raw = await readBody(req);
-        if (raw === null) {
-          rpcError(res, null, -32600, 'Request body too large');
-          return;
-        }
-        if (raw.length === 0) {
-          rpcError(res, null, -32600, 'Empty request body');
-          return;
-        }
-        let parsed: unknown;
-        try {
-          parsed = JSON.parse(raw.toString('utf-8'));
-        } catch {
-          rpcError(res, null, -32700, 'Parse error');
-          return;
-        }
-
-        /* Intercept single-object JSON-RPC extension methods the SDK doesn't
-         * dispatch yet. Batches are forwarded untouched. */
-        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-          const rpcMethod = (parsed as { method?: unknown }).method;
-          const rpcId = (parsed as { id?: unknown }).id;
-          if (rpcMethod === 'server/discover') {
-            sendJson(res, 200, buildDiscoverResult(rpcId));
+        /* POST carries a JSON-RPC body: peek for server/discover + tasks/* and
+         * forward the parsed body to the transport. GET/DELETE (SSE stream /
+         * session teardown) pass straight through. */
+        if (method === 'POST') {
+          const raw = await readBody(req);
+          if (raw === null) {
+            rpcError(res, null, -32600, 'Request body too large');
             return;
           }
-{{#if hasAsyncTools}}
-          if (typeof rpcMethod === 'string' && rpcMethod.startsWith('tasks/')) {
-            const handled = handleTaskRpc(rpcMethod, (parsed as { params?: unknown }).params, rpcId);
-            if (handled) {
-              sendJson(res, 200, handled);
+          if (raw.length === 0) {
+            rpcError(res, null, -32600, 'Empty request body');
+            return;
+          }
+          let parsed: unknown;
+          try {
+            parsed = JSON.parse(raw.toString('utf-8'));
+          } catch {
+            rpcError(res, null, -32700, 'Parse error');
+            return;
+          }
+
+          /* Intercept single-object JSON-RPC extension methods the SDK doesn't
+           * dispatch yet. Batches are forwarded untouched. */
+          if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            const rpcMethod = (parsed as { method?: unknown }).method;
+            const rpcId = (parsed as { id?: unknown }).id;
+            if (rpcMethod === 'server/discover') {
+              sendJson(res, 200, buildDiscoverResult(rpcId));
               return;
             }
-          }
+{{#if hasAsyncTools}}
+            if (typeof rpcMethod === 'string' && rpcMethod.startsWith('tasks/')) {
+              const handled = handleTaskRpc(rpcMethod, (parsed as { params?: unknown }).params, rpcId);
+              if (handled) {
+                sendJson(res, 200, handled);
+                return;
+              }
+            }
 {{/if}}
-        }
+          }
 
-        await dispatchToTransport(req, res, parsed);
-        return;
-      }
+          await dispatchToTransport(req, res, parsed);
+          return;
+        }
 
-      await dispatchToTransport(req, res);
-    } else if (url.pathname === '/health') {
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ status: 'ok' }));
-    } else if (url.pathname === '/ready') {
-      if (isReady) {
+        await dispatchToTransport(req, res);
+      } else if (url.pathname === '/health') {
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ status: 'ready' }));
+        res.end(JSON.stringify({ status: 'ok' }));
+      } else if (url.pathname === '/ready') {
+        if (isReady) {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ status: 'ready' }));
+        } else {
+          res.writeHead(503, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ status: 'not ready' }));
+        }
       } else {
-        res.writeHead(503, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ status: 'not ready' }));
+        res.writeHead(404);
+        res.end('Not found');
+      }
+    } catch (e) {
+      log('error', 'Unhandled error in request handler', { err: String(e) });
+      if (!res.headersSent) {
+        sendJson(res, 500, { error: 'Internal server error' });
       }
-    } else {
-      res.writeHead(404);
-      res.end('Not found');
     }
   });
 
@@ -489,8 +496,8 @@ if (transportMode === 'http') {
 
   /* ── Graceful shutdown ─────────────────────────────────────────────── */
 
-  process.on('SIGTERM', () => {
-    log('info', 'SIGTERM received, shutting down');
+  const shutdown = (signal: string) => {
+    log('info', `${signal} received, shutting down`);
     isReady = false;
     clearInterval(reaper);
 
@@ -514,7 +521,10 @@ if (transportMode === 'http') {
       log('error', 'Shutdown timed out after 5 s, forcing exit');
       process.exit(1);
     }, 5000).unref();
-  });
+  };
+
+  process.on('SIGTERM', () => shutdown('SIGTERM'));
+  process.on('SIGINT', () => shutdown('SIGINT'));
 } else {
   const server = createMcpServer(config);
   const transport = new StdioServerTransport();

package/dist/emitter/templates/task-handlers.ts.hbs

@@ -131,7 +131,8 @@ export function handleTaskRoutes(
 
     const statusParam = url.searchParams.get('status') ?? undefined;
     const limitParam = url.searchParams.get('limit');
-    const limit = limitParam ? parseInt(limitParam, 10) : 50;
+    const rawLimit = parseInt(limitParam ?? '', 10);
+    const limit = Number.isInteger(rawLimit) && rawLimit > 0 && rawLimit <= 1000 ? rawLimit : 50;
 
     if (statusParam && !VALID_STATUSES.has(statusParam)) {
       sendJson(res, 400, { error: `Invalid status filter: ${statusParam}` });

package/dist/emitter/templates/task-manager.ts.hbs

@@ -35,10 +35,12 @@ const MAX_TASKS = 1000;
 export const taskEvents = new EventEmitter();
 
 export function createTask(toolName: string): Task {
-  // Evict oldest if at capacity
+  // Evict a terminal task first; only fall back to the oldest (by insertion order) if none exist.
   if (tasks.size >= MAX_TASKS) {
-    const oldest = tasks.keys().next().value;
-    if (oldest) tasks.delete(oldest);
+    const terminalKey = [...tasks.entries()].find(
+      ([, t]) => t.status === 'completed' || t.status === 'failed' || t.status === 'cancelled',
+    )?.[0] ?? tasks.keys().next().value;
+    if (terminalKey !== undefined) tasks.delete(terminalKey);
   }
 
   const task: Task = {

package/dist/emitter/templates/task-sse.ts.hbs

@@ -37,7 +37,7 @@ function stopHeartbeatIfEmpty(): void {
 function broadcast(eventName: string, data: unknown, taskId: string): void {
   const payload = `event: ${eventName}\ndata: ${JSON.stringify(data)}\n\n`;
   for (const conn of connections) {
-    if (conn.res.writableEnded) continue;
+    if (conn.res.writableEnded) { connections.delete(conn); continue; }
     if (conn.taskIdFilter && conn.taskIdFilter !== taskId) continue;
     conn.res.write(payload);
   }
@@ -83,6 +83,14 @@ export function handleTaskSse(
 
   const taskIdFilter = url.searchParams.get('taskId') ?? null;
 
+  const rawMax = parseInt(process.env.MCP_MAX_SSE_CONNECTIONS ?? '', 10);
+  const maxConnections = Number.isInteger(rawMax) && rawMax > 0 ? rawMax : 500;
+  if (connections.size >= maxConnections) {
+    res.writeHead(503, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'SSE connection limit reached' }));
+    return true;
+  }
+
   res.writeHead(200, {
     'Content-Type': 'text/event-stream',
     'Cache-Control': 'no-cache',