@tmcp/transport-http 0.8.3 → 0.8.5

package/README.md

@@ -212,11 +212,24 @@ interface HttpTransportOptions {
 		streams?: StreamSessionManager;
 		info?: InfoSessionManager;
 	}; // Provide custom managers; defaults to in-memory implementations
+	disableSse?: boolean; // Disable SSE stream endpoint (GET returns 405)
 }
 ```
 
 If you omit `sessionManager` the transport creates `InMemoryStreamSessionManager` and `InMemoryInfoSessionManager` instances for you. You can override either field independently (for example, Redis streams with in-memory metadata during development).
 
+### Disabling SSE Streams
+
+If your deployment doesn't support long-lived SSE connections (e.g., some serverless environments), you can disable the GET endpoint:
+
+```javascript
+const transport = new HttpTransport(server, {
+	disableSse: true,
+});
+```
+
+When `disableSse` is `true`, GET requests to the MCP endpoint will return a `405 Method Not Allowed` response. Clients can still communicate via POST requests, but won't receive server-initiated notifications.
+
 #### Methods
 
 ##### `respond(request: Request, customContext?: T): Promise<Response | null>`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tmcp/transport-http",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Transport for TMCP using HTTP",
   "type": "module",
   "main": "src/index.js",
@@ -40,7 +40,7 @@
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.17.1",
-    "@remix-run/node-fetch-server": "^0.12.0",
+    "@remix-run/node-fetch-server": "^0.13.0",
     "@types/node": "^24.0.15",
     "dts-buddy": "^0.6.2",
     "publint": "^0.3.12",
@@ -48,7 +48,7 @@
     "vitest": "^4.0.0",
     "@tmcp/adapter-valibot": "^0.1.5",
     "@tmcp/auth": "^0.4.0",
-    "tmcp": "^1.18.1"
+    "tmcp": "^1.19.3"
   },
   "publishConfig": {
     "access": "public"

package/src/index.js

@@ -23,6 +23,7 @@
  * 	oauth?: OAuth<"built">
  * 	cors?: CorsConfig | boolean,
  * 	sessionManager?: { streams?: StreamSessionManager, info?: OptionalizeSessionManager<InfoSessionManager> }
+ * 	disableSse?: boolean
  * }} HttpTransportOptions
  */
 
@@ -47,7 +48,7 @@ export class HttpTransport {
 	#server;
 
 	/**
-	 * @type {Required<Omit<HttpTransportOptions, 'oauth' | 'cors' | 'sessionManager'>> & { cors?: CorsConfig | boolean, sessionManager: SessionManager }}
+	 * @type {Required<Omit<HttpTransportOptions, 'oauth' | 'cors' | 'sessionManager' | 'disableSse'>> & { cors?: CorsConfig | boolean, sessionManager: SessionManager, disableSse?: boolean }}
 	 */
 	#options;
 
@@ -85,6 +86,7 @@ export class HttpTransport {
 			path = '/mcp',
 			oauth,
 			cors,
+			disableSse,
 			sessionManager: _sessionManager = {
 				streams: new InMemoryStreamSessionManager(),
 				info: new InMemoryInfoSessionManager(),
@@ -113,7 +115,13 @@ export class HttpTransport {
 			this.#oauth = oauth;
 		}
 
-		this.#options = { getSessionId, path, cors, sessionManager };
+		this.#options = {
+			getSessionId,
+			path,
+			cors,
+			sessionManager,
+			disableSse,
+		};
 		this.#path = path;
 
 		this.#server.on('initialize', ({ capabilities, clientInfo }) => {
@@ -281,6 +289,15 @@ export class HttpTransport {
 	 * @returns
 	 */
 	async #handle_get(session_id) {
+		if (this.#options.disableSse) {
+			return new Response(null, {
+				status: 405,
+				headers: {
+					Allow: 'POST, DELETE, OPTIONS',
+				},
+			});
+		}
+
 		const sessions = this.#options.sessionManager;
 		const text_encoder = this.#text_encoder;
 		// If session already exists, return error
@@ -376,17 +393,28 @@ export class HttpTransport {
 
 			const session_id_storage = this.#session_id_storage;
 
+			const messages = Array.isArray(body) ? body : [body];
+
 			const handle = async () => {
-				const client_capabilities =
-					await this.#options.sessionManager.info
-						.getClientCapabilities(session_id)
-						.catch(() => undefined);
-				const client_info = await this.#options.sessionManager.info
-					.getClientInfo(session_id)
-					.catch(() => undefined);
-				const log_level = await this.#options.sessionManager.info
-					.getLogLevel(session_id)
-					.catch(() => undefined);
+				const init_message = messages.find(
+					(/** @type {any} */ m) => m.method === 'initialize',
+				);
+
+				const client_capabilities = init_message
+					? init_message.params?.capabilities
+					: await this.#options.sessionManager.info
+							.getClientCapabilities(session_id)
+							.catch(() => undefined);
+				const client_info = init_message
+					? init_message.params?.clientInfo
+					: await this.#options.sessionManager.info
+							.getClientInfo(session_id)
+							.catch(() => undefined);
+				const log_level = init_message
+					? undefined
+					: await this.#options.sessionManager.info
+							.getLogLevel(session_id)
+							.catch(() => undefined);
 
 				const response = await this.#controller_storage.run(
 					controller,
@@ -417,8 +445,6 @@ export class HttpTransport {
 
 			handle();
 
-			const messages = Array.isArray(body) ? body : [body];
-
 			const has_request = messages.some((message) => message.id != null);
 
 			// Determine status code based on response type

package/src/types/index.d.ts

@@ -26,6 +26,7 @@ declare module '@tmcp/transport-http' {
 			streams?: StreamSessionManager;
 			info?: OptionalizeSessionManager<InfoSessionManager>;
 		};
+		disableSse?: boolean;
 	};
 	type ToOmit = 'removeSubscription';
 

package/src/types/index.d.ts.map

@@ -14,6 +14,6 @@
 		null,
 		null
 	],
-	"mappings": ";;;;cAsCaA,aAAaA;;;;;;;;;;;;;;;;;;;;;;;;;MCnCrBC,MAAMA;;MAECC,yBAAyBA",
+	"mappings": ";;;;cAuCaA,aAAaA;;;;;;;;;;;;;;;;;;;;;;;;;;MCpCrBC,MAAMA;;MAECC,yBAAyBA",
 	"ignoreList": []
 }