mcp-proxy 6.5.4 → 6.5.5

package/jsr.json

@@ -3,5 +3,5 @@
   "include": ["src/index.ts", "src/bin/mcp-proxy.ts"],
   "license": "MIT",
   "name": "@punkpeye/mcp-proxy",
-  "version": "6.5.4"
+  "version": "6.5.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proxy",
-  "version": "6.5.4",
+  "version": "6.5.5",
   "main": "dist/index.mjs",
   "scripts": {
     "build": "tsdown",

package/src/InMemoryEventStore.test.ts

@@ -237,4 +237,100 @@ describe("InMemoryEventStore", () => {
       secondSpy.mockRestore();
     }
   });
+
+  it("evicts the oldest events once maxEvents is exceeded", async () => {
+    const store = new InMemoryEventStore({ maxEvents: 3 });
+    const streamId = "bounded-stream";
+
+    const eventIds: string[] = [];
+    for (let i = 0; i < 5; i++) {
+      eventIds.push(
+        await store.storeEvent(streamId, {
+          id: i,
+          jsonrpc: "2.0",
+          method: `step/${i}`,
+        }),
+      );
+      await new Promise((resolve) => setTimeout(resolve, 1));
+    }
+
+    // Only the 3 most recently stored events survive.
+    expect(store.size).toBe(3);
+
+    // The two oldest events were evicted, so resuming from them is no
+    // longer possible - the caller falls back to a fresh stream.
+    for (const evictedId of eventIds.slice(0, 2)) {
+      const result = await store.replayEventsAfter(evictedId, {
+        send: vi.fn(),
+      });
+      expect(result).toBe("");
+    }
+
+    // Resuming from a surviving event still replays what came after it.
+    const replayed: JSONRPCMessage[] = [];
+    const returnedStreamId = await store.replayEventsAfter(eventIds[2], {
+      send: async (_eventId, message) => {
+        replayed.push(message);
+      },
+    });
+    expect(returnedStreamId).toBe(streamId);
+    expect(replayed).toHaveLength(2);
+  });
+
+  it("caps total retained events across all streams, not per stream", async () => {
+    const store = new InMemoryEventStore({ maxEvents: 4 });
+
+    for (let i = 0; i < 3; i++) {
+      await store.storeEvent("stream-a", {
+        id: i,
+        jsonrpc: "2.0",
+        method: `a/${i}`,
+      });
+      await new Promise((resolve) => setTimeout(resolve, 1));
+    }
+    for (let i = 0; i < 3; i++) {
+      await store.storeEvent("stream-b", {
+        id: i,
+        jsonrpc: "2.0",
+        method: `b/${i}`,
+      });
+      await new Promise((resolve) => setTimeout(resolve, 1));
+    }
+
+    // 6 events were stored across two streams; the store-wide cap still holds.
+    expect(store.size).toBe(4);
+  });
+
+  it("defaults to a bounded size when maxEvents is not configured", async () => {
+    const store = new InMemoryEventStore();
+    const streamId = "default-cap-stream";
+
+    for (let i = 0; i < 1010; i++) {
+      await store.storeEvent(streamId, {
+        id: i,
+        jsonrpc: "2.0",
+        method: "tools/list",
+      });
+    }
+
+    expect(store.size).toBe(1000);
+  });
+
+  it("rejects a non-positive maxEvents", () => {
+    expect(() => new InMemoryEventStore({ maxEvents: 0 })).toThrow(
+      /maxEvents must be at least 1/,
+    );
+    expect(() => new InMemoryEventStore({ maxEvents: -1 })).toThrow(
+      /maxEvents must be at least 1/,
+    );
+  });
+
+  it("rejects a NaN maxEvents instead of silently disabling eviction", () => {
+    // A naive `maxEvents < 1` check lets NaN through (every comparison with
+    // NaN is false), which would make `size > maxEvents` never trigger and
+    // silently reintroduce unbounded growth.
+    expect(() => new InMemoryEventStore({ maxEvents: NaN })).toThrow(
+      /maxEvents must be at least 1/,
+    );
+  });
 });

package/src/InMemoryEventStore.ts

@@ -6,17 +6,56 @@
 import type { EventStore } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 
+// A stream accumulates one event per server->client message (e.g. every
+// tool call on a stateful session opens its own stream). With no cap, a
+// single long-lived session climbs without bound - see
+// https://github.com/punkpeye/mcp-proxy/issues/72.
+const DEFAULT_MAX_EVENTS = 1000;
+
+export interface InMemoryEventStoreOptions {
+  /**
+   * Maximum number of events retained across all streams before the oldest
+   * are evicted (FIFO). Bounds memory use; older reconnect attempts beyond
+   * this window fall back to a fresh (non-resumed) stream instead of a replay.
+   *
+   * @default 1000
+   */
+  maxEvents?: number;
+}
+
 /**
  * Simple in-memory implementation of the EventStore interface for resumability
  * This is primarily intended for examples and testing, not for production use
  * where a persistent storage solution would be more appropriate.
  */
 export class InMemoryEventStore implements EventStore {
+  /**
+   * The number of events currently retained (for observability/testing).
+   */
+  get size(): number {
+    return this.events.size;
+  }
   private events: Map<string, { message: JSONRPCMessage; streamId: string }> =
     new Map();
   private lastTimestamp = 0;
   private lastTimestampCounter = 0;
 
+  private readonly maxEvents: number;
+
+  constructor(options: InMemoryEventStoreOptions = {}) {
+    const maxEvents = options.maxEvents ?? DEFAULT_MAX_EVENTS;
+
+    // Written as `!(maxEvents >= 1)` rather than `maxEvents < 1` so NaN
+    // (every comparison with NaN is false) is rejected too - otherwise
+    // `size > maxEvents` would never trigger eviction and silently
+    // reintroduce unbounded growth.
+    if (!(maxEvents >= 1)) {
+      throw new Error("maxEvents must be at least 1");
+    }
+
+    this.maxEvents = maxEvents;
+  }
+
   /**
    * Replays events that occurred after a specific event ID
    * Implements EventStore.replayEventsAfter
@@ -77,6 +116,18 @@ export class InMemoryEventStore implements EventStore {
 
     this.events.set(eventId, { message, streamId });
 
+    // Map iterates in insertion order, so the first key is always the
+    // oldest surviving event - evicting it is a plain FIFO/ring buffer.
+    while (this.events.size > this.maxEvents) {
+      const oldestEventId = this.events.keys().next().value;
+
+      if (oldestEventId === undefined) {
+        break;
+      }
+
+      this.events.delete(oldestEventId);
+    }
+
     return eventId;
   }
 

package/src/bin/mcp-proxy.ts

@@ -14,7 +14,6 @@ import { hideBin } from "yargs/helpers";
 const require = createRequire(import.meta.url);
 const packageJson = require("../../package.json") as { version: string };
 
-import { InMemoryEventStore } from "../InMemoryEventStore.js";
 import { proxyServer } from "../proxyServer.js";
 import { SSEServer, startHTTPServer } from "../startHTTPServer.js";
 import { StdioClientTransport } from "../StdioClientTransport.js";
@@ -70,6 +69,18 @@ const argv = await yargs(hideBin(process.argv))
       describe: "The endpoint to listen on",
       type: "string",
     },
+    eventStore: {
+      default: true,
+      describe:
+        "Enable the streamable HTTP transport's resumability event store, which lets clients replay missed messages after a reconnect. Use --no-eventStore to disable it entirely for request/response-only deployments that don't need this and would rather avoid the memory overhead",
+      type: "boolean",
+    },
+    eventStoreMaxEvents: {
+      default: 1000,
+      describe:
+        "Maximum number of buffered events the resumability event store retains (per session) before it evicts the oldest; bounds memory use. Ignored when --no-eventStore is set",
+      type: "number",
+    },
     gracefulShutdownTimeout: {
       default: 5000,
       describe: "The timeout (in milliseconds) for graceful shutdown",
@@ -149,6 +160,13 @@ const argv = await yargs(hideBin(process.argv))
   .help()
   .parseAsync();
 
+if (!(argv.eventStoreMaxEvents >= 1)) {
+  console.error(
+    `Error: --eventStoreMaxEvents must be a number >= 1 (got ${String(argv.eventStoreMaxEvents)}). Use --no-eventStore to disable the event store instead.`,
+  );
+  process.exit(1);
+}
+
 // Default Access-Control-Allow-Headers list — must stay in sync with
 // `defaultCorsOptions.allowedHeaders` in src/startHTTPServer.ts.
 const DEFAULT_ALLOWED_HEADERS = [
@@ -248,7 +266,8 @@ const proxy = async () => {
     apiKey: argv.apiKey,
     cors: corsOption,
     createServer,
-    eventStore: new InMemoryEventStore(),
+    eventStore: argv.eventStore ? undefined : false,
+    eventStoreMaxEvents: argv.eventStoreMaxEvents,
     host: argv.host,
     keepAliveTimeout: argv.keepAliveTimeout,
     port: argv.port,

package/src/index.ts

@@ -1,8 +1,9 @@
 export type { AuthConfig } from "./authentication.js";
 export { AuthenticationMiddleware } from "./authentication.js";
+export type { InMemoryEventStoreOptions } from "./InMemoryEventStore.js";
 export { InMemoryEventStore } from "./InMemoryEventStore.js";
 export { proxyServer } from "./proxyServer.js";
-export type { CorsOptions } from "./startHTTPServer.js";
+export type { CorsOptions, EventStoreOption } from "./startHTTPServer.js";
 export { startHTTPServer } from "./startHTTPServer.js";
 export { ServerType, startStdioServer } from "./startStdioServer.js";
 export { tapTransport } from "./tapTransport.js";

package/src/startHTTPServer.test.ts

@@ -2597,3 +2597,78 @@ it("DELETE request to non-existent session returns 400", async () => {
   await httpServer.close();
   await stdioClient.close();
 }, 15000);
+
+// The SDK only writes a resumability "priming event" (an `id: <eventId>`
+// SSE line) when an event store is configured, so its presence/absence is a
+// reliable, wire-level signal of whether resumability is actually active -
+// see https://github.com/punkpeye/mcp-proxy/issues/72.
+const initializeAndGetRawBody = async (port: number) => {
+  const response = await fetch(`http://localhost:${port}/mcp`, {
+    body: JSON.stringify({
+      id: 1,
+      jsonrpc: "2.0",
+      method: "initialize",
+      params: {
+        capabilities: {},
+        clientInfo: { name: "test", version: "1.0.0" },
+        // Priming events are only sent to clients whose negotiated protocol
+        // version is >= 2025-11-25.
+        protocolVersion: "2025-11-25",
+      },
+    }),
+    headers: {
+      Accept: "application/json, text/event-stream",
+      "Content-Type": "application/json",
+    },
+    method: "POST",
+  });
+
+  expect(response.status).toBe(200);
+
+  return response.text();
+};
+
+it("disables the resumability event store when eventStore: false is passed", async () => {
+  const port = await getRandomPort();
+
+  const httpServer = await startHTTPServer({
+    createServer: async () => {
+      return new Server(
+        { name: "test", version: "1.0.0" },
+        { capabilities: {} },
+      );
+    },
+    eventStore: false,
+    port,
+  });
+
+  try {
+    const body = await initializeAndGetRawBody(port);
+
+    expect(body).not.toMatch(/^id: /m);
+  } finally {
+    await httpServer.close();
+  }
+});
+
+it("enables a bounded, per-session resumability event store by default", async () => {
+  const port = await getRandomPort();
+
+  const httpServer = await startHTTPServer({
+    createServer: async () => {
+      return new Server(
+        { name: "test", version: "1.0.0" },
+        { capabilities: {} },
+      );
+    },
+    port,
+  });
+
+  try {
+    const body = await initializeAndGetRawBody(port);
+
+    expect(body).toMatch(/^id: /m);
+  } finally {
+    await httpServer.close();
+  }
+});

package/src/startHTTPServer.ts

@@ -18,6 +18,25 @@ import { InMemoryEventStore } from "./InMemoryEventStore.js";
 
 const DEFAULT_KEEP_ALIVE_TIMEOUT = 300_000;
 
+/**
+ * `false` disables the resumability event store entirely (no replay-on-
+ * reconnect, no retained state). Omitted/`undefined` creates a fresh,
+ * bounded `InMemoryEventStore` per session - see `eventStoreMaxEvents`.
+ * Pass an `EventStore` instance to use a shared or custom-backed store.
+ */
+export type EventStoreOption = EventStore | false;
+
+const resolveEventStore = (
+  eventStore: EventStoreOption | undefined,
+  maxEvents: number | undefined,
+): EventStore | undefined => {
+  if (eventStore === false) {
+    return undefined;
+  }
+
+  return eventStore ?? new InMemoryEventStore({ maxEvents });
+};
+
 export interface CorsOptions {
   allowedHeaders?: string | string[]; // Allow string[] or '*' for wildcard
   credentials?: boolean;
@@ -381,6 +400,7 @@ const handleStreamRequest = async <T extends ServerLike>({
   enableJsonResponse,
   endpoint,
   eventStore,
+  eventStoreMaxEvents,
   oauth,
   onClose,
   onConnect,
@@ -397,7 +417,8 @@ const handleStreamRequest = async <T extends ServerLike>({
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
   endpoint: string;
-  eventStore?: EventStore;
+  eventStore?: EventStoreOption;
+  eventStoreMaxEvents?: number;
   oauth?: AuthConfig["oauth"];
   onClose?: (server: T) => Promise<void>;
   onConnect?: (server: T) => Promise<void>;
@@ -543,7 +564,7 @@ const handleStreamRequest = async <T extends ServerLike>({
         // Create a new transport for the session
         transport = new StreamableHTTPServerTransport({
           enableJsonResponse,
-          eventStore: eventStore || new InMemoryEventStore(),
+          eventStore: resolveEventStore(eventStore, eventStoreMaxEvents),
           onsessioninitialized: (_sessionId) => {
             // add only when the id Session id is generated (skip in stateless mode)
             if (!stateless && _sessionId) {
@@ -637,7 +658,7 @@ const handleStreamRequest = async <T extends ServerLike>({
         // In stateless mode, handle non-initialize requests by creating a new transport
         transport = new StreamableHTTPServerTransport({
           enableJsonResponse,
-          eventStore: eventStore || new InMemoryEventStore(),
+          eventStore: resolveEventStore(eventStore, eventStoreMaxEvents),
           onsessioninitialized: () => {
             // No session tracking in stateless mode
           },
@@ -979,6 +1000,7 @@ export const startHTTPServer = async <T extends ServerLike>({
   createServer,
   enableJsonResponse,
   eventStore,
+  eventStoreMaxEvents,
   host = "::",
   keepAliveTimeout = DEFAULT_KEEP_ALIVE_TIMEOUT,
   oauth,
@@ -998,7 +1020,22 @@ export const startHTTPServer = async <T extends ServerLike>({
   cors?: boolean | CorsOptions;
   createServer: (request: http.IncomingMessage) => Promise<T>;
   enableJsonResponse?: boolean;
-  eventStore?: EventStore;
+  /**
+   * Event store for the streamable HTTP transport's resumability support.
+   * Pass `false` to disable resumability entirely (recommended for
+   * request/response-only deployments that don't need replay-on-reconnect).
+   * Omit to get a fresh, bounded `InMemoryEventStore` per session - see
+   * `eventStoreMaxEvents`. Pass an `EventStore` instance to bring your own
+   * (e.g. a persistent, cross-process store); it will be shared across all
+   * sessions handled by this server.
+   */
+  eventStore?: EventStoreOption;
+  /**
+   * Caps how many events the auto-created per-session `InMemoryEventStore`
+   * retains (oldest evicted first) before it's overridden by an explicit
+   * `eventStore`. Bounds memory for long-lived sessions. Default: 1000.
+   */
+  eventStoreMaxEvents?: number;
   host?: string;
   keepAliveTimeout?: number;
   oauth?: AuthConfig["oauth"];
@@ -1107,6 +1144,7 @@ export const startHTTPServer = async <T extends ServerLike>({
         enableJsonResponse,
         endpoint: streamEndpoint,
         eventStore,
+        eventStoreMaxEvents,
         oauth,
         onClose,
         onConnect,