mcp-proxy 6.5.1 → 6.5.3

package/jsr.json

@@ -3,5 +3,5 @@
   "include": ["src/index.ts", "src/bin/mcp-proxy.ts"],
   "license": "MIT",
   "name": "@punkpeye/mcp-proxy",
-  "version": "6.5.1"
+  "version": "6.5.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proxy",
-  "version": "6.5.1",
+  "version": "6.5.3",
   "main": "dist/index.mjs",
   "scripts": {
     "build": "tsdown",

package/src/bin/mcp-proxy.ts

@@ -80,6 +80,12 @@ const argv = await yargs(hideBin(process.argv))
       describe: "The host to listen on",
       type: "string",
     },
+    keepAliveTimeout: {
+      default: 300000,
+      describe:
+        "The HTTP keep-alive timeout in milliseconds for stateful stream sessions (default: 5 minutes)",
+      type: "number",
+    },
     port: {
       default: 8080,
       describe: "The port to listen on",
@@ -244,6 +250,7 @@ const proxy = async () => {
     createServer,
     eventStore: new InMemoryEventStore(),
     host: argv.host,
+    keepAliveTimeout: argv.keepAliveTimeout,
     port: argv.port,
     sseEndpoint:
       argv.server && argv.server !== "sse"

package/src/startHTTPServer.test.ts

@@ -131,6 +131,73 @@ it("proxies messages between HTTP stream and stdio servers", async () => {
   expect(onClose).toHaveBeenCalled();
 });
 
+it(
+  "keeps stateful HTTP stream sessions alive after idle keep-alive timeout window",
+  async () => {
+    const port = await getRandomPort();
+    const onClose = vi.fn().mockResolvedValue(undefined);
+
+    const httpServer = await startHTTPServer({
+      createServer: async () => {
+        return new Server(
+          { name: "test", version: "1.0.0" },
+          { capabilities: {} },
+        );
+      },
+      onClose,
+      port,
+    });
+
+    const initializeResponse = await fetch(`http://localhost:${port}/mcp`, {
+      body: JSON.stringify({
+        id: 1,
+        jsonrpc: "2.0",
+        method: "initialize",
+        params: {
+          capabilities: {},
+          clientInfo: { name: "test", version: "1.0.0" },
+          protocolVersion: "2025-03-26",
+        },
+      }),
+      headers: {
+        Accept: "application/json, text/event-stream",
+        "Content-Type": "application/json",
+      },
+      method: "POST",
+    });
+
+    expect(initializeResponse.status).toBe(200);
+    const sessionId = initializeResponse.headers.get("mcp-session-id");
+    expect(sessionId).toBeTruthy();
+    await initializeResponse.text();
+
+    await delay(6_000);
+
+    const listToolsResponse = await fetch(`http://localhost:${port}/mcp`, {
+      body: JSON.stringify({
+        id: 2,
+        jsonrpc: "2.0",
+        method: "tools/list",
+        params: {},
+      }),
+      headers: {
+        Accept: "application/json, text/event-stream",
+        "Content-Type": "application/json",
+        "mcp-session-id": sessionId!,
+      },
+      method: "POST",
+    });
+    const listToolsBody = await listToolsResponse.text();
+
+    expect(listToolsResponse.status).not.toBe(404);
+    expect(listToolsBody).not.toContain("Session not found");
+    expect(onClose).not.toHaveBeenCalled();
+
+    await httpServer.close();
+  },
+  15_000,
+);
+
 it("proxies messages between SSE and stdio servers", async () => {
   const stdioTransport = new StdioClientTransport({
     args: ["src/fixtures/simple-stdio-server.ts"],
@@ -667,6 +734,36 @@ it("does not require auth for /ping endpoint", async () => {
   await httpServer.close();
 });
 
+it("responds with 400 to a malformed request target instead of crashing", async () => {
+  const port = await getRandomPort();
+
+  const httpServer = await startHTTPServer({
+    createServer: async () => {
+      return new Server({ name: "test", version: "1.0.0" }, { capabilities: {} });
+    },
+    port,
+  });
+
+  // `//` is not a valid URL target; sent via http.request so it isn't
+  // normalized away. Before the fix this threw inside the request listener
+  // and crashed the process.
+  const statusCode = await new Promise<number>((resolve, reject) => {
+    const request = http.request(
+      { host: "localhost", path: "//", port },
+      (res) => {
+        res.resume();
+        resolve(res.statusCode ?? 0);
+      },
+    );
+    request.on("error", reject);
+    request.end();
+  });
+
+  expect(statusCode).toBe(400);
+
+  await httpServer.close();
+});
+
 it("does not require auth for OPTIONS requests", async () => {
   const port = await getRandomPort();
   const apiKey = "test-api-key-999";

package/src/startHTTPServer.ts

@@ -13,6 +13,8 @@ import { randomUUID } from "node:crypto";
 import { AuthConfig, AuthenticationMiddleware } from "./authentication.js";
 import { InMemoryEventStore } from "./InMemoryEventStore.js";
 
+const DEFAULT_KEEP_ALIVE_TIMEOUT = 300_000;
+
 export interface CorsOptions {
   allowedHeaders?: string | string[]; // Allow string[] or '*' for wildcard
   credentials?: boolean;
@@ -881,6 +883,7 @@ export const startHTTPServer = async <T extends ServerLike>({
   enableJsonResponse,
   eventStore,
   host = "::",
+  keepAliveTimeout = DEFAULT_KEEP_ALIVE_TIMEOUT,
   oauth,
   onClose,
   onConnect,
@@ -900,6 +903,7 @@ export const startHTTPServer = async <T extends ServerLike>({
   enableJsonResponse?: boolean;
   eventStore?: EventStore;
   host?: string;
+  keepAliveTimeout?: number;
   oauth?: AuthConfig["oauth"];
   onClose?: (server: T) => Promise<void>;
   onConnect?: (server: T) => Promise<void>;
@@ -951,7 +955,15 @@ export const startHTTPServer = async <T extends ServerLike>({
     // and would otherwise short-circuit the MCP protocol handlers.
     // Use a fixed base because `host` may be "::" (IPv6 any), which is not a
     // valid URL authority. We only need pathname here.
-    const requestUrl = new URL(req.url || "", "http://localhost");
+    // A malformed request target (e.g. "//") makes `new URL` throw, which
+    // would crash the process from this listener, so reject it with 400.
+    let requestUrl: URL;
+    try {
+      requestUrl = new URL(req.url || "", "http://localhost");
+    } catch {
+      res.writeHead(400).end("Bad Request");
+      return;
+    }
     const isMcpEndpoint =
       (sseEndpoint && requestUrl.pathname === sseEndpoint) ||
       (streamEndpoint && requestUrl.pathname === streamEndpoint);
@@ -1047,6 +1059,14 @@ export const startHTTPServer = async <T extends ServerLike>({
     httpServer = http.createServer(requestListener);
   }
 
+  // Keep stateful stream sessions from being torn down when Node closes
+  // otherwise-idle HTTP keep-alive sockets after its 5 second default.
+  httpServer.keepAliveTimeout = keepAliveTimeout;
+  httpServer.headersTimeout = Math.max(
+    httpServer.headersTimeout,
+    keepAliveTimeout + 1000,
+  );
+
   await new Promise((resolve) => {
     httpServer.listen(port, host, () => {
       resolve(undefined);