mcp-proxy 6.5.3 → 6.5.5

package/jsr.json

@@ -3,5 +3,5 @@
   "include": ["src/index.ts", "src/bin/mcp-proxy.ts"],
   "license": "MIT",
   "name": "@punkpeye/mcp-proxy",
-  "version": "6.5.3"
+  "version": "6.5.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proxy",
-  "version": "6.5.3",
+  "version": "6.5.5",
   "main": "dist/index.mjs",
   "scripts": {
     "build": "tsdown",

package/src/InMemoryEventStore.test.ts

@@ -237,4 +237,100 @@ describe("InMemoryEventStore", () => {
       secondSpy.mockRestore();
     }
   });
+
+  it("evicts the oldest events once maxEvents is exceeded", async () => {
+    const store = new InMemoryEventStore({ maxEvents: 3 });
+    const streamId = "bounded-stream";
+
+    const eventIds: string[] = [];
+    for (let i = 0; i < 5; i++) {
+      eventIds.push(
+        await store.storeEvent(streamId, {
+          id: i,
+          jsonrpc: "2.0",
+          method: `step/${i}`,
+        }),
+      );
+      await new Promise((resolve) => setTimeout(resolve, 1));
+    }
+
+    // Only the 3 most recently stored events survive.
+    expect(store.size).toBe(3);
+
+    // The two oldest events were evicted, so resuming from them is no
+    // longer possible - the caller falls back to a fresh stream.
+    for (const evictedId of eventIds.slice(0, 2)) {
+      const result = await store.replayEventsAfter(evictedId, {
+        send: vi.fn(),
+      });
+      expect(result).toBe("");
+    }
+
+    // Resuming from a surviving event still replays what came after it.
+    const replayed: JSONRPCMessage[] = [];
+    const returnedStreamId = await store.replayEventsAfter(eventIds[2], {
+      send: async (_eventId, message) => {
+        replayed.push(message);
+      },
+    });
+    expect(returnedStreamId).toBe(streamId);
+    expect(replayed).toHaveLength(2);
+  });
+
+  it("caps total retained events across all streams, not per stream", async () => {
+    const store = new InMemoryEventStore({ maxEvents: 4 });
+
+    for (let i = 0; i < 3; i++) {
+      await store.storeEvent("stream-a", {
+        id: i,
+        jsonrpc: "2.0",
+        method: `a/${i}`,
+      });
+      await new Promise((resolve) => setTimeout(resolve, 1));
+    }
+    for (let i = 0; i < 3; i++) {
+      await store.storeEvent("stream-b", {
+        id: i,
+        jsonrpc: "2.0",
+        method: `b/${i}`,
+      });
+      await new Promise((resolve) => setTimeout(resolve, 1));
+    }
+
+    // 6 events were stored across two streams; the store-wide cap still holds.
+    expect(store.size).toBe(4);
+  });
+
+  it("defaults to a bounded size when maxEvents is not configured", async () => {
+    const store = new InMemoryEventStore();
+    const streamId = "default-cap-stream";
+
+    for (let i = 0; i < 1010; i++) {
+      await store.storeEvent(streamId, {
+        id: i,
+        jsonrpc: "2.0",
+        method: "tools/list",
+      });
+    }
+
+    expect(store.size).toBe(1000);
+  });
+
+  it("rejects a non-positive maxEvents", () => {
+    expect(() => new InMemoryEventStore({ maxEvents: 0 })).toThrow(
+      /maxEvents must be at least 1/,
+    );
+    expect(() => new InMemoryEventStore({ maxEvents: -1 })).toThrow(
+      /maxEvents must be at least 1/,
+    );
+  });
+
+  it("rejects a NaN maxEvents instead of silently disabling eviction", () => {
+    // A naive `maxEvents < 1` check lets NaN through (every comparison with
+    // NaN is false), which would make `size > maxEvents` never trigger and
+    // silently reintroduce unbounded growth.
+    expect(() => new InMemoryEventStore({ maxEvents: NaN })).toThrow(
+      /maxEvents must be at least 1/,
+    );
+  });
 });

package/src/InMemoryEventStore.ts

@@ -6,17 +6,56 @@
 import type { EventStore } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 
+// A stream accumulates one event per server->client message (e.g. every
+// tool call on a stateful session opens its own stream). With no cap, a
+// single long-lived session climbs without bound - see
+// https://github.com/punkpeye/mcp-proxy/issues/72.
+const DEFAULT_MAX_EVENTS = 1000;
+
+export interface InMemoryEventStoreOptions {
+  /**
+   * Maximum number of events retained across all streams before the oldest
+   * are evicted (FIFO). Bounds memory use; older reconnect attempts beyond
+   * this window fall back to a fresh (non-resumed) stream instead of a replay.
+   *
+   * @default 1000
+   */
+  maxEvents?: number;
+}
+
 /**
  * Simple in-memory implementation of the EventStore interface for resumability
  * This is primarily intended for examples and testing, not for production use
  * where a persistent storage solution would be more appropriate.
  */
 export class InMemoryEventStore implements EventStore {
+  /**
+   * The number of events currently retained (for observability/testing).
+   */
+  get size(): number {
+    return this.events.size;
+  }
   private events: Map<string, { message: JSONRPCMessage; streamId: string }> =
     new Map();
   private lastTimestamp = 0;
   private lastTimestampCounter = 0;
 
+  private readonly maxEvents: number;
+
+  constructor(options: InMemoryEventStoreOptions = {}) {
+    const maxEvents = options.maxEvents ?? DEFAULT_MAX_EVENTS;
+
+    // Written as `!(maxEvents >= 1)` rather than `maxEvents < 1` so NaN
+    // (every comparison with NaN is false) is rejected too - otherwise
+    // `size > maxEvents` would never trigger eviction and silently
+    // reintroduce unbounded growth.
+    if (!(maxEvents >= 1)) {
+      throw new Error("maxEvents must be at least 1");
+    }
+
+    this.maxEvents = maxEvents;
+  }
+
   /**
    * Replays events that occurred after a specific event ID
    * Implements EventStore.replayEventsAfter
@@ -77,6 +116,18 @@ export class InMemoryEventStore implements EventStore {
 
     this.events.set(eventId, { message, streamId });
 
+    // Map iterates in insertion order, so the first key is always the
+    // oldest surviving event - evicting it is a plain FIFO/ring buffer.
+    while (this.events.size > this.maxEvents) {
+      const oldestEventId = this.events.keys().next().value;
+
+      if (oldestEventId === undefined) {
+        break;
+      }
+
+      this.events.delete(oldestEventId);
+    }
+
     return eventId;
   }
 

package/src/bin/mcp-proxy.ts

@@ -14,7 +14,6 @@ import { hideBin } from "yargs/helpers";
 const require = createRequire(import.meta.url);
 const packageJson = require("../../package.json") as { version: string };
 
-import { InMemoryEventStore } from "../InMemoryEventStore.js";
 import { proxyServer } from "../proxyServer.js";
 import { SSEServer, startHTTPServer } from "../startHTTPServer.js";
 import { StdioClientTransport } from "../StdioClientTransport.js";
@@ -70,6 +69,18 @@ const argv = await yargs(hideBin(process.argv))
       describe: "The endpoint to listen on",
       type: "string",
     },
+    eventStore: {
+      default: true,
+      describe:
+        "Enable the streamable HTTP transport's resumability event store, which lets clients replay missed messages after a reconnect. Use --no-eventStore to disable it entirely for request/response-only deployments that don't need this and would rather avoid the memory overhead",
+      type: "boolean",
+    },
+    eventStoreMaxEvents: {
+      default: 1000,
+      describe:
+        "Maximum number of buffered events the resumability event store retains (per session) before it evicts the oldest; bounds memory use. Ignored when --no-eventStore is set",
+      type: "number",
+    },
     gracefulShutdownTimeout: {
       default: 5000,
       describe: "The timeout (in milliseconds) for graceful shutdown",
@@ -149,6 +160,13 @@ const argv = await yargs(hideBin(process.argv))
   .help()
   .parseAsync();
 
+if (!(argv.eventStoreMaxEvents >= 1)) {
+  console.error(
+    `Error: --eventStoreMaxEvents must be a number >= 1 (got ${String(argv.eventStoreMaxEvents)}). Use --no-eventStore to disable the event store instead.`,
+  );
+  process.exit(1);
+}
+
 // Default Access-Control-Allow-Headers list — must stay in sync with
 // `defaultCorsOptions.allowedHeaders` in src/startHTTPServer.ts.
 const DEFAULT_ALLOWED_HEADERS = [
@@ -248,7 +266,8 @@ const proxy = async () => {
     apiKey: argv.apiKey,
     cors: corsOption,
     createServer,
-    eventStore: new InMemoryEventStore(),
+    eventStore: argv.eventStore ? undefined : false,
+    eventStoreMaxEvents: argv.eventStoreMaxEvents,
     host: argv.host,
     keepAliveTimeout: argv.keepAliveTimeout,
     port: argv.port,

package/src/index.ts

@@ -1,8 +1,9 @@
 export type { AuthConfig } from "./authentication.js";
 export { AuthenticationMiddleware } from "./authentication.js";
+export type { InMemoryEventStoreOptions } from "./InMemoryEventStore.js";
 export { InMemoryEventStore } from "./InMemoryEventStore.js";
 export { proxyServer } from "./proxyServer.js";
-export type { CorsOptions } from "./startHTTPServer.js";
+export type { CorsOptions, EventStoreOption } from "./startHTTPServer.js";
 export { startHTTPServer } from "./startHTTPServer.js";
 export { ServerType, startStdioServer } from "./startStdioServer.js";
 export { tapTransport } from "./tapTransport.js";

package/src/startHTTPServer.test.ts

@@ -993,6 +993,136 @@ it("accepts requests with valid Bearer token in stateless mode", async () => {
   await stdioClient.close();
 });
 
+it("returns 401 for authenticated stream requests without a session ID", async () => {
+  const port = await getRandomPort();
+  const authenticate = vi.fn().mockResolvedValue({ userId: "test-user" });
+  const createServer = vi.fn(async () => {
+    return new Server({ name: "test", version: "1.0.0" }, { capabilities: {} });
+  });
+
+  const httpServer = await startHTTPServer({
+    authenticate,
+    createServer,
+    port,
+  });
+
+  try {
+    const response = await fetch(`http://localhost:${port}/mcp`, {
+      body: JSON.stringify({
+        id: 1,
+        jsonrpc: "2.0",
+        method: "tools/list",
+      }),
+      headers: {
+        Accept: "application/json, text/event-stream",
+        Authorization: "Bearer valid-token",
+        "Content-Type": "application/json",
+      },
+      method: "POST",
+    });
+
+    expect(response.status).toBe(401);
+
+    const errorResponse = (await response.json()) as {
+      error: { code: number; message: string };
+      id: null | number;
+      jsonrpc: string;
+    };
+    expect(errorResponse.error).toEqual({
+      code: -32000,
+      message: "Unauthorized: No valid session ID provided",
+    });
+    expect(errorResponse.id).toBe(1);
+    expect(authenticate).toHaveBeenCalledTimes(1);
+    expect(createServer).not.toHaveBeenCalled();
+  } finally {
+    await httpServer.close();
+  }
+});
+
+it("returns 401 for authenticated stream GET requests without a session ID", async () => {
+  const port = await getRandomPort();
+  const authenticate = vi.fn().mockResolvedValue({ userId: "test-user" });
+
+  const httpServer = await startHTTPServer({
+    authenticate,
+    createServer: async () => {
+      return new Server(
+        { name: "test", version: "1.0.0" },
+        { capabilities: {} },
+      );
+    },
+    port,
+  });
+
+  try {
+    const response = await fetch(`http://localhost:${port}/mcp`, {
+      headers: {
+        Accept: "text/event-stream",
+        Authorization: "Bearer valid-token",
+      },
+      method: "GET",
+    });
+
+    expect(response.status).toBe(401);
+
+    const errorResponse = (await response.json()) as {
+      error: { code: number; message: string };
+      id: null | number;
+      jsonrpc: string;
+    };
+    expect(errorResponse.error.message).toBe(
+      "Unauthorized: No valid session ID provided",
+    );
+    expect(errorResponse.id).toBeNull();
+    expect(authenticate).not.toHaveBeenCalled();
+  } finally {
+    await httpServer.close();
+  }
+});
+
+it("keeps malformed authenticated stream requests as 400", async () => {
+  const port = await getRandomPort();
+  const authenticate = vi.fn().mockResolvedValue({ userId: "test-user" });
+
+  const httpServer = await startHTTPServer({
+    authenticate,
+    createServer: async () => {
+      return new Server(
+        { name: "test", version: "1.0.0" },
+        { capabilities: {} },
+      );
+    },
+    port,
+  });
+
+  try {
+    const response = await fetch(`http://localhost:${port}/mcp`, {
+      body: JSON.stringify({ malformed: true }),
+      headers: {
+        Accept: "application/json, text/event-stream",
+        Authorization: "Bearer valid-token",
+        "Content-Type": "application/json",
+      },
+      method: "POST",
+    });
+
+    expect(response.status).toBe(400);
+
+    const errorResponse = (await response.json()) as {
+      error: { code: number; message: string };
+      id: null | number;
+      jsonrpc: string;
+    };
+    expect(errorResponse.error.message).toBe(
+      "Bad Request: No valid session ID provided",
+    );
+    expect(authenticate).toHaveBeenCalledTimes(1);
+  } finally {
+    await httpServer.close();
+  }
+});
+
 it("returns 401 when authenticate callback returns null in stateless mode", async () => {
   const stdioTransport = new StdioClientTransport({
     args: ["src/fixtures/simple-stdio-server.ts"],
@@ -2467,3 +2597,78 @@ it("DELETE request to non-existent session returns 400", async () => {
   await httpServer.close();
   await stdioClient.close();
 }, 15000);
+
+// The SDK only writes a resumability "priming event" (an `id: <eventId>`
+// SSE line) when an event store is configured, so its presence/absence is a
+// reliable, wire-level signal of whether resumability is actually active -
+// see https://github.com/punkpeye/mcp-proxy/issues/72.
+const initializeAndGetRawBody = async (port: number) => {
+  const response = await fetch(`http://localhost:${port}/mcp`, {
+    body: JSON.stringify({
+      id: 1,
+      jsonrpc: "2.0",
+      method: "initialize",
+      params: {
+        capabilities: {},
+        clientInfo: { name: "test", version: "1.0.0" },
+        // Priming events are only sent to clients whose negotiated protocol
+        // version is >= 2025-11-25.
+        protocolVersion: "2025-11-25",
+      },
+    }),
+    headers: {
+      Accept: "application/json, text/event-stream",
+      "Content-Type": "application/json",
+    },
+    method: "POST",
+  });
+
+  expect(response.status).toBe(200);
+
+  return response.text();
+};
+
+it("disables the resumability event store when eventStore: false is passed", async () => {
+  const port = await getRandomPort();
+
+  const httpServer = await startHTTPServer({
+    createServer: async () => {
+      return new Server(
+        { name: "test", version: "1.0.0" },
+        { capabilities: {} },
+      );
+    },
+    eventStore: false,
+    port,
+  });
+
+  try {
+    const body = await initializeAndGetRawBody(port);
+
+    expect(body).not.toMatch(/^id: /m);
+  } finally {
+    await httpServer.close();
+  }
+});
+
+it("enables a bounded, per-session resumability event store by default", async () => {
+  const port = await getRandomPort();
+
+  const httpServer = await startHTTPServer({
+    createServer: async () => {
+      return new Server(
+        { name: "test", version: "1.0.0" },
+        { capabilities: {} },
+      );
+    },
+    port,
+  });
+
+  try {
+    const body = await initializeAndGetRawBody(port);
+
+    expect(body).toMatch(/^id: /m);
+  } finally {
+    await httpServer.close();
+  }
+});