mcp-proxy 6.5.3 → 6.5.5

package/src/startHTTPServer.ts

@@ -4,7 +4,10 @@ import {
   EventStore,
   StreamableHTTPServerTransport,
 } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import {
+  isInitializeRequest,
+  JSONRPCMessageSchema,
+} from "@modelcontextprotocol/sdk/types.js";
 import fs from "fs";
 import http from "http";
 import https from "https";
@@ -15,6 +18,25 @@ import { InMemoryEventStore } from "./InMemoryEventStore.js";
 
 const DEFAULT_KEEP_ALIVE_TIMEOUT = 300_000;
 
+/**
+ * `false` disables the resumability event store entirely (no replay-on-
+ * reconnect, no retained state). Omitted/`undefined` creates a fresh,
+ * bounded `InMemoryEventStore` per session - see `eventStoreMaxEvents`.
+ * Pass an `EventStore` instance to use a shared or custom-backed store.
+ */
+export type EventStoreOption = EventStore | false;
+
+const resolveEventStore = (
+  eventStore: EventStoreOption | undefined,
+  maxEvents: number | undefined,
+): EventStore | undefined => {
+  if (eventStore === false) {
+    return undefined;
+  }
+
+  return eventStore ?? new InMemoryEventStore({ maxEvents });
+};
+
 export interface CorsOptions {
   allowedHeaders?: string | string[]; // Allow string[] or '*' for wildcard
   credentials?: boolean;
@@ -62,6 +84,35 @@ const createJsonRpcErrorResponse = (code: number, message: string) => {
   });
 };
 
+type SessionUnauthorizedResponseOptions = {
+  readonly body?: unknown;
+  readonly oauth?: AuthConfig["oauth"];
+  readonly res: http.ServerResponse;
+};
+
+const getRequestId = (body: unknown): unknown => {
+  if (
+    typeof body !== "object" ||
+    body === null ||
+    Array.isArray(body) ||
+    !("id" in body)
+  ) {
+    return null;
+  }
+
+  return body.id;
+};
+
+const isJsonRpcMessage = (message: unknown): boolean => {
+  return JSONRPCMessageSchema.safeParse(message).success;
+};
+
+const isJsonRpcBody = (body: unknown): boolean => {
+  return Array.isArray(body)
+    ? body.every(isJsonRpcMessage)
+    : isJsonRpcMessage(body);
+};
+
 // Helper function to get WWW-Authenticate header value
 const getWWWAuthenticateHeader = (
   oauth?: AuthConfig["oauth"],
@@ -125,6 +176,35 @@ const getWWWAuthenticateHeader = (
   return `Bearer ${params.join(", ")}`;
 };
 
+const sendSessionUnauthorizedResponse = ({
+  body,
+  oauth,
+  res,
+}: SessionUnauthorizedResponseOptions): void => {
+  const message = "Unauthorized: No valid session ID provided";
+
+  res.setHeader("Content-Type", "application/json");
+
+  const wwwAuthHeader = getWWWAuthenticateHeader(oauth, {
+    error: "invalid_token",
+    error_description: message,
+  });
+  if (wwwAuthHeader) {
+    res.setHeader("WWW-Authenticate", wwwAuthHeader);
+  }
+
+  res.writeHead(401).end(
+    JSON.stringify({
+      error: {
+        code: -32000,
+        message,
+      },
+      id: getRequestId(body),
+      jsonrpc: "2.0",
+    }),
+  );
+};
+
 // Helper function to detect scope challenge errors
 const isScopeChallengeError = (
   error: unknown,
@@ -320,6 +400,7 @@ const handleStreamRequest = async <T extends ServerLike>({
   enableJsonResponse,
   endpoint,
   eventStore,
+  eventStoreMaxEvents,
   oauth,
   onClose,
   onConnect,
@@ -336,7 +417,8 @@ const handleStreamRequest = async <T extends ServerLike>({
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
   endpoint: string;
-  eventStore?: EventStore;
+  eventStore?: EventStoreOption;
+  eventStoreMaxEvents?: number;
   oauth?: AuthConfig["oauth"];
   onClose?: (server: T) => Promise<void>;
   onConnect?: (server: T) => Promise<void>;
@@ -353,9 +435,9 @@ const handleStreamRequest = async <T extends ServerLike>({
       // In stateless mode, ignore session ID header entirely (like Python MCP SDK)
       const sessionId = stateless
         ? undefined
-        : (Array.isArray(req.headers["mcp-session-id"])
-            ? req.headers["mcp-session-id"][0]
-            : req.headers["mcp-session-id"]);
+        : Array.isArray(req.headers["mcp-session-id"])
+          ? req.headers["mcp-session-id"][0]
+          : req.headers["mcp-session-id"];
 
       let transport: StreamableHTTPServerTransport;
 
@@ -449,6 +531,12 @@ const handleStreamRequest = async <T extends ServerLike>({
       if (sessionId) {
         const activeTransport = activeTransports[sessionId];
         if (!activeTransport) {
+          if (authenticate && isJsonRpcBody(body)) {
+            sendSessionUnauthorizedResponse({ body, oauth, res });
+
+            return true;
+          }
+
           res.setHeader("Content-Type", "application/json");
           res
             .writeHead(404)
@@ -476,7 +564,7 @@ const handleStreamRequest = async <T extends ServerLike>({
         // Create a new transport for the session
         transport = new StreamableHTTPServerTransport({
           enableJsonResponse,
-          eventStore: eventStore || new InMemoryEventStore(),
+          eventStore: resolveEventStore(eventStore, eventStoreMaxEvents),
           onsessioninitialized: (_sessionId) => {
             // add only when the id Session id is generated (skip in stateless mode)
             if (!stateless && _sessionId) {
@@ -570,7 +658,7 @@ const handleStreamRequest = async <T extends ServerLike>({
         // In stateless mode, handle non-initialize requests by creating a new transport
         transport = new StreamableHTTPServerTransport({
           enableJsonResponse,
-          eventStore: eventStore || new InMemoryEventStore(),
+          eventStore: resolveEventStore(eventStore, eventStoreMaxEvents),
           onsessioninitialized: () => {
             // No session tracking in stateless mode
           },
@@ -634,6 +722,12 @@ const handleStreamRequest = async <T extends ServerLike>({
 
         return true;
       } else {
+        if (authenticate && isJsonRpcBody(body)) {
+          sendSessionUnauthorizedResponse({ body, oauth, res });
+
+          return true;
+        }
+
         // Error if the server is not created but the request is not an initialize request
         res.setHeader("Content-Type", "application/json");
 
@@ -690,7 +784,7 @@ const handleStreamRequest = async <T extends ServerLike>({
         }
       | undefined = sessionId ? activeTransports[sessionId] : undefined;
 
-    if (!sessionId) {  
+    if (!sessionId) {
       // Return METHOD_NOT_ALLOWED so stateless clients' transport stops reconnecting
       if (stateless) {
         res.writeHead(405, { Allow: "POST" }).end("Method Not Allowed");
@@ -698,12 +792,24 @@ const handleStreamRequest = async <T extends ServerLike>({
         return true;
       }
 
+      if (authenticate) {
+        sendSessionUnauthorizedResponse({ oauth, res });
+
+        return true;
+      }
+
       res.writeHead(400).end("No sessionId");
 
       return true;
     }
 
     if (!activeTransport) {
+      if (authenticate) {
+        sendSessionUnauthorizedResponse({ oauth, res });
+
+        return true;
+      }
+
       res.writeHead(400).end("No active transport");
 
       return true;
@@ -735,6 +841,12 @@ const handleStreamRequest = async <T extends ServerLike>({
     const sessionId = req.headers["mcp-session-id"] as string | undefined;
 
     if (!sessionId) {
+      if (authenticate) {
+        sendSessionUnauthorizedResponse({ oauth, res });
+
+        return true;
+      }
+
       res.writeHead(400).end("Invalid or missing sessionId");
 
       return true;
@@ -745,6 +857,12 @@ const handleStreamRequest = async <T extends ServerLike>({
     const activeTransport = activeTransports[sessionId];
 
     if (!activeTransport) {
+      if (authenticate) {
+        sendSessionUnauthorizedResponse({ oauth, res });
+
+        return true;
+      }
+
       res.writeHead(400).end("No active transport");
       return true;
     }
@@ -882,6 +1000,7 @@ export const startHTTPServer = async <T extends ServerLike>({
   createServer,
   enableJsonResponse,
   eventStore,
+  eventStoreMaxEvents,
   host = "::",
   keepAliveTimeout = DEFAULT_KEEP_ALIVE_TIMEOUT,
   oauth,
@@ -901,7 +1020,22 @@ export const startHTTPServer = async <T extends ServerLike>({
   cors?: boolean | CorsOptions;
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
-  eventStore?: EventStore;
+  /**
+   * Event store for the streamable HTTP transport's resumability support.
+   * Pass `false` to disable resumability entirely (recommended for
+   * request/response-only deployments that don't need replay-on-reconnect).
+   * Omit to get a fresh, bounded `InMemoryEventStore` per session - see
+   * `eventStoreMaxEvents`. Pass an `EventStore` instance to bring your own
+   * (e.g. a persistent, cross-process store); it will be shared across all
+   * sessions handled by this server.
+   */
+  eventStore?: EventStoreOption;
+  /**
+   * Caps how many events the auto-created per-session `InMemoryEventStore`
+   * retains (oldest evicted first) before it's overridden by an explicit
+   * `eventStore`. Bounds memory for long-lived sessions. Default: 1000.
+   */
+  eventStoreMaxEvents?: number;
   host?: string;
   keepAliveTimeout?: number;
   oauth?: AuthConfig["oauth"];
@@ -1010,6 +1144,7 @@ export const startHTTPServer = async <T extends ServerLike>({
         enableJsonResponse,
         endpoint: streamEndpoint,
         eventStore,
+        eventStoreMaxEvents,
         oauth,
         onClose,
         onConnect,
@@ -1024,7 +1159,7 @@ export const startHTTPServer = async <T extends ServerLike>({
     res.writeHead(404).end();
   };
 
-  let httpServer;
+  let httpServer: http.Server | https.Server;
   if (sslCa || sslCert || sslKey) {
     const options: https.ServerOptions = {};
     if (sslCa) {