mcp-use 1.5.0 → 1.5.1-canary.1

package/dist/src/server/index.js

@@ -70,7 +70,8 @@ function createAppsSdkResource(uri, htmlTemplate, metadata) {
 }
 __name(createAppsSdkResource, "createAppsSdkResource");
 function createUIResourceFromDefinition(definition, params, config) {
-  const uri = definition.type === "appsSdk" ? `ui://widget/${definition.name}.html` : `ui://widget/${definition.name}`;
+  const buildIdPart = config.buildId ? `-${config.buildId}` : "";
+  const uri = definition.type === "appsSdk" ? `ui://widget/${definition.name}${buildIdPart}.html` : `ui://widget/${definition.name}${buildIdPart}`;
   const encoding = definition.encoding || "text";
   switch (definition.type) {
     case "externalUrl": {
@@ -262,15 +263,46 @@ async function adaptConnectMiddleware(connectMiddleware, middlewarePath) {
 __name(adaptConnectMiddleware, "adaptConnectMiddleware");
 
 // src/server/logging.ts
+var isDeno = typeof globalThis.Deno !== "undefined";
+function getEnv(key) {
+  if (isDeno) {
+    return globalThis.Deno.env.get(key);
+  }
+  return typeof process !== "undefined" && process.env ? process.env[key] : void 0;
+}
+__name(getEnv, "getEnv");
+function isDebugMode() {
+  const debugEnv = getEnv("DEBUG");
+  return debugEnv !== void 0 && debugEnv !== "" && debugEnv !== "0" && debugEnv.toLowerCase() !== "false";
+}
+__name(isDebugMode, "isDebugMode");
+function formatForLogging(obj) {
+  try {
+    return JSON.stringify(obj, null, 2);
+  } catch {
+    return String(obj);
+  }
+}
+__name(formatForLogging, "formatForLogging");
 async function requestLogger(c, next) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().substring(11, 23);
   const method = c.req.method;
   const url = c.req.url;
-  let body = null;
-  if (method === "POST" && url.includes("/mcp")) {
+  const debugMode = isDebugMode();
+  let requestBody = null;
+  let requestHeaders = {};
+  if (debugMode) {
+    const allHeaders = c.req.header();
+    if (allHeaders) {
+      requestHeaders = allHeaders;
+    }
+  }
+  if (method !== "GET" && method !== "HEAD") {
     try {
       const clonedRequest = c.req.raw.clone();
-      body = await clonedRequest.json().catch(() => null);
+      requestBody = await clonedRequest.json().catch(() => {
+        return clonedRequest.text().catch(() => null);
+      });
     } catch {
     }
   }
@@ -287,26 +319,89 @@ async function requestLogger(c, next) {
     statusColor = "\x1B[35m";
   }
   let logMessage = `[${timestamp}] ${method} \x1B[1m${new URL(url).pathname}\x1B[0m`;
-  if (method === "POST" && url.includes("/mcp") && body?.method) {
-    logMessage += ` \x1B[1m[${body.method}]\x1B[0m`;
+  if (method === "POST" && url.includes("/mcp") && requestBody?.method) {
+    logMessage += ` \x1B[1m[${requestBody.method}]\x1B[0m`;
   }
   logMessage += ` ${statusColor}${statusCode}\x1B[0m`;
   console.log(logMessage);
+  if (debugMode) {
+    console.log("\n\x1B[36m" + "=".repeat(80) + "\x1B[0m");
+    console.log("\x1B[1m\x1B[36m[DEBUG] Request Details\x1B[0m");
+    console.log("\x1B[36m" + "-".repeat(80) + "\x1B[0m");
+    if (Object.keys(requestHeaders).length > 0) {
+      console.log("\x1B[33mRequest Headers:\x1B[0m");
+      console.log(formatForLogging(requestHeaders));
+    }
+    if (requestBody !== null) {
+      console.log("\x1B[33mRequest Body:\x1B[0m");
+      if (typeof requestBody === "string") {
+        console.log(requestBody);
+      } else {
+        console.log(formatForLogging(requestBody));
+      }
+    }
+    const responseHeaders = {};
+    c.res.headers.forEach((value, key) => {
+      responseHeaders[key] = value;
+    });
+    if (Object.keys(responseHeaders).length > 0) {
+      console.log("\x1B[33mResponse Headers:\x1B[0m");
+      console.log(formatForLogging(responseHeaders));
+    }
+    try {
+      if (c.res.body !== null && c.res.body !== void 0) {
+        try {
+          const clonedResponse = c.res.clone();
+          const responseBody = await clonedResponse.text().catch(() => null);
+          if (responseBody !== null && responseBody.length > 0) {
+            console.log("\x1B[33mResponse Body:\x1B[0m");
+            try {
+              const jsonBody = JSON.parse(responseBody);
+              console.log(formatForLogging(jsonBody));
+            } catch {
+              const maxLength = 1e4;
+              if (responseBody.length > maxLength) {
+                console.log(
+                  responseBody.substring(0, maxLength) + `
+... (truncated, ${responseBody.length - maxLength} more characters)`
+                );
+              } else {
+                console.log(responseBody);
+              }
+            }
+          } else {
+            console.log("\x1B[33mResponse Body:\x1B[0m (empty)");
+          }
+        } catch (cloneError) {
+          console.log("\x1B[33mResponse Body:\x1B[0m (unable to clone/read)");
+        }
+      } else {
+        console.log("\x1B[33mResponse Body:\x1B[0m (no body)");
+      }
+    } catch (error) {
+      console.log("\x1B[33mResponse Body:\x1B[0m (unable to read)");
+    }
+    console.log("\x1B[36m" + "=".repeat(80) + "\x1B[0m\n");
+  }
 }
 __name(requestLogger, "requestLogger");
 
 // src/server/mcp-server.ts
+function generateUUID() {
+  return globalThis.crypto.randomUUID();
+}
+__name(generateUUID, "generateUUID");
 var TMP_MCP_USE_DIR = ".mcp-use";
-var isDeno = typeof globalThis.Deno !== "undefined";
-function getEnv(key) {
-  if (isDeno) {
+var isDeno2 = typeof globalThis.Deno !== "undefined";
+function getEnv2(key) {
+  if (isDeno2) {
     return globalThis.Deno.env.get(key);
   }
   return process.env[key];
 }
-__name(getEnv, "getEnv");
+__name(getEnv2, "getEnv");
 function getCwd() {
-  if (isDeno) {
+  if (isDeno2) {
     return globalThis.Deno.cwd();
   }
   return process.cwd();
@@ -314,7 +409,7 @@ function getCwd() {
 __name(getCwd, "getCwd");
 var fsHelpers = {
   async readFileSync(path, encoding = "utf8") {
-    if (isDeno) {
+    if (isDeno2) {
       return await globalThis.Deno.readTextFile(path);
     }
     const { readFileSync } = await import("fs");
@@ -322,7 +417,7 @@ var fsHelpers = {
     return typeof result === "string" ? result : result.toString(encoding);
   },
   async readFile(path) {
-    if (isDeno) {
+    if (isDeno2) {
       const data = await globalThis.Deno.readFile(path);
       return data.buffer;
     }
@@ -334,7 +429,7 @@ var fsHelpers = {
     );
   },
   async existsSync(path) {
-    if (isDeno) {
+    if (isDeno2) {
       try {
         await globalThis.Deno.stat(path);
         return true;
@@ -346,7 +441,7 @@ var fsHelpers = {
     return existsSync(path);
   },
   async readdirSync(path) {
-    if (isDeno) {
+    if (isDeno2) {
       const entries = [];
       for await (const entry of globalThis.Deno.readDir(path)) {
         entries.push(entry.name);
@@ -359,7 +454,7 @@ var fsHelpers = {
 };
 var pathHelpers = {
   join(...paths) {
-    if (isDeno) {
+    if (isDeno2) {
       return paths.join("/").replace(/\/+/g, "/");
     }
     return paths.join("/").replace(/\/+/g, "/");
@@ -391,6 +486,9 @@ var McpServer = class {
   registeredTools = [];
   registeredPrompts = [];
   registeredResources = [];
+  buildId;
+  sessions = /* @__PURE__ */ new Map();
+  idleCleanupInterval;
   /**
    * Creates a new MCP server instance with Hono integration
    *
@@ -423,7 +521,9 @@ var McpServer = class {
           "mcp-session-id",
           "X-Proxy-Token",
           "X-Target-URL"
-        ]
+        ],
+        // Expose mcp-session-id so browser clients can read it from responses
+        exposeHeaders: ["mcp-session-id"]
       })
     );
     this.app.use("*", requestLogger);
@@ -486,7 +586,7 @@ var McpServer = class {
     if (this.serverBaseUrl) {
       return this.serverBaseUrl;
     }
-    const mcpUrl = getEnv("MCP_URL");
+    const mcpUrl = getEnv2("MCP_URL");
     if (mcpUrl) {
       return mcpUrl;
     }
@@ -663,6 +763,11 @@ var McpServer = class {
    */
   tool(toolDefinition) {
     const inputSchema = this.createParamsSchema(toolDefinition.inputs || []);
+    const context = {
+      sample: /* @__PURE__ */ __name(async (params, options) => {
+        return await this.createMessage(params, options);
+      }, "sample")
+    };
     this.server.registerTool(
       toolDefinition.name,
       {
@@ -673,6 +778,9 @@ var McpServer = class {
         _meta: toolDefinition._meta
       },
       async (params) => {
+        if (toolDefinition.cb.length >= 2) {
+          return await toolDefinition.cb(params, context);
+        }
         return await toolDefinition.cb(params);
       }
     );
@@ -729,6 +837,46 @@ var McpServer = class {
     this.registeredPrompts.push(promptDefinition.name);
     return this;
   }
+  /**
+   * Request LLM sampling from connected clients.
+   *
+   * This method allows server tools to request LLM completions from clients
+   * that support the sampling capability. The client will handle model selection,
+   * user approval (human-in-the-loop), and return the generated response.
+   *
+   * @param params - Sampling request parameters including messages, model preferences, etc.
+   * @param options - Optional request options (timeouts, cancellation, etc.)
+   * @returns Promise resolving to the generated message from the client's LLM
+   *
+   * @example
+   * ```typescript
+   * // In a tool callback
+   * server.tool({
+   *   name: 'analyze-sentiment',
+   *   description: 'Analyze sentiment using LLM',
+   *   inputs: [{ name: 'text', type: 'string', required: true }],
+   *   cb: async (params, ctx) => {
+   *     const result = await ctx.sample({
+   *       messages: [{
+   *         role: 'user',
+   *         content: { type: 'text', text: `Analyze sentiment: ${params.text}` }
+   *       }],
+   *       modelPreferences: {
+   *         intelligencePriority: 0.8,
+   *         speedPriority: 0.5
+   *       }
+   *     });
+   *     return {
+   *       content: [{ type: 'text', text: result.content.text }]
+   *     };
+   *   }
+   * })
+   * ```
+   */
+  async createMessage(params, options) {
+    console.log("createMessage", params, options);
+    return await this.server.server.createMessage(params, options);
+  }
   /**
    * Register a UI widget as both a tool and a resource
    *
@@ -802,19 +950,19 @@ var McpServer = class {
     let mimeType;
     switch (definition.type) {
       case "externalUrl":
-        resourceUri = `ui://widget/${definition.widget}`;
+        resourceUri = this.generateWidgetUri(definition.widget);
         mimeType = "text/uri-list";
         break;
       case "rawHtml":
-        resourceUri = `ui://widget/${definition.name}`;
+        resourceUri = this.generateWidgetUri(definition.name);
         mimeType = "text/html";
         break;
       case "remoteDom":
-        resourceUri = `ui://widget/${definition.name}`;
+        resourceUri = this.generateWidgetUri(definition.name);
         mimeType = "application/vnd.mcp-ui.remote-dom+javascript";
         break;
       case "appsSdk":
-        resourceUri = `ui://widget/${definition.name}.html`;
+        resourceUri = this.generateWidgetUri(definition.name, ".html");
         mimeType = "text/html+skybridge";
         break;
       default:
@@ -833,16 +981,19 @@ var McpServer = class {
       readCallback: /* @__PURE__ */ __name(async () => {
         const params = definition.type === "externalUrl" ? this.applyDefaultProps(definition.props) : {};
         const uiResource = this.createWidgetUIResource(definition, params);
+        uiResource.resource.uri = resourceUri;
         return {
           contents: [uiResource.resource]
         };
       }, "readCallback")
     });
     if (definition.type === "appsSdk") {
+      const buildIdPart = this.buildId ? `-${this.buildId}` : "";
+      const uriTemplate = `ui://widget/${definition.name}${buildIdPart}-{id}.html`;
       this.resourceTemplate({
         name: `${definition.name}-dynamic`,
         resourceTemplate: {
-          uriTemplate: `ui://widget/${definition.name}-{id}.html`,
+          uriTemplate,
           name: definition.title || definition.name,
           description: definition.description,
           mimeType
@@ -853,6 +1004,7 @@ var McpServer = class {
         annotations: definition.annotations,
         readCallback: /* @__PURE__ */ __name(async (uri, params) => {
           const uiResource = this.createWidgetUIResource(definition, {});
+          uiResource.resource.uri = uri.toString();
           return {
             contents: [uiResource.resource]
           };
@@ -884,7 +1036,11 @@ var McpServer = class {
         const uiResource = this.createWidgetUIResource(definition, params);
         if (definition.type === "appsSdk") {
           const randomId = Math.random().toString(36).substring(2, 15);
-          const uniqueUri = `ui://widget/${definition.name}-${randomId}.html`;
+          const uniqueUri = this.generateWidgetUri(
+            definition.name,
+            ".html",
+            randomId
+          );
           const uniqueToolMetadata = {
             ...toolMetadata,
             "openai/outputTemplate": uniqueUri
@@ -941,7 +1097,8 @@ var McpServer = class {
     }
     const urlConfig = {
       baseUrl: configBaseUrl,
-      port: configPort
+      port: configPort,
+      buildId: this.buildId
     };
     const uiResource = createUIResourceFromDefinition(
       definition,
@@ -956,6 +1113,25 @@ var McpServer = class {
     }
     return uiResource;
   }
+  /**
+   * Generate a widget URI with optional build ID for cache busting
+   *
+   * @private
+   * @param widgetName - Widget name/identifier
+   * @param extension - Optional file extension (e.g., '.html')
+   * @param suffix - Optional suffix (e.g., random ID for dynamic URIs)
+   * @returns Widget URI with build ID if available
+   */
+  generateWidgetUri(widgetName, extension = "", suffix = "") {
+    const parts = [widgetName];
+    if (this.buildId) {
+      parts.push(this.buildId);
+    }
+    if (suffix) {
+      parts.push(suffix);
+    }
+    return `ui://widget/${parts.join("-")}${extension}`;
+  }
   /**
    * Build a complete URL for a widget including query parameters
    *
@@ -1032,7 +1208,7 @@ var McpServer = class {
    * @returns true if in production mode, false otherwise
    */
   isProductionMode() {
-    return getEnv("NODE_ENV") === "production";
+    return getEnv2("NODE_ENV") === "production";
   }
   /**
    * Read build manifest file
@@ -1043,7 +1219,7 @@ var McpServer = class {
   async readBuildManifest() {
     try {
       const manifestPath = pathHelpers.join(
-        isDeno ? "." : getCwd(),
+        isDeno2 ? "." : getCwd(),
         "dist",
         "mcp-use.json"
       );
@@ -1065,7 +1241,7 @@ var McpServer = class {
    * @returns Promise that resolves when all widgets are mounted
    */
   async mountWidgets(options) {
-    if (this.isProductionMode() || isDeno) {
+    if (this.isProductionMode() || isDeno2) {
       console.log("[WIDGETS] Mounting widgets in production mode");
       await this.mountWidgetsProduction(options);
     } else {
@@ -1485,7 +1661,7 @@ if (container && Component) {
   async mountWidgetsProduction(options) {
     const baseRoute = options?.baseRoute || "/mcp-use/widgets";
     const widgetsDir = pathHelpers.join(
-      isDeno ? "." : getCwd(),
+      isDeno2 ? "." : getCwd(),
       "dist",
       "resources",
       "widgets"
@@ -1501,6 +1677,10 @@ if (container && Component) {
         "utf8"
       );
       const manifest = JSON.parse(manifestContent);
+      if (manifest.buildId && typeof manifest.buildId === "string") {
+        this.buildId = manifest.buildId;
+        console.log(`[WIDGETS] Build ID: ${this.buildId}`);
+      }
       if (manifest.widgets && typeof manifest.widgets === "object" && !Array.isArray(manifest.widgets)) {
         widgets = Object.keys(manifest.widgets);
         widgetsMetadata = manifest.widgets;
@@ -1633,6 +1813,7 @@ if (container && Component) {
             resource_domains: [
               "https://*.oaistatic.com",
               "https://*.oaiusercontent.com",
+              "https://*.openai.com",
               // always also add the base url of the server
               ...this.getServerBaseUrl() ? [this.getServerBaseUrl()] : [],
               ...metadata.appsSdkMetadata?.["openai/widgetCSP"]?.resource_domains || []
@@ -1665,12 +1846,11 @@ if (container && Component) {
     });
   }
   /**
-   * Mount MCP server endpoints at /mcp
+   * Mount MCP server endpoints at /mcp and /sse
    *
    * Sets up the HTTP transport layer for the MCP server, creating endpoints for
    * Server-Sent Events (SSE) streaming, POST message handling, and DELETE session cleanup.
-   * Each request gets its own transport instance to prevent state conflicts between
-   * concurrent client connections.
+   * Transports are reused per session ID to maintain state across requests.
    *
    * This method is called automatically when the server starts listening and ensures
    * that MCP clients can communicate with the server over HTTP.
@@ -1680,14 +1860,91 @@ if (container && Component) {
    *
    * @example
    * Endpoints created:
-   * - GET /mcp - SSE streaming endpoint for real-time communication
-   * - POST /mcp - Message handling endpoint for MCP protocol messages
-   * - DELETE /mcp - Session cleanup endpoint
+   * - GET /mcp, GET /sse - SSE streaming endpoint for real-time communication
+   * - POST /mcp, POST /sse - Message handling endpoint for MCP protocol messages
+   * - DELETE /mcp, DELETE /sse - Session cleanup endpoint
    */
   async mountMcp() {
     if (this.mcpMounted) return;
     const { StreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/streamableHttp.js");
-    const endpoint = "/mcp";
+    const idleTimeoutMs = this.config.sessionIdleTimeoutMs ?? 3e5;
+    const createNewTransport = /* @__PURE__ */ __name(async (closeOldSessionId) => {
+      if (closeOldSessionId && this.sessions.has(closeOldSessionId)) {
+        try {
+          this.sessions.get(closeOldSessionId).transport.close();
+        } catch (error) {
+        }
+        this.sessions.delete(closeOldSessionId);
+      }
+      const isProduction = this.isProductionMode();
+      let allowedOrigins = this.config.allowedOrigins;
+      let enableDnsRebindingProtection = false;
+      if (isProduction) {
+        if (allowedOrigins !== void 0) {
+          enableDnsRebindingProtection = allowedOrigins.length > 0;
+        }
+      } else {
+        allowedOrigins = void 0;
+        enableDnsRebindingProtection = false;
+      }
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: /* @__PURE__ */ __name(() => generateUUID(), "sessionIdGenerator"),
+        enableJsonResponse: true,
+        allowedOrigins,
+        enableDnsRebindingProtection,
+        onsessioninitialized: /* @__PURE__ */ __name((id) => {
+          if (id) {
+            this.sessions.set(id, {
+              transport,
+              lastAccessedAt: Date.now()
+            });
+          }
+        }, "onsessioninitialized"),
+        onsessionclosed: /* @__PURE__ */ __name((id) => {
+          if (id) {
+            this.sessions.delete(id);
+          }
+        }, "onsessionclosed")
+      });
+      await this.server.connect(transport);
+      return transport;
+    }, "createNewTransport");
+    const getOrCreateTransport = /* @__PURE__ */ __name(async (sessionId, isInit = false) => {
+      if (isInit) {
+        return await createNewTransport(sessionId);
+      }
+      if (sessionId && this.sessions.has(sessionId)) {
+        const session = this.sessions.get(sessionId);
+        session.lastAccessedAt = Date.now();
+        return session.transport;
+      }
+      if (sessionId) {
+        const autoCreate = this.config.autoCreateSessionOnInvalidId ?? true;
+        if (autoCreate) {
+          console.warn(
+            `[MCP] Session ${sessionId} not found (expired or invalid), auto-creating new session for seamless reconnection`
+          );
+          return await createNewTransport(sessionId);
+        } else {
+          return null;
+        }
+      }
+      return null;
+    }, "getOrCreateTransport");
+    if (idleTimeoutMs > 0 && !this.idleCleanupInterval) {
+      this.idleCleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [sessionId, session] of this.sessions.entries()) {
+          if (now - session.lastAccessedAt > idleTimeoutMs) {
+            try {
+              session.transport.close();
+            } catch (error) {
+            }
+            this.sessions.delete(sessionId);
+          }
+        }
+      }, 6e4);
+    }
     const createExpressLikeObjects = /* @__PURE__ */ __name((c) => {
       const req = c.req.raw;
       const responseBody = [];
@@ -1779,7 +2036,7 @@ if (container && Component) {
         getResponse: /* @__PURE__ */ __name(() => {
           if (ended) {
             if (responseBody.length > 0) {
-              const body = isDeno ? Buffer.concat(responseBody) : Buffer.concat(responseBody);
+              const body = isDeno2 ? Buffer.concat(responseBody) : Buffer.concat(responseBody);
               return new Response(body, {
                 status: statusCode,
                 headers
@@ -1795,164 +2052,250 @@ if (container && Component) {
         }, "getResponse")
       };
     }, "createExpressLikeObjects");
-    this.app.post(endpoint, async (c) => {
-      const { expressReq, expressRes, getResponse } = createExpressLikeObjects(c);
-      try {
-        expressReq.body = await c.req.json();
-      } catch {
-        expressReq.body = {};
-      }
-      const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: void 0,
-        enableJsonResponse: true
+    const mountEndpoint = /* @__PURE__ */ __name((endpoint) => {
+      this.app.post(endpoint, async (c) => {
+        const { expressReq, expressRes, getResponse } = createExpressLikeObjects(c);
+        let body = {};
+        try {
+          body = await c.req.json();
+          expressReq.body = body;
+        } catch {
+          expressReq.body = {};
+        }
+        const isInit = body?.method === "initialize";
+        const sessionId = c.req.header("mcp-session-id");
+        const transport = await getOrCreateTransport(sessionId, isInit);
+        if (!transport) {
+          if (sessionId) {
+            return c.json(
+              {
+                jsonrpc: "2.0",
+                error: {
+                  code: -32e3,
+                  message: "Session not found or expired"
+                },
+                // Notifications don't have an id, but we include null for consistency
+                id: body?.id ?? null
+              },
+              404
+            );
+          } else {
+            return c.json(
+              {
+                jsonrpc: "2.0",
+                error: {
+                  code: -32e3,
+                  message: "Bad Request: Mcp-Session-Id header is required"
+                },
+                id: body?.id ?? null
+              },
+              400
+            );
+          }
+        }
+        if (sessionId && this.sessions.has(sessionId)) {
+          this.sessions.get(sessionId).lastAccessedAt = Date.now();
+        }
+        if (expressRes._closeHandler) {
+          c.req.raw.signal?.addEventListener("abort", () => {
+            transport.close();
+          });
+        }
+        await this.waitForRequestComplete(
+          transport,
+          expressReq,
+          expressRes,
+          expressReq.body
+        );
+        const response = getResponse();
+        if (response) {
+          return response;
+        }
+        return c.text("", 200);
       });
-      if (expressRes._closeHandler) {
+      this.app.get(endpoint, async (c) => {
+        const sessionId = c.req.header("mcp-session-id");
+        const transport = await getOrCreateTransport(sessionId, false);
+        if (!transport) {
+          if (sessionId) {
+            return c.json(
+              {
+                jsonrpc: "2.0",
+                error: {
+                  code: -32e3,
+                  message: "Session not found or expired"
+                },
+                id: null
+              },
+              404
+            );
+          } else {
+            return c.json(
+              {
+                jsonrpc: "2.0",
+                error: {
+                  code: -32e3,
+                  message: "Bad Request: Mcp-Session-Id header is required"
+                },
+                id: null
+              },
+              400
+            );
+          }
+        }
+        if (sessionId && this.sessions.has(sessionId)) {
+          this.sessions.get(sessionId).lastAccessedAt = Date.now();
+        }
         c.req.raw.signal?.addEventListener("abort", () => {
           transport.close();
         });
-      }
-      await this.server.connect(transport);
-      await this.waitForRequestComplete(
-        transport,
-        expressReq,
-        expressRes,
-        expressReq.body
-      );
-      const response = getResponse();
-      if (response) {
-        return response;
-      }
-      return c.text("", 200);
-    });
-    this.app.get(endpoint, async (c) => {
-      const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: void 0,
-        enableJsonResponse: true
-      });
-      c.req.raw.signal?.addEventListener("abort", () => {
-        transport.close();
-      });
-      const { readable, writable } = new globalThis.TransformStream();
-      const writer = writable.getWriter();
-      const encoder = new TextEncoder();
-      let resolveResponse;
-      const responsePromise = new Promise((resolve) => {
-        resolveResponse = resolve;
-      });
-      let headersSent = false;
-      const headers = {};
-      let statusCode = 200;
-      const expressRes = {
-        statusCode: 200,
-        headersSent: false,
-        status: /* @__PURE__ */ __name((code) => {
-          statusCode = code;
-          expressRes.statusCode = code;
-          return expressRes;
-        }, "status"),
-        setHeader: /* @__PURE__ */ __name((name, value) => {
-          if (!headersSent) {
-            headers[name] = Array.isArray(value) ? value.join(", ") : value;
-          }
-        }, "setHeader"),
-        getHeader: /* @__PURE__ */ __name((name) => headers[name], "getHeader"),
-        write: /* @__PURE__ */ __name((chunk) => {
-          if (!headersSent) {
-            headersSent = true;
-            resolveResponse(
-              new Response(readable, {
-                status: statusCode,
-                headers
-              })
-            );
-          }
-          const data = typeof chunk === "string" ? encoder.encode(chunk) : chunk instanceof Uint8Array ? chunk : Buffer.from(chunk);
-          writer.write(data);
-          return true;
-        }, "write"),
-        end: /* @__PURE__ */ __name((chunk) => {
-          if (chunk) {
-            expressRes.write(chunk);
+        const { readable, writable } = new globalThis.TransformStream();
+        const writer = writable.getWriter();
+        const encoder = new TextEncoder();
+        let resolveResponse;
+        const responsePromise = new Promise((resolve) => {
+          resolveResponse = resolve;
+        });
+        let headersSent = false;
+        const headers = {};
+        let statusCode = 200;
+        const expressRes = {
+          statusCode: 200,
+          headersSent: false,
+          status: /* @__PURE__ */ __name((code) => {
+            statusCode = code;
+            expressRes.statusCode = code;
+            return expressRes;
+          }, "status"),
+          setHeader: /* @__PURE__ */ __name((name, value) => {
+            if (!headersSent) {
+              headers[name] = Array.isArray(value) ? value.join(", ") : value;
+            }
+          }, "setHeader"),
+          getHeader: /* @__PURE__ */ __name((name) => headers[name], "getHeader"),
+          write: /* @__PURE__ */ __name((chunk) => {
+            if (!headersSent) {
+              headersSent = true;
+              resolveResponse(
+                new Response(readable, {
+                  status: statusCode,
+                  headers
+                })
+              );
+            }
+            const data = typeof chunk === "string" ? encoder.encode(chunk) : chunk instanceof Uint8Array ? chunk : Buffer.from(chunk);
+            writer.write(data);
+            return true;
+          }, "write"),
+          end: /* @__PURE__ */ __name((chunk) => {
+            if (chunk) {
+              expressRes.write(chunk);
+            }
+            if (!headersSent) {
+              headersSent = true;
+              resolveResponse(
+                new Response(null, {
+                  status: statusCode,
+                  headers
+                })
+              );
+              writer.close();
+            } else {
+              writer.close();
+            }
+          }, "end"),
+          on: /* @__PURE__ */ __name((event, handler) => {
+            if (event === "close") {
+              expressRes._closeHandler = handler;
+            }
+          }, "on"),
+          once: /* @__PURE__ */ __name(() => {
+          }, "once"),
+          removeListener: /* @__PURE__ */ __name(() => {
+          }, "removeListener"),
+          writeHead: /* @__PURE__ */ __name((code, _headers) => {
+            statusCode = code;
+            expressRes.statusCode = code;
+            if (_headers) {
+              Object.assign(headers, _headers);
+            }
+            if (!headersSent) {
+              headersSent = true;
+              resolveResponse(
+                new Response(readable, {
+                  status: statusCode,
+                  headers
+                })
+              );
+            }
+            return expressRes;
+          }, "writeHead"),
+          flushHeaders: /* @__PURE__ */ __name(() => {
+          }, "flushHeaders")
+        };
+        const expressReq = {
+          ...c.req.raw,
+          url: new URL(c.req.url).pathname + new URL(c.req.url).search,
+          path: new URL(c.req.url).pathname,
+          query: Object.fromEntries(new URL(c.req.url).searchParams),
+          headers: c.req.header(),
+          method: c.req.method
+        };
+        transport.handleRequest(expressReq, expressRes).catch((err) => {
+          console.error("MCP Transport error:", err);
+          try {
+            writer.close();
+          } catch {
           }
-          if (!headersSent) {
-            headersSent = true;
-            resolveResponse(
-              new Response(null, {
-                status: statusCode,
-                headers
-              })
+        });
+        return responsePromise;
+      });
+      this.app.delete(endpoint, async (c) => {
+        const { expressReq, expressRes, getResponse } = createExpressLikeObjects(c);
+        const sessionId = c.req.header("mcp-session-id");
+        const transport = await getOrCreateTransport(sessionId, false);
+        if (!transport) {
+          if (sessionId) {
+            return c.json(
+              {
+                jsonrpc: "2.0",
+                error: {
+                  code: -32e3,
+                  message: "Session not found or expired"
+                },
+                id: null
+              },
+              404
             );
-            writer.close();
           } else {
-            writer.close();
-          }
-        }, "end"),
-        on: /* @__PURE__ */ __name((event, handler) => {
-          if (event === "close") {
-            expressRes._closeHandler = handler;
-          }
-        }, "on"),
-        once: /* @__PURE__ */ __name(() => {
-        }, "once"),
-        removeListener: /* @__PURE__ */ __name(() => {
-        }, "removeListener"),
-        writeHead: /* @__PURE__ */ __name((code, _headers) => {
-          statusCode = code;
-          expressRes.statusCode = code;
-          if (_headers) {
-            Object.assign(headers, _headers);
-          }
-          if (!headersSent) {
-            headersSent = true;
-            resolveResponse(
-              new Response(readable, {
-                status: statusCode,
-                headers
-              })
+            return c.json(
+              {
+                jsonrpc: "2.0",
+                error: {
+                  code: -32e3,
+                  message: "Bad Request: Mcp-Session-Id header is required"
+                },
+                id: null
+              },
+              400
             );
           }
-          return expressRes;
-        }, "writeHead"),
-        flushHeaders: /* @__PURE__ */ __name(() => {
-        }, "flushHeaders")
-      };
-      const expressReq = {
-        ...c.req.raw,
-        url: new URL(c.req.url).pathname + new URL(c.req.url).search,
-        path: new URL(c.req.url).pathname,
-        query: Object.fromEntries(new URL(c.req.url).searchParams),
-        headers: c.req.header(),
-        method: c.req.method
-      };
-      await this.server.connect(transport);
-      transport.handleRequest(expressReq, expressRes).catch((err) => {
-        console.error("MCP Transport error:", err);
-        try {
-          writer.close();
-        } catch {
         }
+        c.req.raw.signal?.addEventListener("abort", () => {
+          transport.close();
+        });
+        await this.waitForRequestComplete(transport, expressReq, expressRes);
+        const response = getResponse();
+        if (response) {
+          return response;
+        }
+        return c.text("", 200);
       });
-      return responsePromise;
-    });
-    this.app.delete(endpoint, async (c) => {
-      const { expressReq, expressRes, getResponse } = createExpressLikeObjects(c);
-      const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: void 0,
-        enableJsonResponse: true
-      });
-      c.req.raw.signal?.addEventListener("abort", () => {
-        transport.close();
-      });
-      await this.server.connect(transport);
-      await this.waitForRequestComplete(transport, expressReq, expressRes);
-      const response = getResponse();
-      if (response) {
-        return response;
-      }
-      return c.text("", 200);
-    });
+    }, "mountEndpoint");
+    mountEndpoint("/mcp");
+    mountEndpoint("/sse");
     this.mcpMounted = true;
-    console.log(`[MCP] Server mounted at ${endpoint}`);
+    console.log(`[MCP] Server mounted at /mcp and /sse`);
   }
   /**
    * Start the Hono server with MCP endpoints
@@ -1961,7 +2304,7 @@ if (container && Component) {
    * the inspector UI (if available), and starting the server to listen
    * for incoming connections. This is the main entry point for running the server.
    *
-   * The server will be accessible at the specified port with MCP endpoints at /mcp
+   * The server will be accessible at the specified port with MCP endpoints at /mcp and /sse
    * and inspector UI at /inspector (if the inspector package is installed).
    *
    * @param port - Port number to listen on (defaults to 3001 if not specified)
@@ -1971,7 +2314,7 @@ if (container && Component) {
    * ```typescript
    * await server.listen(8080)
    * // Server now running at http://localhost:8080 (or configured host)
-   * // MCP endpoints: http://localhost:8080/mcp
+   * // MCP endpoints: http://localhost:8080/mcp and http://localhost:8080/sse
    * // Inspector UI: http://localhost:8080/inspector
    * ```
    */
@@ -2001,9 +2344,9 @@ if (container && Component) {
     console.log("");
   }
   async listen(port) {
-    const portEnv = getEnv("PORT");
+    const portEnv = getEnv2("PORT");
     this.serverPort = port || (portEnv ? parseInt(portEnv, 10) : 3001);
-    const hostEnv = getEnv("HOST");
+    const hostEnv = getEnv2("HOST");
     if (hostEnv) {
       this.serverHost = hostEnv;
     }
@@ -2014,7 +2357,7 @@ if (container && Component) {
     await this.mountMcp();
     await this.mountInspector();
     this.logRegisteredItems();
-    if (isDeno) {
+    if (isDeno2) {
       const corsHeaders = {
         "Access-Control-Allow-Origin": "*",
         "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type"
@@ -2075,7 +2418,7 @@ if (container && Component) {
             `[SERVER] Listening on http://${this.serverHost}:${this.serverPort}`
           );
           console.log(
-            `[MCP] Endpoints: http://${this.serverHost}:${this.serverPort}/mcp`
+            `[MCP] Endpoints: http://${this.serverHost}:${this.serverPort}/mcp and http://${this.serverHost}:${this.serverPort}/sse`
           );
         }
       );
@@ -2159,6 +2502,192 @@ if (container && Component) {
       return result;
     };
   }
+  /**
+   * Get array of active session IDs
+   *
+   * Returns an array of all currently active session IDs. This is useful for
+   * sending targeted notifications to specific clients or iterating over
+   * connected clients.
+   *
+   * Note: This only works in stateful mode. In stateless mode (edge environments),
+   * this will return an empty array.
+   *
+   * @returns Array of active session ID strings
+   *
+   * @example
+   * ```typescript
+   * const sessions = server.getActiveSessions();
+   * console.log(`${sessions.length} clients connected`);
+   *
+   * // Send notification to first connected client
+   * if (sessions.length > 0) {
+   *   server.sendNotificationToSession(sessions[0], "custom/hello", { message: "Hi!" });
+   * }
+   * ```
+   */
+  getActiveSessions() {
+    return Array.from(this.sessions.keys());
+  }
+  /**
+   * Send a notification to all connected clients
+   *
+   * Broadcasts a JSON-RPC notification to all active sessions. Notifications are
+   * one-way messages that do not expect a response from the client.
+   *
+   * Note: This only works in stateful mode with active sessions. If no sessions
+   * are connected, the notification is silently discarded (per MCP spec: "server MAY send").
+   *
+   * @param method - The notification method name (e.g., "custom/my-notification")
+   * @param params - Optional parameters to include in the notification
+   *
+   * @example
+   * ```typescript
+   * // Send a simple notification to all clients
+   * server.sendNotification("custom/server-status", {
+   *   status: "ready",
+   *   timestamp: new Date().toISOString()
+   * });
+   *
+   * // Notify all clients that resources have changed
+   * server.sendNotification("notifications/resources/list_changed");
+   * ```
+   */
+  async sendNotification(method, params) {
+    const notification = {
+      jsonrpc: "2.0",
+      method,
+      ...params && { params }
+    };
+    for (const [sessionId, session] of this.sessions.entries()) {
+      try {
+        await session.transport.send(notification);
+      } catch (error) {
+        console.warn(
+          `[MCP] Failed to send notification to session ${sessionId}:`,
+          error
+        );
+      }
+    }
+  }
+  /**
+   * Send a notification to a specific client session
+   *
+   * Sends a JSON-RPC notification to a single client identified by their session ID.
+   * This allows sending customized notifications to individual clients.
+   *
+   * Note: This only works in stateful mode. If the session ID doesn't exist,
+   * the notification is silently discarded.
+   *
+   * @param sessionId - The target session ID (from getActiveSessions())
+   * @param method - The notification method name (e.g., "custom/my-notification")
+   * @param params - Optional parameters to include in the notification
+   * @returns true if the notification was sent, false if session not found
+   *
+   * @example
+   * ```typescript
+   * const sessions = server.getActiveSessions();
+   *
+   * // Send different messages to different clients
+   * sessions.forEach((sessionId, index) => {
+   *   server.sendNotificationToSession(sessionId, "custom/welcome", {
+   *     message: `Hello client #${index + 1}!`,
+   *     clientNumber: index + 1
+   *   });
+   * });
+   * ```
+   */
+  async sendNotificationToSession(sessionId, method, params) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return false;
+    }
+    const notification = {
+      jsonrpc: "2.0",
+      method,
+      ...params && { params }
+    };
+    try {
+      await session.transport.send(notification);
+      return true;
+    } catch (error) {
+      console.warn(
+        `[MCP] Failed to send notification to session ${sessionId}:`,
+        error
+      );
+      return false;
+    }
+  }
+  // Store the roots changed callback
+  onRootsChangedCallback;
+  /**
+   * Register a callback for when a client's roots change
+   *
+   * When a client sends a `notifications/roots/list_changed` notification,
+   * the server will automatically request the updated roots list and call
+   * this callback with the new roots.
+   *
+   * @param callback - Function called with the updated roots array
+   *
+   * @example
+   * ```typescript
+   * server.onRootsChanged(async (roots) => {
+   *   console.log("Client roots updated:", roots);
+   *   roots.forEach(root => {
+   *     console.log(`  - ${root.name || "unnamed"}: ${root.uri}`);
+   *   });
+   * });
+   * ```
+   */
+  onRootsChanged(callback) {
+    this.onRootsChangedCallback = callback;
+    return this;
+  }
+  /**
+   * Request the current roots list from a specific client session
+   *
+   * This sends a `roots/list` request to the client and returns
+   * the list of roots the client has configured.
+   *
+   * @param sessionId - The session ID of the client to query
+   * @returns Array of roots, or null if the session doesn't exist or request fails
+   *
+   * @example
+   * ```typescript
+   * const sessions = server.getActiveSessions();
+   * if (sessions.length > 0) {
+   *   const roots = await server.listRoots(sessions[0]);
+   *   if (roots) {
+   *     console.log(`Client has ${roots.length} roots:`);
+   *     roots.forEach(r => console.log(`  - ${r.uri}`));
+   *   }
+   * }
+   * ```
+   */
+  async listRoots(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return null;
+    }
+    try {
+      const request = {
+        jsonrpc: "2.0",
+        id: generateUUID(),
+        method: "roots/list",
+        params: {}
+      };
+      const response = await session.transport.send(request);
+      if (response && typeof response === "object" && "roots" in response) {
+        return response.roots;
+      }
+      return [];
+    } catch (error) {
+      console.warn(
+        `[MCP] Failed to list roots from session ${sessionId}:`,
+        error
+      );
+      return null;
+    }
+  }
   /**
    * Mount MCP Inspector UI at /inspector
    *
@@ -2175,7 +2704,7 @@ if (container && Component) {
    * @example
    * If @mcp-use/inspector is installed:
    * - Inspector UI available at http://localhost:PORT/inspector
-   * - Automatically connects to http://localhost:PORT/mcp
+   * - Automatically connects to http://localhost:PORT/mcp (or /sse)
    *
    * If not installed:
    * - Server continues to function normally
@@ -2194,7 +2723,14 @@ if (container && Component) {
     }
     try {
       const { mountInspector } = await import("@mcp-use/inspector");
-      mountInspector(this.app);
+      const mcpUrl = `http://${this.serverHost}:${this.serverPort}/mcp`;
+      const autoConnectConfig = JSON.stringify({
+        url: mcpUrl,
+        name: "Local MCP Server",
+        transportType: "sse",
+        connectionType: "Direct"
+      });
+      mountInspector(this.app, { autoConnectUrl: autoConnectConfig });
       this.inspectorMounted = true;
       console.log(
         `[INSPECTOR] UI available at http://${this.serverHost}:${this.serverPort}/inspector`
@@ -2518,7 +3054,9 @@ function createMCPServer(name, config = {}) {
     version: config.version || "1.0.0",
     description: config.description,
     host: config.host,
-    baseUrl: config.baseUrl
+    baseUrl: config.baseUrl,
+    allowedOrigins: config.allowedOrigins,
+    sessionIdleTimeoutMs: config.sessionIdleTimeoutMs
   });
   return instance;
 }