@nifrajs/mcp 3.2.0 → 3.5.0

package/src/http.ts

@@ -8,12 +8,20 @@
  * the MCP Apps `ui://` widgets) so each host supplies its own corpus/source behind one core.
  */
 
+import {
+  assertTransportByteLimit,
+  MAX_TRANSPORT_BYTES,
+  parseTransportContentLength,
+  readBoundedTransportBytes,
+} from "@nifrajs/agent-protocol"
 import {
   handleRpc,
+  isJsonRpcRequest,
   type JsonRpcNotification,
   type JsonRpcRequest,
   type JsonRpcResponse,
   MCP_ERROR,
+  type McpProtocolState,
   type McpServerFeatures,
   type McpTool,
   modernVersionOf,
@@ -36,24 +44,30 @@ const CORS_BASE: Record<string, string> = {
  * Resolve the CORS/Origin headers for one request against the host's `allowedOrigins` policy, or `null`
  * when the request's `Origin` is present but not allowed - the caller then answers 403, per the
  * Streamable-HTTP DNS-rebinding rule ("Servers MUST validate the `Origin` header ... respond with 403").
- * With no policy (the default) every origin is allowed and reflected as `*` - correct for a public,
- * secret-free, unauthenticated server, whose browser clients send arbitrary origins we can't enumerate.
+ * The default is same-origin. Public, secret-free servers must explicitly opt into `allowAnyOrigin`.
  */
 function corsFor(
   request: Request,
   allowedOrigins: readonly string[] | undefined,
+  allowAnyOrigin: boolean,
 ): Record<string, string> | null {
-  if (allowedOrigins === undefined) return { ...CORS_BASE, "access-control-allow-origin": "*" }
+  if (allowAnyOrigin) return { ...CORS_BASE, "access-control-allow-origin": "*" }
   const origin = request.headers.get("origin")
   // A caller with no Origin (curl, server-to-server) can't mount a DNS-rebinding attack - allow it.
   if (origin === null) return { ...CORS_BASE, vary: "Origin" }
-  if (allowedOrigins.includes(origin)) {
+  if (allowedOrigins?.includes(origin)) {
+    return { ...CORS_BASE, "access-control-allow-origin": origin, vary: "Origin" }
+  }
+  if (allowedOrigins === undefined && origin === new URL(request.url).origin) {
     return { ...CORS_BASE, "access-control-allow-origin": origin, vary: "Origin" }
   }
   return null
 }
 
 const DEFAULT_MAX_BODY_BYTES = 1_000_000
+const MAX_BODY_BYTES = MAX_TRANSPORT_BYTES
+const DEFAULT_MAX_RESPONSE_BYTES = 1_000_000
+const MAX_RESPONSE_BYTES = MAX_TRANSPORT_BYTES
 const TEXT_DECODER = new TextDecoder()
 const TEXT_ENCODER = new TextEncoder()
 const SSE_CONTENT_TYPE = "text/event-stream; charset=utf-8"
@@ -62,24 +76,46 @@ const SSE_KEEP_ALIVE_MS = 15_000
 /** Invalid byte caps make `total > maxBytes` fail open (especially for `NaN`). Reject configuration
  * before any request body is read so MCP cannot silently lose its memory bound. */
 function assertByteLimit(value: number): void {
-  if (!Number.isSafeInteger(value) || value < 0) {
-    throw new RangeError("MCP maxBodyBytes must be a non-negative safe integer")
-  }
+  assertTransportByteLimit(value, { maximum: MAX_BODY_BYTES, label: "MCP maxBodyBytes" })
+}
+
+function assertResponseLimit(value: number): void {
+  assertTransportByteLimit(value, {
+    minimum: 1_024,
+    maximum: MAX_RESPONSE_BYTES,
+    label: "MCP maxResponseBytes",
+  })
 }
 
 export interface McpHttpOptions {
   /** Maximum JSON-RPC request body size in bytes. Default 1 MB. */
   readonly maxBodyBytes?: number
+  /** Maximum serialized JSON-RPC response or SSE frame size. Default 1 MB. */
+  readonly maxResponseBytes?: number
   /** Resources / prompts / the MCP Apps UI extension served alongside the tools. */
   readonly features?: McpServerFeatures
   /** Shown on the GET health page so each host can describe itself. */
   readonly health?: string
+  /** Explicitly expose a secret-free, unauthenticated server to browser clients from any origin. */
+  readonly allowAnyOrigin?: boolean
+  /** Origin allowlist for the DNS-rebinding guard. When set, only exact origins are accepted. */
+  readonly allowedOrigins?: readonly string[]
   /**
-   * Origin allowlist for the DNS-rebinding guard. Omit (the default) to allow any origin - the right
-   * choice for a public, unauthenticated docs server that can't enumerate its browser clients' origins.
-   * Set it (e.g. a localhost origin for a hardened local host) to reject any other browser origin with 403.
+   * Shared request registry for one authenticated MCP session. Pass the same state to the
+   * request that starts a tool call and its `notifications/cancelled` request. Do not share one
+   * state across unrelated callers unless the surrounding authorization boundary makes their
+   * request-id namespace exclusive.
    */
-  readonly allowedOrigins?: readonly string[]
+  readonly state?: McpProtocolState
+  /**
+   * Resolve a session-scoped request registry after authorization. This is the preferred seam for
+   * multi-user HTTP hosts: bind the returned state to the authenticated caller/session and return
+   * `undefined` for stateless requests. A resolver failure fails closed with a generic denial.
+   */
+  readonly resolveState?: (
+    request: Request,
+    message: JsonRpcRequest,
+  ) => McpProtocolState | undefined | Promise<McpProtocolState | undefined>
   /**
    * Optional authorization, run once per request against the parsed message - after the body has been
    * read under the size cap, so it never costs a second read of the stream. Returning `false` answers
@@ -108,6 +144,7 @@ function eventStreamResponse(
   headers: Record<string, string>,
   run: (stream: EventStreamControl) => void | Promise<void>,
   keepAliveMs = 0,
+  maxFrameBytes = DEFAULT_MAX_RESPONSE_BYTES,
 ): Response {
   const abortController = new AbortController()
   let closed = false
@@ -154,7 +191,15 @@ function eventStreamResponse(
     signal: abortController.signal,
     closed: closedPromise,
     send(message) {
-      write(`data: ${JSON.stringify(message)}\n\n`)
+      const encoded = encodeJson(message, maxFrameBytes)
+      const id = "id" in message ? message.id : null
+      const payload = encoded ?? JSON.stringify(rpcError(id ?? null, -32000, "response too large"))
+      const frame = `data: ${payload}\n\n`
+      write(
+        TEXT_ENCODER.encode(frame).byteLength <= maxFrameBytes
+          ? frame
+          : `data: ${JSON.stringify(rpcError(id ?? null, -32000, "response too large"))}\n\n`,
+      )
     },
     comment(value = "") {
       write(`: ${value.replace(/[\r\n]/g, "")}\n\n`)
@@ -205,16 +250,16 @@ function eventStreamResponse(
   })
 }
 
-function parseContentLength(value: string): number | undefined {
-  if (value.length === 0) return undefined
-  let length = 0
-  for (let i = 0; i < value.length; i++) {
-    const digit = value.charCodeAt(i) - 48
-    if (digit < 0 || digit > 9) return undefined
-    length = length * 10 + digit
-    if (length > Number.MAX_SAFE_INTEGER) return Number.POSITIVE_INFINITY
-  }
-  return length
+/** Validate the HTTP envelope before any method-specific access or authorization callback. */
+function parseHttpMessage(value: unknown): JsonRpcRequest | undefined {
+  return isJsonRpcRequest(value) ? value : undefined
+}
+
+function unauthorizedResponse(id: JsonRpcRequest["id"], headers: Record<string, string>): Response {
+  return Response.json(rpcError(id ?? null, MCP_ERROR.UNAUTHORIZED, "unauthorized"), {
+    status: 403,
+    headers,
+  })
 }
 
 async function readJsonBounded(
@@ -223,7 +268,7 @@ async function readJsonBounded(
 ): Promise<{ ok: true; value: unknown } | { ok: false; status: 400 | 413 }> {
   const declared = request.headers.get("content-length")
   if (declared !== null) {
-    const length = parseContentLength(declared)
+    const length = parseTransportContentLength(declared)
     if (length === undefined) return { ok: false, status: 400 }
     if (length > maxBytes) return { ok: false, status: 413 }
   }
@@ -231,33 +276,31 @@ async function readJsonBounded(
   const body = request.body
   if (body === null) return { ok: false, status: 400 }
 
-  const reader = body.getReader()
-  const chunks: Uint8Array[] = []
-  let total = 0
-  for (;;) {
-    const { done, value } = await reader.read()
-    if (done) break
-    total += value.byteLength
-    if (total > maxBytes) {
-      await reader.cancel()
-      return { ok: false, status: 413 }
-    }
-    chunks.push(value)
+  const read = await readBoundedTransportBytes(body, maxBytes)
+  if (!read.ok) return { ok: false, status: read.reason === "too-large" ? 413 : 400 }
+  try {
+    return { ok: true, value: JSON.parse(TEXT_DECODER.decode(read.bytes)) as unknown }
+  } catch {
+    return { ok: false, status: 400 }
   }
+}
 
-  const bytes = new Uint8Array(total)
-  let offset = 0
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset)
-    offset += chunk.byteLength
-  }
+function encodeJson(value: unknown, maxBytes: number): string | undefined {
   try {
-    return { ok: true, value: JSON.parse(TEXT_DECODER.decode(bytes)) as unknown }
+    const encoded = JSON.stringify(value)
+    if (typeof encoded !== "string") return undefined
+    if (TEXT_ENCODER.encode(encoded).byteLength > maxBytes) return undefined
+    return encoded
   } catch {
-    return { ok: false, status: 400 }
+    return undefined
   }
 }
 
+function boundedResponse(response: JsonRpcResponse, maxBytes: number): JsonRpcResponse {
+  if (encodeJson(response, maxBytes) !== undefined) return response
+  return rpcError(response.id, -32000, "response too large")
+}
+
 const SENTINEL_PREFIX = "=?base64?"
 const SENTINEL_SUFFIX = "?="
 
@@ -332,7 +375,9 @@ export async function respondMcpHttp(
 ): Promise<Response> {
   const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES
   assertByteLimit(maxBodyBytes)
-  const cors = corsFor(request, options.allowedOrigins)
+  const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES
+  assertResponseLimit(maxResponseBytes)
+  const cors = corsFor(request, options.allowedOrigins, options.allowAnyOrigin === true)
   if (cors === null) {
     // Origin present but not allowlisted: reject before the body is ever read (DNS-rebinding guard). No
     // `id` (no request parsed) and no CORS headers - a disallowed origin gets nothing to work with.
@@ -352,6 +397,7 @@ export async function respondMcpHttp(
           await stream.closed
         },
         SSE_KEEP_ALIVE_MS,
+        maxResponseBytes,
       )
     }
     return new Response(
@@ -376,14 +422,31 @@ export async function respondMcpHttp(
     }
     return Response.json(rpcError(null, -32700, "parse error"), { status: 400, headers: cors })
   }
-  const message = parsed.value as JsonRpcRequest
+  const message = parseHttpMessage(parsed.value)
+  if (message === undefined)
+    return Response.json(rpcError(null, -32600, "Invalid Request"), {
+      status: 400,
+      headers: cors,
+    })
   if (options.authorizeMessage !== undefined) {
-    const authorized = await options.authorizeMessage(message, request)
+    let authorized = false
+    try {
+      authorized = await options.authorizeMessage(message, request)
+    } catch {
+      // Authorization is an application boundary. Fail closed without reflecting verifier or
+      // credential-store diagnostics to an unauthenticated caller.
+      return unauthorizedResponse(message.id, cors)
+    }
     if (!authorized) {
-      return Response.json(rpcError(message.id ?? null, MCP_ERROR.UNAUTHORIZED, "unauthorized"), {
-        status: 403,
-        headers: cors,
-      })
+      return unauthorizedResponse(message.id, cors)
+    }
+  }
+  let state: McpProtocolState | undefined = options.state
+  if (options.resolveState !== undefined) {
+    try {
+      state = await options.resolveState(request, message)
+    } catch {
+      return unauthorizedResponse(message.id, cors)
     }
   }
   const bodyVersion = modernVersionOf(message.params)
@@ -397,20 +460,27 @@ export async function respondMcpHttp(
   }
   const dispatch = (stream?: EventStreamControl): Promise<JsonRpcResponse | null> =>
     handleRpc(message, tools, serverInfo, options.features ?? {}, {
+      ...(state === undefined ? {} : { state }),
       signal: stream?.signal ?? request.signal,
       ...(stream !== undefined ? { sendNotification: stream.send } : {}),
     })
   if (acceptsEventStream(request)) {
-    return eventStreamResponse(request, headers, async (stream) => {
-      const response = await dispatch(stream)
-      if (response !== null) stream.send(response)
-      stream.close()
-    })
+    return eventStreamResponse(
+      request,
+      headers,
+      async (stream) => {
+        const response = await dispatch(stream)
+        if (response !== null) stream.send(response)
+        stream.close()
+      },
+      0,
+      maxResponseBytes,
+    )
   }
   const response = await dispatch()
   // A notification (no id) yields null - acknowledge with 202 Accepted and no body (Streamable-HTTP).
   if (response === null) return new Response(null, { status: 202, headers })
   // Modern requests carry spec HTTP statuses (400 version/header, 404 unknown method); legacy stays 200.
   const status = bodyVersion !== undefined ? modernErrorStatus(response) : 200
-  return Response.json(response, { status, headers })
+  return Response.json(boundedResponse(response, maxResponseBytes), { status, headers })
 }

package/src/protocol.ts

@@ -38,6 +38,9 @@ export const MCP_ERROR = {
 } as const
 const META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion"
 const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo"
+const MAX_RPC_ID_LENGTH = 128
+const MAX_RPC_METHOD_LENGTH = 128
+const MAX_CANCEL_REASON_LENGTH = 512
 
 /** The MIME type a UI resource MUST use so a host recognizes it as an MCP App widget (SEP-1865). */
 export const UI_MIME = "text/html;profile=mcp-app"
@@ -185,7 +188,70 @@ export function createMcpProtocolState(): McpProtocolState {
 
 function requestKey(id: unknown): string | undefined {
   if (typeof id === "string") return `s:${id}`
-  return typeof id === "number" && Number.isFinite(id) ? `n:${id}` : undefined
+  return typeof id === "number" && Number.isSafeInteger(id) ? `n:${id}` : undefined
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+}
+
+/** Validate a JSON-RPC request/notification before any transport or method-specific access. */
+export function isJsonRpcRequest(value: unknown): value is JsonRpcRequest {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false
+  const record = value as Record<string, unknown>
+  if (Object.hasOwn(record, "result") || Object.hasOwn(record, "error")) return false
+  if (Object.hasOwn(record, "jsonrpc") && record.jsonrpc !== "2.0") return false
+  if (
+    typeof record.method !== "string" ||
+    record.method.length === 0 ||
+    record.method.length > MAX_RPC_METHOD_LENGTH
+  )
+    return false
+  if (Object.hasOwn(record, "id")) {
+    const id = record.id
+    if (
+      id !== null &&
+      typeof id !== "string" &&
+      !(typeof id === "number" && Number.isSafeInteger(id))
+    )
+      return false
+    if (typeof id === "string" && id.length > MAX_RPC_ID_LENGTH) return false
+  }
+  return (
+    !Object.hasOwn(record, "params") ||
+    (record.params !== null && typeof record.params === "object" && !Array.isArray(record.params))
+  )
+}
+
+/** Validate a JSON-RPC response received by a transport-side client hook. Responses are not accepted
+ * by {@link handleRpc}; this guard exists for the stdio roots/list answer, which is the one server-
+ * initiated request response the CLI consumes itself. */
+export function isJsonRpcResponse(value: unknown): value is JsonRpcResponse {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false
+  const record = value as Record<string, unknown>
+  if (record.jsonrpc !== "2.0") return false
+  if (Object.hasOwn(record, "method") || Object.hasOwn(record, "params")) return false
+  if (
+    record.id !== null &&
+    typeof record.id !== "string" &&
+    !(typeof record.id === "number" && Number.isSafeInteger(record.id))
+  )
+    return false
+  if (typeof record.id === "string" && record.id.length > MAX_RPC_ID_LENGTH) return false
+  const hasResult = Object.hasOwn(record, "result")
+  const hasError = Object.hasOwn(record, "error")
+  if (hasResult === hasError) return false
+  if (!hasError) return true
+  const error = record.error
+  if (error === null || typeof error !== "object" || Array.isArray(error)) return false
+  const errorRecord = error as Record<string, unknown>
+  return (
+    typeof errorRecord.code === "number" &&
+    Number.isSafeInteger(errorRecord.code) &&
+    typeof errorRecord.message === "string" &&
+    errorRecord.message.length > 0 &&
+    errorRecord.message.length <= MAX_RPC_METHOD_LENGTH
+  )
 }
 
 function metaObject(
@@ -213,7 +279,9 @@ function progressTokenOf(params: Record<string, unknown> | undefined): ProgressT
 
 function cancellationReason(params: Record<string, unknown> | undefined): string | undefined {
   const reason = params?.reason
-  return typeof reason === "string" && reason.length > 0 ? reason : undefined
+  return typeof reason === "string" && reason.length > 0
+    ? reason.slice(0, MAX_CANCEL_REASON_LENGTH)
+    : undefined
 }
 
 function linkAbortSignal(parent: AbortSignal | undefined, child: AbortController): () => void {
@@ -294,6 +362,7 @@ export async function handleRpc(
   features: McpServerFeatures = {},
   options: McpProtocolOptions = {},
 ): Promise<JsonRpcResponse | null> {
+  if (!isJsonRpcRequest(message)) return rpcError(null, -32600, "Invalid Request")
   const { id, method, params } = message
   const isNotification = id === undefined
   const rid = id ?? null
@@ -416,7 +485,10 @@ export async function handleRpc(
       const name = params?.name
       const tool = tools.find((t) => t.name === name)
       if (!tool) return rpcError(rid, -32602, `unknown tool: ${String(name)}`)
-      const args = (params?.arguments as Record<string, unknown>) ?? {}
+      const suppliedArguments = params?.arguments
+      if (suppliedArguments !== undefined && !record(suppliedArguments))
+        return rpcError(rid, -32602, "tool arguments must be an object")
+      const args = suppliedArguments ?? {}
       const controller = new AbortController()
       const key = requestKey(id)
       if (key !== undefined && state.activeRequests.has(key)) {
@@ -458,15 +530,19 @@ export async function handleRpc(
         if (controller.signal.aborted) throw new DOMException("cancelled", "AbortError")
         reportProgress(1, 1)
         return reply(toolCallResult(result, tool))
-      } catch (err) {
+      } catch {
         if (controller.signal.aborted) {
           return reply({
             content: [{ type: "text", text: abortMessage(controller.signal) }],
             isError: true,
           })
         }
-        const msg = err instanceof Error ? err.message : String(err)
-        return reply({ content: [{ type: "text", text: `Error: ${msg}` }], isError: true })
+        // Handler errors are application-internal data. Never reflect their messages to a remote
+        // MCP caller: paths, SQL diagnostics, provider responses, and secrets commonly end up there.
+        return reply({
+          content: [{ type: "text", text: "Tool execution failed" }],
+          isError: true,
+        })
       } finally {
         cleanupAbort()
         if (key !== undefined && state.activeRequests.get(key) === controller) {
@@ -526,15 +602,18 @@ export async function handleRpc(
       const name = params?.name
       const prompt = prompts.find((p) => p.name === name)
       if (!prompt) return rpcError(rid, -32602, `unknown prompt: ${String(name)}`)
-      const args = (params?.arguments as Record<string, unknown>) ?? {}
+      const suppliedArguments = params?.arguments
+      if (suppliedArguments !== undefined && !record(suppliedArguments))
+        return rpcError(rid, -32602, "prompt arguments must be an object")
+      const args = suppliedArguments ?? {}
       try {
         return reply({
           description: prompt.description,
           messages: await prompt.handler(args),
         })
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err)
-        return rpcError(rid, -32000, msg)
+      } catch {
+        // Prompt handlers have the same trust boundary as tools; expose only a stable protocol error.
+        return rpcError(rid, -32000, "Prompt execution failed")
       }
     }
     default:

package/src/react.ts

@@ -82,6 +82,8 @@ export async function reactWidget(opts: ReactWidgetOptions): Promise<McpWidget>
     ...(opts.description !== undefined ? { description: opts.description } : {}),
     ...(opts.title !== undefined ? { title: opts.title } : {}),
     ...(opts.head !== undefined ? { head: opts.head } : {}),
-    html: `<div id="root"></div>\n<script>${safe}</script>`,
+    // `safe` is a Bun-generated JavaScript bundle with every HTML script end-tag escaped before it is
+    // placed in this inline script. The widget test asserts the generated document remains intact.
+    html: `<div id="root"></div>\n<script>${safe}</script>`, // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
   })
 }

package/src/server.ts

@@ -15,9 +15,9 @@
  * {@link McpServer.handle} dispatches a single JSON-RPC message directly (for headless verification / tests).
  *
  * SECURITY: this has NO built-in authentication - once mounted, every tool is callable by anyone who can
- * reach the route (the CORS header is `*` and no credentials are used, so it is effectively public). That
- * is fine for read-only/public tools; if any tool mutates state or returns private data, gate the route
- * yourself (check an `Authorization` header / session in the nifra handler before calling `mcp.fetch`).
+ * reach the route. Browser access is same-origin by default; set `allowAnyOrigin: true` only for a
+ * secret-free public server. If any tool mutates state or returns private data, gate the route yourself
+ * (check an `Authorization` header / session in the nifra handler before calling `mcp.fetch`).
  */
 
 import { type McpHttpOptions, respondMcpHttp } from "./http.ts"
@@ -26,6 +26,7 @@ import {
   type JsonRpcRequest,
   type JsonRpcResponse,
   type McpPrompt,
+  type McpProtocolState,
   type McpResource,
   type McpServerFeatures,
   type McpTool,
@@ -46,11 +47,18 @@ export interface CreateMcpServerOptions {
   readonly health?: string
   /** Max JSON-RPC body size in bytes (default 1 MB). */
   readonly maxBodyBytes?: number
+  /** Max serialized JSON-RPC response or SSE frame size (default 1 MB). */
+  readonly maxResponseBytes?: number
   /** Natural-language guidance for LLMs, surfaced in the modern `server/discover` result (2026-07-28). */
   readonly instructions?: string
-  /** Origin allowlist for the DNS-rebinding guard. Omit to allow any origin; set it to reject other
-   * browser origins with 403 (e.g. a hardened, non-public mount). */
+  /** Explicitly allow browser clients from any origin. Omit for the secure same-origin default. */
+  readonly allowAnyOrigin?: boolean
+  /** Origin allowlist for the DNS-rebinding guard. Set it to permit exact cross-origin clients. */
   readonly allowedOrigins?: readonly string[]
+  /** Shared state for one authenticated MCP session; prefer `resolveState` for multi-session hosts. */
+  readonly state?: McpProtocolState
+  /** Resolve a session-scoped request registry after per-message authorization. */
+  readonly resolveState?: McpHttpOptions["resolveState"]
   /**
    * Per-message authorization, applied after the message parses and before any tool runs. Return
    * `false` to answer 403 with a JSON-RPC `unauthorized` error (`MCP_ERROR.UNAUTHORIZED`) and no result.
@@ -71,7 +79,10 @@ export interface McpServer {
   readonly features: McpServerFeatures
   readonly serverInfo: { name: string; version: string }
   /** Web `fetch` handler - mount at `POST /mcp` (GET is a health page, OPTIONS the CORS preflight). */
-  fetch(request: Request, overrides?: Pick<McpHttpOptions, "authorizeMessage">): Promise<Response>
+  fetch(
+    request: Request,
+    overrides?: Pick<McpHttpOptions, "authorizeMessage" | "state" | "resolveState">,
+  ): Promise<Response>
   /** Dispatch one JSON-RPC message directly (no HTTP) - for headless verification and unit tests. */
   handle(message: JsonRpcRequest): Promise<JsonRpcResponse | null>
   /**
@@ -103,12 +114,21 @@ export function createMcpServer(opts: CreateMcpServerOptions): McpServer {
         features,
         ...(opts.health !== undefined ? { health: opts.health } : {}),
         ...(opts.maxBodyBytes !== undefined ? { maxBodyBytes: opts.maxBodyBytes } : {}),
+        ...(opts.maxResponseBytes !== undefined ? { maxResponseBytes: opts.maxResponseBytes } : {}),
+        ...(opts.allowAnyOrigin === true ? { allowAnyOrigin: true } : {}),
         ...(opts.allowedOrigins !== undefined ? { allowedOrigins: opts.allowedOrigins } : {}),
+        ...(opts.state === undefined ? {} : { state: opts.state }),
+        ...(opts.resolveState === undefined ? {} : { resolveState: opts.resolveState }),
         ...(opts.authorizeMessage !== undefined ? { authorizeMessage: opts.authorizeMessage } : {}),
         ...(overrides?.authorizeMessage !== undefined
           ? { authorizeMessage: overrides.authorizeMessage }
           : {}),
+        ...(overrides?.state === undefined ? {} : { state: overrides.state }),
+        ...(overrides?.resolveState === undefined ? {} : { resolveState: overrides.resolveState }),
+      }),
+    handle: (message) =>
+      handleRpc(message, tools, serverInfo, features, {
+        ...(opts.state === undefined ? {} : { state: opts.state }),
       }),
-    handle: (message) => handleRpc(message, tools, serverInfo, features),
   }
 }