n8n-mcp 2.8.1 → 2.9.1

package/dist/http-server-single-session.js

@@ -7,6 +7,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SingleSessionHTTPServer = void 0;
 const express_1 = __importDefault(require("express"));
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const sse_js_1 = require("@modelcontextprotocol/sdk/server/sse.js");
 const server_1 = require("./mcp/server");
 const console_manager_1 = require("./utils/console-manager");
 const logger_1 = require("./utils/logger");
@@ -14,14 +15,126 @@ const fs_1 = require("fs");
 const dotenv_1 = __importDefault(require("dotenv"));
 const url_detector_1 = require("./utils/url-detector");
 const version_1 = require("./utils/version");
+const uuid_1 = require("uuid");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const protocol_version_1 = require("./utils/protocol-version");
 dotenv_1.default.config();
+const DEFAULT_PROTOCOL_VERSION = protocol_version_1.STANDARD_PROTOCOL_VERSION;
+const MAX_SESSIONS = 100;
+const SESSION_CLEANUP_INTERVAL = 5 * 60 * 1000;
 class SingleSessionHTTPServer {
     constructor() {
+        this.transports = {};
+        this.servers = {};
+        this.sessionMetadata = {};
         this.session = null;
         this.consoleManager = new console_manager_1.ConsoleManager();
         this.sessionTimeout = 30 * 60 * 1000;
         this.authToken = null;
+        this.cleanupTimer = null;
         this.validateEnvironment();
+        this.startSessionCleanup();
+    }
+    startSessionCleanup() {
+        this.cleanupTimer = setInterval(async () => {
+            try {
+                await this.cleanupExpiredSessions();
+            }
+            catch (error) {
+                logger_1.logger.error('Error during session cleanup', error);
+            }
+        }, SESSION_CLEANUP_INTERVAL);
+        logger_1.logger.info('Session cleanup started', {
+            interval: SESSION_CLEANUP_INTERVAL / 1000 / 60,
+            maxSessions: MAX_SESSIONS,
+            sessionTimeout: this.sessionTimeout / 1000 / 60
+        });
+    }
+    cleanupExpiredSessions() {
+        const now = Date.now();
+        const expiredSessions = [];
+        for (const sessionId in this.sessionMetadata) {
+            const metadata = this.sessionMetadata[sessionId];
+            if (now - metadata.lastAccess.getTime() > this.sessionTimeout) {
+                expiredSessions.push(sessionId);
+            }
+        }
+        for (const sessionId of expiredSessions) {
+            this.removeSession(sessionId, 'expired');
+        }
+        if (expiredSessions.length > 0) {
+            logger_1.logger.info('Cleaned up expired sessions', {
+                removed: expiredSessions.length,
+                remaining: this.getActiveSessionCount()
+            });
+        }
+    }
+    async removeSession(sessionId, reason) {
+        try {
+            if (this.transports[sessionId]) {
+                await this.transports[sessionId].close();
+                delete this.transports[sessionId];
+            }
+            delete this.servers[sessionId];
+            delete this.sessionMetadata[sessionId];
+            logger_1.logger.info('Session removed', { sessionId, reason });
+        }
+        catch (error) {
+            logger_1.logger.warn('Error removing session', { sessionId, reason, error });
+        }
+    }
+    getActiveSessionCount() {
+        return Object.keys(this.transports).length;
+    }
+    canCreateSession() {
+        return this.getActiveSessionCount() < MAX_SESSIONS;
+    }
+    isValidSessionId(sessionId) {
+        const uuidv4Regex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+        return uuidv4Regex.test(sessionId);
+    }
+    sanitizeErrorForClient(error) {
+        const isProduction = process.env.NODE_ENV === 'production';
+        if (error instanceof Error) {
+            if (isProduction) {
+                if (error.message.includes('Unauthorized') || error.message.includes('authentication')) {
+                    return { message: 'Authentication failed', code: 'AUTH_ERROR' };
+                }
+                if (error.message.includes('Session') || error.message.includes('session')) {
+                    return { message: 'Session error', code: 'SESSION_ERROR' };
+                }
+                if (error.message.includes('Invalid') || error.message.includes('validation')) {
+                    return { message: 'Validation error', code: 'VALIDATION_ERROR' };
+                }
+                return { message: 'Internal server error', code: 'INTERNAL_ERROR' };
+            }
+            return {
+                message: error.message.substring(0, 200),
+                code: error.name || 'ERROR'
+            };
+        }
+        return { message: 'An error occurred', code: 'UNKNOWN_ERROR' };
+    }
+    updateSessionAccess(sessionId) {
+        if (this.sessionMetadata[sessionId]) {
+            this.sessionMetadata[sessionId].lastAccess = new Date();
+        }
+    }
+    getSessionMetrics() {
+        const now = Date.now();
+        let expiredCount = 0;
+        for (const sessionId in this.sessionMetadata) {
+            const metadata = this.sessionMetadata[sessionId];
+            if (now - metadata.lastAccess.getTime() > this.sessionTimeout) {
+                expiredCount++;
+            }
+        }
+        return {
+            totalSessions: Object.keys(this.sessionMetadata).length,
+            activeSessions: this.getActiveSessionCount(),
+            expiredSessions: expiredCount,
+            lastCleanup: new Date()
+        };
     }
     loadAuthToken() {
         if (process.env.AUTH_TOKEN) {
@@ -54,7 +167,17 @@ class SingleSessionHTTPServer {
         if (this.authToken.length < 32) {
             logger_1.logger.warn('AUTH_TOKEN should be at least 32 characters for security');
         }
-        if (this.authToken === 'REPLACE_THIS_AUTH_TOKEN_32_CHARS_MIN_abcdefgh') {
+        const isDefaultToken = this.authToken === 'REPLACE_THIS_AUTH_TOKEN_32_CHARS_MIN_abcdefgh';
+        const isProduction = process.env.NODE_ENV === 'production';
+        if (isDefaultToken) {
+            if (isProduction) {
+                const message = 'CRITICAL SECURITY ERROR: Cannot start in production with default AUTH_TOKEN. Generate secure token: openssl rand -base64 32';
+                logger_1.logger.error(message);
+                console.error('\n🚨 CRITICAL SECURITY ERROR 🚨');
+                console.error(message);
+                console.error('Set NODE_ENV to development for testing, or update AUTH_TOKEN for production\n');
+                throw new Error(message);
+            }
             logger_1.logger.warn('⚠️ SECURITY WARNING: Using default AUTH_TOKEN - CHANGE IMMEDIATELY!');
             logger_1.logger.warn('Generate secure token with: openssl rand -base64 32');
             if (process.env.MCP_MODE === 'http') {
@@ -69,41 +192,147 @@ class SingleSessionHTTPServer {
         const startTime = Date.now();
         return this.consoleManager.wrapOperation(async () => {
             try {
-                if (!this.session || this.isExpired()) {
-                    await this.resetSession();
+                const sessionId = req.headers['mcp-session-id'];
+                const isInitialize = req.body ? (0, types_js_1.isInitializeRequest)(req.body) : false;
+                logger_1.logger.info('handleRequest: Processing MCP request - SDK PATTERN', {
+                    requestId: req.get('x-request-id') || 'unknown',
+                    sessionId: sessionId,
+                    method: req.method,
+                    url: req.url,
+                    bodyType: typeof req.body,
+                    bodyContent: req.body ? JSON.stringify(req.body, null, 2) : 'undefined',
+                    existingTransports: Object.keys(this.transports),
+                    isInitializeRequest: isInitialize
+                });
+                let transport;
+                if (isInitialize) {
+                    if (!this.canCreateSession()) {
+                        logger_1.logger.warn('handleRequest: Session limit reached', {
+                            currentSessions: this.getActiveSessionCount(),
+                            maxSessions: MAX_SESSIONS
+                        });
+                        res.status(429).json({
+                            jsonrpc: '2.0',
+                            error: {
+                                code: -32000,
+                                message: `Session limit reached (${MAX_SESSIONS}). Please wait for existing sessions to expire.`
+                            },
+                            id: req.body?.id || null
+                        });
+                        return;
+                    }
+                    logger_1.logger.info('handleRequest: Creating new transport for initialize request');
+                    const sessionIdToUse = sessionId || (0, uuid_1.v4)();
+                    const server = new server_1.N8NDocumentationMCPServer();
+                    transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
+                        sessionIdGenerator: () => sessionIdToUse,
+                        onsessioninitialized: (initializedSessionId) => {
+                            logger_1.logger.info('handleRequest: Session initialized, storing transport and server', {
+                                sessionId: initializedSessionId
+                            });
+                            this.transports[initializedSessionId] = transport;
+                            this.servers[initializedSessionId] = server;
+                            this.sessionMetadata[initializedSessionId] = {
+                                lastAccess: new Date(),
+                                createdAt: new Date()
+                            };
+                        }
+                    });
+                    transport.onclose = () => {
+                        const sid = transport.sessionId;
+                        if (sid) {
+                            logger_1.logger.info('handleRequest: Transport closed, cleaning up', { sessionId: sid });
+                            this.removeSession(sid, 'transport_closed');
+                        }
+                    };
+                    logger_1.logger.info('handleRequest: Connecting server to new transport');
+                    await server.connect(transport);
                 }
-                this.session.lastAccess = new Date();
-                logger_1.logger.debug('Calling transport.handleRequest...');
-                await this.session.transport.handleRequest(req, res);
-                logger_1.logger.debug('transport.handleRequest completed');
-                const duration = Date.now() - startTime;
-                logger_1.logger.info('MCP request completed', {
-                    duration,
-                    sessionId: this.session.sessionId
+                else if (sessionId && this.transports[sessionId]) {
+                    if (!this.isValidSessionId(sessionId)) {
+                        logger_1.logger.warn('handleRequest: Invalid session ID format', { sessionId });
+                        res.status(400).json({
+                            jsonrpc: '2.0',
+                            error: {
+                                code: -32602,
+                                message: 'Invalid session ID format'
+                            },
+                            id: req.body?.id || null
+                        });
+                        return;
+                    }
+                    logger_1.logger.info('handleRequest: Reusing existing transport for session', { sessionId });
+                    transport = this.transports[sessionId];
+                    this.updateSessionAccess(sessionId);
+                }
+                else {
+                    const errorDetails = {
+                        hasSessionId: !!sessionId,
+                        isInitialize: isInitialize,
+                        sessionIdValid: sessionId ? this.isValidSessionId(sessionId) : false,
+                        sessionExists: sessionId ? !!this.transports[sessionId] : false
+                    };
+                    logger_1.logger.warn('handleRequest: Invalid request - no session ID and not initialize', errorDetails);
+                    let errorMessage = 'Bad Request: No valid session ID provided and not an initialize request';
+                    if (sessionId && !this.isValidSessionId(sessionId)) {
+                        errorMessage = 'Bad Request: Invalid session ID format';
+                    }
+                    else if (sessionId && !this.transports[sessionId]) {
+                        errorMessage = 'Bad Request: Session not found or expired';
+                    }
+                    res.status(400).json({
+                        jsonrpc: '2.0',
+                        error: {
+                            code: -32000,
+                            message: errorMessage
+                        },
+                        id: req.body?.id || null
+                    });
+                    return;
+                }
+                logger_1.logger.info('handleRequest: Handling request with transport', {
+                    sessionId: isInitialize ? 'new' : sessionId,
+                    isInitialize
                 });
+                await transport.handleRequest(req, res, req.body);
+                const duration = Date.now() - startTime;
+                logger_1.logger.info('MCP request completed', { duration, sessionId: transport.sessionId });
             }
             catch (error) {
-                logger_1.logger.error('MCP request error:', error);
+                logger_1.logger.error('handleRequest: MCP request error:', {
+                    error: error instanceof Error ? error.message : error,
+                    errorName: error instanceof Error ? error.name : 'Unknown',
+                    stack: error instanceof Error ? error.stack : undefined,
+                    activeTransports: Object.keys(this.transports),
+                    requestDetails: {
+                        method: req.method,
+                        url: req.url,
+                        hasBody: !!req.body,
+                        sessionId: req.headers['mcp-session-id']
+                    },
+                    duration: Date.now() - startTime
+                });
                 if (!res.headersSent) {
+                    const sanitizedError = this.sanitizeErrorForClient(error);
                     res.status(500).json({
                         jsonrpc: '2.0',
                         error: {
                             code: -32603,
-                            message: 'Internal server error',
-                            data: process.env.NODE_ENV === 'development'
-                                ? error.message
-                                : undefined
+                            message: sanitizedError.message,
+                            data: {
+                                code: sanitizedError.code
+                            }
                         },
-                        id: null
+                        id: req.body?.id || null
                     });
                 }
             }
         });
     }
-    async resetSession() {
+    async resetSessionSSE(res) {
         if (this.session) {
             try {
-                logger_1.logger.info('Closing previous session', { sessionId: this.session.sessionId });
+                logger_1.logger.info('Closing previous session for SSE', { sessionId: this.session.sessionId });
                 await this.session.transport.close();
             }
             catch (error) {
@@ -111,24 +340,25 @@ class SingleSessionHTTPServer {
             }
         }
         try {
-            logger_1.logger.info('Creating new N8NDocumentationMCPServer...');
+            logger_1.logger.info('Creating new N8NDocumentationMCPServer for SSE...');
             const server = new server_1.N8NDocumentationMCPServer();
-            logger_1.logger.info('Creating StreamableHTTPServerTransport...');
-            const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
-                sessionIdGenerator: () => 'single-session',
-            });
-            logger_1.logger.info('Connecting server to transport...');
+            const sessionId = (0, uuid_1.v4)();
+            logger_1.logger.info('Creating SSEServerTransport...');
+            const transport = new sse_js_1.SSEServerTransport('/mcp', res);
+            logger_1.logger.info('Connecting server to SSE transport...');
             await server.connect(transport);
             this.session = {
                 server,
                 transport,
                 lastAccess: new Date(),
-                sessionId: 'single-session'
+                sessionId,
+                initialized: false,
+                isSSE: true
             };
-            logger_1.logger.info('Created new single session successfully', { sessionId: this.session.sessionId });
+            logger_1.logger.info('Created new SSE session successfully', { sessionId: this.session.sessionId });
         }
         catch (error) {
-            logger_1.logger.error('Failed to create session:', error);
+            logger_1.logger.error('Failed to create SSE session:', error);
             throw error;
         }
     }
@@ -139,6 +369,7 @@ class SingleSessionHTTPServer {
     }
     async start() {
         const app = (0, express_1.default)();
+        const jsonParser = express_1.default.json({ limit: '10mb' });
         const trustProxy = process.env.TRUST_PROXY ? Number(process.env.TRUST_PROXY) : 0;
         if (trustProxy > 0) {
             app.set('trust proxy', trustProxy);
@@ -154,8 +385,9 @@ class SingleSessionHTTPServer {
         app.use((req, res, next) => {
             const allowedOrigin = process.env.CORS_ORIGIN || '*';
             res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-            res.setHeader('Access-Control-Allow-Methods', 'POST, GET, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Accept');
+            res.setHeader('Access-Control-Allow-Methods', 'POST, GET, DELETE, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Accept, Mcp-Session-Id');
+            res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');
             res.setHeader('Access-Control-Max-Age', '86400');
             if (req.method === 'OPTIONS') {
                 res.sendStatus(204);
@@ -201,15 +433,33 @@ class SingleSessionHTTPServer {
             });
         });
         app.get('/health', (req, res) => {
+            const activeTransports = Object.keys(this.transports);
+            const activeServers = Object.keys(this.servers);
+            const sessionMetrics = this.getSessionMetrics();
+            const isProduction = process.env.NODE_ENV === 'production';
+            const isDefaultToken = this.authToken === 'REPLACE_THIS_AUTH_TOKEN_32_CHARS_MIN_abcdefgh';
             res.json({
                 status: 'ok',
-                mode: 'single-session',
+                mode: 'sdk-pattern-transports',
                 version: version_1.PROJECT_VERSION,
+                environment: process.env.NODE_ENV || 'development',
                 uptime: Math.floor(process.uptime()),
-                sessionActive: !!this.session,
-                sessionAge: this.session
-                    ? Math.floor((Date.now() - this.session.lastAccess.getTime()) / 1000)
-                    : null,
+                sessions: {
+                    active: sessionMetrics.activeSessions,
+                    total: sessionMetrics.totalSessions,
+                    expired: sessionMetrics.expiredSessions,
+                    max: MAX_SESSIONS,
+                    usage: `${sessionMetrics.activeSessions}/${MAX_SESSIONS}`,
+                    sessionIds: activeTransports
+                },
+                security: {
+                    production: isProduction,
+                    defaultToken: isDefaultToken,
+                    tokenLength: this.authToken?.length || 0
+                },
+                activeTransports: activeTransports.length,
+                activeServers: activeServers.length,
+                legacySessionActive: !!this.session,
                 memory: {
                     used: Math.round(process.memoryUsage().heapUsed / 1024 / 1024),
                     total: Math.round(process.memoryUsage().heapTotal / 1024 / 1024),
@@ -218,7 +468,81 @@ class SingleSessionHTTPServer {
                 timestamp: new Date().toISOString()
             });
         });
-        app.get('/mcp', (req, res) => {
+        app.post('/mcp/test', jsonParser, async (req, res) => {
+            logger_1.logger.info('TEST ENDPOINT: Manual test request received', {
+                method: req.method,
+                headers: req.headers,
+                body: req.body,
+                bodyType: typeof req.body,
+                bodyContent: req.body ? JSON.stringify(req.body, null, 2) : 'undefined'
+            });
+            const negotiationResult = (0, protocol_version_1.negotiateProtocolVersion)(undefined, undefined, req.get('user-agent'), req.headers);
+            (0, protocol_version_1.logProtocolNegotiation)(negotiationResult, logger_1.logger, 'TEST_ENDPOINT');
+            const testResponse = {
+                jsonrpc: '2.0',
+                id: req.body?.id || 1,
+                result: {
+                    protocolVersion: negotiationResult.version,
+                    capabilities: {
+                        tools: {}
+                    },
+                    serverInfo: {
+                        name: 'n8n-mcp',
+                        version: version_1.PROJECT_VERSION
+                    }
+                }
+            };
+            logger_1.logger.info('TEST ENDPOINT: Sending test response', {
+                response: testResponse
+            });
+            res.json(testResponse);
+        });
+        app.get('/mcp', async (req, res) => {
+            const sessionId = req.headers['mcp-session-id'];
+            if (sessionId && this.transports[sessionId]) {
+                try {
+                    await this.transports[sessionId].handleRequest(req, res, undefined);
+                    return;
+                }
+                catch (error) {
+                    logger_1.logger.error('StreamableHTTP GET request failed:', error);
+                }
+            }
+            const accept = req.headers.accept;
+            if (accept && accept.includes('text/event-stream')) {
+                logger_1.logger.info('SSE stream request received - establishing SSE connection');
+                try {
+                    await this.resetSessionSSE(res);
+                    logger_1.logger.info('SSE connection established successfully');
+                }
+                catch (error) {
+                    logger_1.logger.error('Failed to establish SSE connection:', error);
+                    res.status(500).json({
+                        jsonrpc: '2.0',
+                        error: {
+                            code: -32603,
+                            message: 'Failed to establish SSE connection'
+                        },
+                        id: null
+                    });
+                }
+                return;
+            }
+            if (process.env.N8N_MODE === 'true') {
+                const negotiationResult = (0, protocol_version_1.negotiateProtocolVersion)(undefined, undefined, req.get('user-agent'), req.headers);
+                (0, protocol_version_1.logProtocolNegotiation)(negotiationResult, logger_1.logger, 'N8N_MODE_GET');
+                res.json({
+                    protocolVersion: negotiationResult.version,
+                    serverInfo: {
+                        name: 'n8n-mcp',
+                        version: version_1.PROJECT_VERSION,
+                        capabilities: {
+                            tools: {}
+                        }
+                    }
+                });
+                return;
+            }
             res.json({
                 description: 'n8n Documentation MCP Server',
                 version: version_1.PROJECT_VERSION,
@@ -245,7 +569,92 @@ class SingleSessionHTTPServer {
                 documentation: 'https://github.com/czlonkowski/n8n-mcp'
             });
         });
-        app.post('/mcp', async (req, res) => {
+        app.delete('/mcp', async (req, res) => {
+            const mcpSessionId = req.headers['mcp-session-id'];
+            if (!mcpSessionId) {
+                res.status(400).json({
+                    jsonrpc: '2.0',
+                    error: {
+                        code: -32602,
+                        message: 'Mcp-Session-Id header is required'
+                    },
+                    id: null
+                });
+                return;
+            }
+            if (!this.isValidSessionId(mcpSessionId)) {
+                res.status(400).json({
+                    jsonrpc: '2.0',
+                    error: {
+                        code: -32602,
+                        message: 'Invalid session ID format'
+                    },
+                    id: null
+                });
+                return;
+            }
+            if (this.transports[mcpSessionId]) {
+                logger_1.logger.info('Terminating session via DELETE request', { sessionId: mcpSessionId });
+                try {
+                    await this.removeSession(mcpSessionId, 'manual_termination');
+                    res.status(204).send();
+                }
+                catch (error) {
+                    logger_1.logger.error('Error terminating session:', error);
+                    res.status(500).json({
+                        jsonrpc: '2.0',
+                        error: {
+                            code: -32603,
+                            message: 'Error terminating session'
+                        },
+                        id: null
+                    });
+                }
+            }
+            else {
+                res.status(404).json({
+                    jsonrpc: '2.0',
+                    error: {
+                        code: -32001,
+                        message: 'Session not found'
+                    },
+                    id: null
+                });
+            }
+        });
+        app.post('/mcp', jsonParser, async (req, res) => {
+            logger_1.logger.info('POST /mcp request received - DETAILED DEBUG', {
+                headers: req.headers,
+                readable: req.readable,
+                readableEnded: req.readableEnded,
+                complete: req.complete,
+                bodyType: typeof req.body,
+                bodyContent: req.body ? JSON.stringify(req.body, null, 2) : 'undefined',
+                contentLength: req.get('content-length'),
+                contentType: req.get('content-type'),
+                userAgent: req.get('user-agent'),
+                ip: req.ip,
+                method: req.method,
+                url: req.url,
+                originalUrl: req.originalUrl
+            });
+            const sessionId = req.headers['mcp-session-id'];
+            if (typeof req.on === 'function') {
+                req.on('close', () => {
+                    if (!res.headersSent && sessionId) {
+                        logger_1.logger.info('Connection closed before response sent', { sessionId });
+                        setImmediate(() => {
+                            if (this.sessionMetadata[sessionId]) {
+                                const metadata = this.sessionMetadata[sessionId];
+                                const timeSinceAccess = Date.now() - metadata.lastAccess.getTime();
+                                if (timeSinceAccess > 60000) {
+                                    this.removeSession(sessionId, 'connection_closed');
+                                }
+                            }
+                        });
+                    }
+                });
+            }
             const authHeader = req.headers.authorization;
             if (!authHeader) {
                 logger_1.logger.warn('Authentication failed: Missing Authorization header', {
@@ -268,7 +677,7 @@ class SingleSessionHTTPServer {
                     ip: req.ip,
                     userAgent: req.get('user-agent'),
                     reason: 'invalid_auth_format',
-                    headerPrefix: authHeader.substring(0, 10) + '...'
+                    headerPrefix: authHeader.substring(0, Math.min(authHeader.length, 10)) + '...'
                 });
                 res.status(401).json({
                     jsonrpc: '2.0',
@@ -297,7 +706,17 @@ class SingleSessionHTTPServer {
                 });
                 return;
             }
+            logger_1.logger.info('Authentication successful - proceeding to handleRequest', {
+                hasSession: !!this.session,
+                sessionType: this.session?.isSSE ? 'SSE' : 'StreamableHTTP',
+                sessionInitialized: this.session?.initialized
+            });
             await this.handleRequest(req, res);
+            logger_1.logger.info('POST /mcp request completed - checking response status', {
+                responseHeadersSent: res.headersSent,
+                responseStatusCode: res.statusCode,
+                responseFinished: res.finished
+            });
         });
         app.use((req, res) => {
             res.status(404).json({
@@ -322,14 +741,32 @@ class SingleSessionHTTPServer {
         const port = parseInt(process.env.PORT || '3000');
         const host = process.env.HOST || '0.0.0.0';
         this.expressServer = app.listen(port, host, () => {
-            logger_1.logger.info(`n8n MCP Single-Session HTTP Server started`, { port, host });
+            const isProduction = process.env.NODE_ENV === 'production';
+            const isDefaultToken = this.authToken === 'REPLACE_THIS_AUTH_TOKEN_32_CHARS_MIN_abcdefgh';
+            logger_1.logger.info(`n8n MCP Single-Session HTTP Server started`, {
+                port,
+                host,
+                environment: process.env.NODE_ENV || 'development',
+                maxSessions: MAX_SESSIONS,
+                sessionTimeout: this.sessionTimeout / 1000 / 60,
+                production: isProduction,
+                defaultToken: isDefaultToken
+            });
             const baseUrl = (0, url_detector_1.getStartupBaseUrl)(host, port);
             const endpoints = (0, url_detector_1.formatEndpointUrls)(baseUrl);
             console.log(`n8n MCP Single-Session HTTP Server running on ${host}:${port}`);
+            console.log(`Environment: ${process.env.NODE_ENV || 'development'}`);
+            console.log(`Session Limits: ${MAX_SESSIONS} max sessions, ${this.sessionTimeout / 1000 / 60}min timeout`);
             console.log(`Health check: ${endpoints.health}`);
             console.log(`MCP endpoint: ${endpoints.mcp}`);
+            if (isProduction) {
+                console.log('🔒 Running in PRODUCTION mode - enhanced security enabled');
+            }
+            else {
+                console.log('🛠️ Running in DEVELOPMENT mode');
+            }
             console.log('\nPress Ctrl+C to stop the server');
-            if (this.authToken === 'REPLACE_THIS_AUTH_TOKEN_32_CHARS_MIN_abcdefgh') {
+            if (isDefaultToken && !isProduction) {
                 setInterval(() => {
                     logger_1.logger.warn('⚠️ Still using default AUTH_TOKEN - security risk!');
                     if (process.env.MCP_MODE === 'http') {
@@ -359,13 +796,29 @@ class SingleSessionHTTPServer {
     }
     async shutdown() {
         logger_1.logger.info('Shutting down Single-Session HTTP server...');
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+            logger_1.logger.info('Session cleanup timer stopped');
+        }
+        const sessionIds = Object.keys(this.transports);
+        logger_1.logger.info(`Closing ${sessionIds.length} active sessions`);
+        for (const sessionId of sessionIds) {
+            try {
+                logger_1.logger.info(`Closing transport for session ${sessionId}`);
+                await this.removeSession(sessionId, 'server_shutdown');
+            }
+            catch (error) {
+                logger_1.logger.warn(`Error closing transport for session ${sessionId}:`, error);
+            }
+        }
         if (this.session) {
             try {
                 await this.session.transport.close();
-                logger_1.logger.info('Session closed');
+                logger_1.logger.info('Legacy session closed');
             }
             catch (error) {
-                logger_1.logger.warn('Error closing session:', error);
+                logger_1.logger.warn('Error closing legacy session:', error);
             }
             this.session = null;
         }
@@ -377,15 +830,33 @@ class SingleSessionHTTPServer {
                 });
             });
         }
+        logger_1.logger.info('Single-Session HTTP server shutdown completed');
     }
     getSessionInfo() {
+        const metrics = this.getSessionMetrics();
         if (!this.session) {
-            return { active: false };
+            return {
+                active: false,
+                sessions: {
+                    total: metrics.totalSessions,
+                    active: metrics.activeSessions,
+                    expired: metrics.expiredSessions,
+                    max: MAX_SESSIONS,
+                    sessionIds: Object.keys(this.transports)
+                }
+            };
         }
         return {
             active: true,
             sessionId: this.session.sessionId,
-            age: Date.now() - this.session.lastAccess.getTime()
+            age: Date.now() - this.session.lastAccess.getTime(),
+            sessions: {
+                total: metrics.totalSessions,
+                active: metrics.activeSessions,
+                expired: metrics.expiredSessions,
+                max: MAX_SESSIONS,
+                sessionIds: Object.keys(this.transports)
+            }
         };
     }
 }