@tmcp/transport-http 0.5.3 → 0.5.5

package/README.md

@@ -81,6 +81,38 @@ const transport = new HttpTransport(server, {
 });
 ```
 
+### Session Management
+
+The HTTP transport supports custom session managers for different deployment scenarios:
+
+#### In-Memory Sessions (Default)
+
+```javascript
+import { InMemorySessionManager } from '@tmcp/session-manager';
+
+const transport = new HttpTransport(server, {
+	sessionManager: new InMemorySessionManager(), // Default behavior
+});
+```
+
+#### Redis Sessions (Multi-Server/Serverless)
+
+For deployments across multiple servers or serverless environments where sessions need to be shared:
+
+```javascript
+import { RedisSessionManager } from '@tmcp/session-manager-redis';
+
+const transport = new HttpTransport(server, {
+	sessionManager: new RedisSessionManager('redis://localhost:6379'),
+});
+```
+
+**When to use Redis sessions:**
+
+- **Multi-server deployments**: When your application runs on multiple servers and clients might connect to different instances
+- **Serverless deployments**: When your transport is deployed on serverless platforms where instances are ephemeral (attention, serverless environment generally kills SSE request after a not-so-long amount of time, this means notification from the server will not reach the client after the shutdown)
+- **Load balancing**: When using load balancers that might route requests to different server instances
+
 ## Features
 
 - **🌐 HTTP/SSE Communication**: Uses Server-Sent Events for real-time bidirectional communication
@@ -116,6 +148,7 @@ interface HttpTransportOptions {
 	getSessionId: () => string; // Custom session ID generator
 	path?: string; // MCP endpoint path (default: '/mcp')
 	oauth?: OAuth; // an oauth provider generated from @tmcp/auth
+	sessionManager?: SessionManager; // Custom session manager (default: InMemorySessionManager)
 }
 ```
 
@@ -262,7 +295,7 @@ Deno.serve({ port: 3000 }, async (req) => {
 
 ### `srvx`
 
-If you want to have the same experience throughout Deno, Bun or Node you can also use `srvx`
+If you want the same experience across Deno, Bun, and Node.js, you can use [srvx](https://srvx.h3.dev/).
 
 ```js
 import { McpServer } from 'tmcp';
@@ -272,12 +305,14 @@ import { serve } from 'srvx';
 const server = new McpServer(/* ... */);
 const transport = new HttpTransport(server);
 
-serve(async (req) => {
-	const response = await transport.respond(req);
-	if (response === null) {
-		return new Response('Not Found', { status: 404 });
-	}
-	return response;
+serve({
+	async fetch(req) {
+		const response = await transport.respond(req);
+		if (response === null) {
+			return new Response('Not Found', { status: 404 });
+		}
+		return response;
+	},
 });
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tmcp/transport-http",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Transport for TMCP using HTTP",
   "type": "module",
   "main": "src/index.js",
@@ -28,15 +28,19 @@
     "url": "git+https://github.com/paoloricciuti/tmcp.git",
     "directory": "packages/transport-http"
   },
+  "dependencies": {
+    "@tmcp/session-manager": "^0.1.0"
+  },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.16.0",
+    "@modelcontextprotocol/sdk": "^1.17.1",
+    "@remix-run/node-fetch-server": "^0.8.0",
     "@types/node": "^24.0.15",
     "dts-buddy": "^0.6.2",
     "publint": "^0.3.12",
     "valibot": "^1.1.0",
     "vitest": "^3.2.4",
-    "tmcp": "^1.10.2",
     "@tmcp/adapter-valibot": "^0.1.4",
+    "tmcp": "^1.10.2",
     "@tmcp/auth": "^0.3.3"
   },
   "publishConfig": {

package/src/index.js

@@ -1,6 +1,18 @@
 /**
  * @import { AuthInfo, McpServer } from "tmcp";
  * @import { OAuth  } from "@tmcp/auth";
+ * @import { SessionManager  } from "@tmcp/session-manager";
+ */
+
+/**
+ * @typedef {{
+ * 	origin?: string | string[] | boolean
+ * 	methods?: string[]
+ * 	allowedHeaders?: string[]
+ * 	exposedHeaders?: string[]
+ * 	credentials?: boolean
+ * 	maxAge?: number
+ * }} CorsConfig
  */
 
 /**
@@ -8,10 +20,13 @@
  * 	getSessionId?: () => string
  * 	path?: string
  * 	oauth?: OAuth<"built">
+ * 	cors?: CorsConfig | boolean,
+ * 	sessionManager?: SessionManager
  * }} HttpTransportOptions
  */
 
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { InMemorySessionManager } from '@tmcp/session-manager';
 export class HttpTransport {
 	/**
 	 * @type {McpServer<any>}
@@ -19,7 +34,7 @@ export class HttpTransport {
 	#server;
 
 	/**
-	 * @type {Required<Omit<HttpTransportOptions, 'oauth'>>}
+	 * @type {Required<Omit<HttpTransportOptions, 'oauth' | 'cors'>> & { cors?: CorsConfig | boolean }}
 	 */
 	#options;
 
@@ -28,15 +43,6 @@ export class HttpTransport {
 	 */
 	#path;
 
-	/**
-	 * @type {Map<string, ReadableStreamDefaultController>}
-	 */
-	#session = new Map();
-	/**
-	 * @type {Map<string, ReadableStream>}
-	 */
-	#streams = new Map();
-
 	/**
 	 * @type {AsyncLocalStorage<ReadableStreamDefaultController | undefined>}
 	 */
@@ -60,6 +66,8 @@ export class HttpTransport {
 			getSessionId = () => crypto.randomUUID(),
 			path = '/mcp',
 			oauth,
+			cors,
+			sessionManager = new InMemorySessionManager(),
 		} = options ?? {
 			getSessionId: () => crypto.randomUUID(),
 		};
@@ -68,7 +76,7 @@ export class HttpTransport {
 			this.#oauth = oauth;
 		}
 
-		this.#options = { getSessionId, path };
+		this.#options = { getSessionId, path, cors, sessionManager };
 		this.#path = path;
 		this.#server.on('send', ({ request, context: { sessions } }) => {
 			// use the current controller if the request has an id (it means it's a request and not a notification)
@@ -83,28 +91,101 @@ export class HttpTransport {
 				);
 				return;
 			}
-			for (let [session_id, controller] of this.#session.entries()) {
-				if (sessions === undefined || sessions.includes(session_id)) {
-					controller.enqueue(
-						this.#text_encoder.encode(
-							'data: ' + JSON.stringify(request) + '\n\n',
-						),
+			this.#options.sessionManager.send(
+				sessions,
+				'data: ' + JSON.stringify(request) + '\n\n',
+			);
+		});
+	}
+
+	/**
+	 * Applies CORS headers to a response based on the configuration
+	 * @param {Response} response - The response to modify
+	 * @param {Request} request - The original request
+	 */
+	#apply_cors_headers(response, request) {
+		const cors_config = this.#options.cors;
+		if (!cors_config) {
+			return;
+		}
+
+		// Handle boolean true (allow all origins)
+		if (cors_config === true) {
+			response.headers.set('Access-Control-Allow-Origin', '*');
+			response.headers.set(
+				'Access-Control-Allow-Methods',
+				'GET, POST, DELETE, OPTIONS',
+			);
+			response.headers.set('Access-Control-Allow-Headers', '*');
+			return;
+		}
+
+		// Handle detailed configuration
+		const config = /** @type {CorsConfig} */ (cors_config);
+		const origin = request.headers.get('origin');
+
+		// Handle origin
+		if (config.origin !== undefined) {
+			if (config.origin === true || config.origin === '*') {
+				response.headers.set('Access-Control-Allow-Origin', '*');
+			} else if (typeof config.origin === 'string') {
+				if (origin === config.origin) {
+					response.headers.set(
+						'Access-Control-Allow-Origin',
+						config.origin,
 					);
 				}
+			} else if (Array.isArray(config.origin)) {
+				if (origin && config.origin.includes(origin)) {
+					response.headers.set('Access-Control-Allow-Origin', origin);
+				}
 			}
-		});
+		}
+
+		// Handle other CORS headers with defaults
+		const methods = config.methods ?? ['GET', 'POST', 'DELETE', 'OPTIONS'];
+		response.headers.set(
+			'Access-Control-Allow-Methods',
+			methods.join(', '),
+		);
+
+		const allowed_headers = config.allowedHeaders ?? '*';
+		if (Array.isArray(allowed_headers)) {
+			response.headers.set(
+				'Access-Control-Allow-Headers',
+				allowed_headers.join(', '),
+			);
+		} else {
+			response.headers.set(
+				'Access-Control-Allow-Headers',
+				allowed_headers,
+			);
+		}
+
+		if (config.exposedHeaders) {
+			response.headers.set(
+				'Access-Control-Expose-Headers',
+				config.exposedHeaders.join(', '),
+			);
+		}
+
+		if (config.credentials) {
+			response.headers.set('Access-Control-Allow-Credentials', 'true');
+		}
+
+		if (config.maxAge !== undefined) {
+			response.headers.set(
+				'Access-Control-Max-Age',
+				config.maxAge.toString(),
+			);
+		}
 	}
 
 	/**
 	 * @param {string} session_id
 	 */
 	#handle_delete(session_id) {
-		const controller = this.#session.get(session_id);
-		if (controller) {
-			controller.close();
-			this.#session.delete(session_id);
-			this.#streams.delete(session_id);
-		}
+		this.#options.sessionManager.delete(session_id);
 		return new Response(null, {
 			status: 204,
 			headers: {
@@ -118,12 +199,11 @@ export class HttpTransport {
 	 * @param {string} session_id
 	 * @returns
 	 */
-	#handle_get(session_id) {
-		const sessions = this.#session;
-		const streams = this.#streams;
-		// If session already exists, return existing stream
-		const existing_stream = this.#streams.get(session_id);
-		if (existing_stream) {
+	async #handle_get(session_id) {
+		const sessions = this.#options.sessionManager;
+		// If session already exists, return error
+		const existing_session = await sessions.has(session_id);
+		if (existing_session) {
 			return new Response(
 				JSON.stringify({
 					jsonrpc: '2.0',
@@ -147,15 +227,13 @@ export class HttpTransport {
 		// Create new long-lived stream for notifications
 		const stream = new ReadableStream({
 			start(controller) {
-				sessions.set(session_id, controller);
+				sessions.create(session_id, controller);
 			},
 			cancel() {
 				sessions.delete(session_id);
-				streams.delete(session_id);
 			},
 		});
 
-		streams.set(session_id, stream);
 		return new Response(stream, {
 			headers: {
 				'Content-Type': 'text/event-stream',
@@ -288,7 +366,7 @@ export class HttpTransport {
 				status: 405,
 				headers: {
 					'Content-Type': 'application/json',
-					Allow: 'GET, POST, DELETE',
+					Allow: 'GET, POST, DELETE, OPTIONS',
 				},
 			},
 		);
@@ -339,22 +417,42 @@ export class HttpTransport {
 			request.headers.get('mcp-session-id') ||
 			this.#options.getSessionId();
 
+		/**
+		 * @type {Response | null}
+		 */
+		let response = null;
+
+		// Handle OPTIONS request - preflight CORS
+		if (method === 'OPTIONS') {
+			response = new Response(null, {
+				status: 204,
+				headers: {
+					'Content-Type': 'application/json',
+				},
+			});
+		}
 		// Handle DELETE request - disconnect session
-		if (method === 'DELETE') {
-			return this.#handle_delete(session_id);
+		else if (method === 'DELETE') {
+			response = this.#handle_delete(session_id);
 		}
-
 		// Handle GET request - establish long-lived connection for notifications
-		if (method === 'GET') {
-			return this.#handle_get(session_id);
+		else if (method === 'GET') {
+			response = await this.#handle_get(session_id);
 		}
-
 		// Handle POST request - process message and respond through event stream
-		if (method === 'POST') {
-			return this.#handle_post(session_id, request, auth_info);
+		else if (method === 'POST') {
+			response = await this.#handle_post(session_id, request, auth_info);
 		}
-
 		// Method not supported
-		return this.#handle_default(method);
+		else {
+			response = this.#handle_default(method);
+		}
+
+		// Apply CORS headers if we have a response
+		if (response) {
+			this.#apply_cors_headers(response, request);
+		}
+
+		return response;
 	}
 }

package/src/types/index.d.ts

@@ -1,6 +1,7 @@
 declare module '@tmcp/transport-http' {
 	import type { McpServer } from 'tmcp';
 	import type { OAuth } from '@tmcp/auth';
+	import type { SessionManager } from '@tmcp/session-manager';
 	export class HttpTransport {
 		
 		constructor(server: McpServer<any>, options?: HttpTransportOptions);
@@ -8,10 +9,20 @@ declare module '@tmcp/transport-http' {
 		respond(request: Request): Promise<Response | null>;
 		#private;
 	}
+	export type CorsConfig = {
+		origin?: string | string[] | boolean;
+		methods?: string[];
+		allowedHeaders?: string[];
+		exposedHeaders?: string[];
+		credentials?: boolean;
+		maxAge?: number;
+	};
 	export type HttpTransportOptions = {
 		getSessionId?: () => string;
 		path?: string;
 		oauth?: OAuth<"built">;
+		cors?: CorsConfig | boolean;
+		sessionManager?: SessionManager;
 	};
 
 	export {};

package/src/types/index.d.ts.map

@@ -10,6 +10,6 @@
 	"sourcesContent": [
 		null
 	],
-	"mappings": ";;;cAcaA,aAAaA",
+	"mappings": ";;;;cA6BaA,aAAaA",
 	"ignoreList": []
 }