portkey-admin-mcp 0.5.0 → 0.6.0

package/build/server.js

@@ -4,7 +4,7 @@
 import { pathToFileURL } from "node:url";
 
 // src/lib/http-app.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { readFileSync as readFileSync2 } from "node:fs";
 import {
   createServer as createHttpServer
@@ -22,6 +22,7 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import cors from "cors";
 import express from "express";
+import { rateLimit as expressRateLimit } from "express-rate-limit";
 import helmet from "helmet";
 
 // src/services/base.service.ts
@@ -136,6 +137,7 @@ var Logger = {
 // src/services/base.service.ts
 var DEFAULT_BASE_URL = "https://api.portkey.ai/v1";
 var PRIVATE_BASE_URL_OVERRIDE_HINT = "Set PORTKEY_ALLOW_PRIVATE_BASE_URL=true to allow self-hosted gateways on loopback or private networks.";
+var INSECURE_HTTP_OVERRIDE_HINT = "Set PORTKEY_ALLOW_INSECURE_HTTP=true only for a trusted self-hosted gateway when TLS is unavailable.";
 function isPrivateOrLocalHost(hostname) {
   const host = hostname.trim().toLowerCase().replace(/^\[|\]$/g, "");
   if (host === "localhost" || host.endsWith(".localhost")) {
@@ -202,6 +204,14 @@ function validateUrl(url) {
       `Refusing to use a loopback or private-network PORTKEY_BASE_URL host: ${parsed.hostname}. ${PRIVATE_BASE_URL_OVERRIDE_HINT}`
     );
   }
+  const allowInsecureHttp = /^(1|true|yes)$/i.test(
+    process.env.PORTKEY_ALLOW_INSECURE_HTTP?.trim() ?? ""
+  );
+  if (parsed.protocol === "http:" && !allowInsecureHttp) {
+    throw new Error(
+      `Refusing insecure HTTP PORTKEY_BASE_URL: ${parsed.origin}. ${INSECURE_HTTP_OVERRIDE_HINT}`
+    );
+  }
 }
 var BaseService = class {
   apiKey;
@@ -213,13 +223,9 @@ var BaseService = class {
       throw new Error("PORTKEY_API_KEY environment variable is not set");
     }
     this.apiKey = apiKey;
-    if (baseUrlOverride !== void 0) {
-      this.baseUrl = baseUrlOverride.replace(/\/+$/, "");
-    } else {
-      const baseUrl = process.env.PORTKEY_BASE_URL ?? DEFAULT_BASE_URL;
-      validateUrl(baseUrl);
-      this.baseUrl = baseUrl.replace(/\/+$/, "");
-    }
+    const baseUrl = baseUrlOverride ?? process.env.PORTKEY_BASE_URL ?? DEFAULT_BASE_URL;
+    validateUrl(baseUrl);
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
   }
   encodePathSegment(value) {
     return encodeURIComponent(value);
@@ -255,6 +261,7 @@ var BaseService = class {
     try {
       const response = await fetchWithTimeout(url, {
         method,
+        redirect: "manual",
         headers: this.buildHeaders(method),
         body: this.serializeBody(options.body),
         timeout: this.timeout
@@ -8425,6 +8432,11 @@ function registerAllTools(server, service, options = {}) {
 // src/lib/auth.ts
 import crypto2 from "node:crypto";
 import { createRemoteJWKSet, jwtVerify } from "jose";
+function getPrincipalOwnerKey(principal) {
+  return crypto2.createHash("sha256").update(principal.id, "utf8").digest("hex");
+}
+var ClerkAuthorizationError = class extends Error {
+};
 var AUTH_SCHEMES = {
   bearer: "Bearer"
 };
@@ -8471,6 +8483,12 @@ function getHttpAuthConfigFromEnv() {
     process.env.CLERK_JWKS_URL?.trim(),
     issuer
   );
+  const allowedSubjects = parseCsv(process.env.CLERK_ALLOWED_SUBJECTS);
+  const allowedOrganizationIds = parseCsv(
+    process.env.CLERK_ALLOWED_ORGANIZATION_IDS
+  );
+  const allowedRoles = parseCsv(process.env.CLERK_ALLOWED_ROLES);
+  const requiredPermissions = parseCsv(process.env.CLERK_REQUIRED_PERMISSIONS);
   if (mode === "bearer" && !bearerToken) {
     throw new Error("MCP_AUTH_MODE=bearer requires MCP_AUTH_TOKEN to be set");
   }
@@ -8502,13 +8520,22 @@ function getHttpAuthConfigFromEnv() {
         `MCP_AUTH_MODE=clerk configuration error (${issues.join("; ")})`
       );
     }
+    if (!allowedSubjects && !allowedOrganizationIds && !allowedRoles && !requiredPermissions) {
+      throw new Error(
+        "MCP_AUTH_MODE=clerk requires an explicit authorization policy. Set at least one of CLERK_ALLOWED_SUBJECTS, CLERK_ALLOWED_ORGANIZATION_IDS, CLERK_ALLOWED_ROLES, or CLERK_REQUIRED_PERMISSIONS."
+      );
+    }
   }
   return {
     mode,
     bearerToken,
     jwksUrl,
     issuer,
-    audience
+    audience,
+    allowedSubjects,
+    allowedOrganizationIds,
+    allowedRoles,
+    requiredPermissions
   };
 }
 var HTTP_AUTH_CONFIG = getHttpAuthConfigFromEnv();
@@ -8543,6 +8570,65 @@ function timingSafeEqual(a, b) {
   return crypto2.timingSafeEqual(left, right);
 }
 var jwksCache = /* @__PURE__ */ new Map();
+function asString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function asStringArray(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.flatMap((item) => {
+    const normalized = asString(item);
+    return normalized ? [normalized] : [];
+  });
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+function authorizeClerkClaims(payload, config) {
+  const subject = asString(payload.sub);
+  if (!subject) {
+    throw new ClerkAuthorizationError("Clerk token is missing a subject");
+  }
+  const organization = typeof payload.o === "object" && payload.o !== null ? payload.o : void 0;
+  const organizationId = asString(payload.org_id) ?? asString(organization?.id);
+  const roles = unique(
+    [
+      asString(payload.org_role),
+      asString(organization?.rol),
+      ...asStringArray(payload.roles)
+    ].filter((role) => Boolean(role))
+  );
+  const permissions = unique([
+    ...asStringArray(payload.org_permissions),
+    ...asStringArray(organization?.per),
+    ...asStringArray(payload.permissions)
+  ]);
+  if (config.allowedSubjects && !config.allowedSubjects.includes(subject)) {
+    throw new ClerkAuthorizationError("Clerk subject is not authorized");
+  }
+  if (config.allowedOrganizationIds && (!organizationId || !config.allowedOrganizationIds.includes(organizationId))) {
+    throw new ClerkAuthorizationError("Clerk organization is not authorized");
+  }
+  if (config.allowedRoles && !roles.some((role) => config.allowedRoles?.includes(role))) {
+    throw new ClerkAuthorizationError("Clerk role is not authorized");
+  }
+  if (config.requiredPermissions && !config.requiredPermissions.every(
+    (permission) => permissions.includes(permission)
+  )) {
+    throw new ClerkAuthorizationError(
+      "Clerk token is missing a required permission"
+    );
+  }
+  return {
+    id: `clerk:${config.issuer}:${subject}`,
+    mode: "clerk",
+    subject,
+    organizationId,
+    roles,
+    permissions
+  };
+}
 async function verifyClerkToken(token, config) {
   if (!config.jwksUrl) {
     throw new Error("Missing Clerk JWKS URL configuration");
@@ -8558,11 +8644,12 @@ async function verifyClerkToken(token, config) {
     jwks = createRemoteJWKSet(new URL(config.jwksUrl));
     jwksCache.set(config.jwksUrl, jwks);
   }
-  await jwtVerify(token, jwks, {
+  const { payload } = await jwtVerify(token, jwks, {
     issuer: config.issuer,
     audience: config.audience,
     clockTolerance: "5s"
   });
+  return authorizeClerkClaims(payload, config);
 }
 async function mcpAuthMiddleware(req, res, next) {
   if (!req.path.startsWith("/mcp")) {
@@ -8571,6 +8658,12 @@ async function mcpAuthMiddleware(req, res, next) {
   }
   const config = getHttpAuthConfig();
   if (config.mode === "none") {
+    res.locals.authPrincipal = {
+      id: "anonymous",
+      mode: "none",
+      roles: [],
+      permissions: []
+    };
     next();
     return;
   }
@@ -8582,13 +8675,21 @@ async function mcpAuthMiddleware(req, res, next) {
     return;
   }
   try {
+    let principal;
     if (config.mode === "bearer") {
       if (!config.bearerToken || !timingSafeEqual(token, config.bearerToken)) {
         throw new Error("Bearer token mismatch");
       }
+      principal = {
+        id: `bearer:${crypto2.createHash("sha256").update(token, "utf8").digest("hex")}`,
+        mode: "bearer",
+        roles: [],
+        permissions: []
+      };
     } else {
-      await verifyClerkToken(token, config);
+      principal = await verifyClerkToken(token, config);
     }
+    res.locals.authPrincipal = principal;
     next();
   } catch (error) {
     Logger.warn("MCP auth failed", {
@@ -8599,6 +8700,10 @@ async function mcpAuthMiddleware(req, res, next) {
         reason: error instanceof Error ? error.message : "Unknown error"
       }
     });
+    if (error instanceof ClerkAuthorizationError) {
+      res.status(403).json({ error: "Forbidden: Principal is not authorized" });
+      return;
+    }
     res.status(401).json({ error: "Unauthorized: Token validation failed" });
   }
 }
@@ -8669,7 +8774,7 @@ function getServerConfig() {
       `Invalid MCP_MAX_SESSIONS value: ${maxSessionsStr}. Must be a positive integer`
     );
   }
-  const eventStoreTtlStr = (process.env.MCP_EVENT_TTL_SECONDS || "3600").trim();
+  const eventStoreTtlStr = (process.env.MCP_EVENT_TTL_SECONDS || "300").trim();
   const eventStoreTtlSeconds = parseStrictInteger(eventStoreTtlStr);
   if (Number.isNaN(eventStoreTtlSeconds) || eventStoreTtlSeconds <= 0) {
     throw new Error(
@@ -8682,6 +8787,38 @@ function getServerConfig() {
       "MCP_EVENT_STORE=redis requires MCP_REDIS_URL (or REDIS_URL) to be set"
     );
   }
+  if (eventStoreMode === "redis" && redisUrl) {
+    let parsedRedisUrl;
+    try {
+      parsedRedisUrl = new URL(redisUrl);
+    } catch {
+      throw new Error(
+        "MCP_REDIS_URL must be a valid redis:// or rediss:// URL"
+      );
+    }
+    if (!["redis:", "rediss:"].includes(parsedRedisUrl.protocol)) {
+      throw new Error("MCP_REDIS_URL must use redis:// or rediss://");
+    }
+    if (process.env.NODE_ENV?.trim().toLowerCase() === "production" && parsedRedisUrl.protocol !== "rediss:") {
+      throw new Error("MCP_REDIS_URL must use rediss:// in production");
+    }
+  }
+  const rawEventEncryptionKey = process.env.MCP_EVENT_ENCRYPTION_KEY?.trim();
+  let eventEncryptionKey;
+  if (eventStoreMode === "redis") {
+    if (!rawEventEncryptionKey) {
+      throw new Error(
+        "MCP_EVENT_ENCRYPTION_KEY must be base64-encoded 32-byte key when MCP_EVENT_STORE=redis"
+      );
+    }
+    const decodedKey = Buffer.from(rawEventEncryptionKey, "base64");
+    if (decodedKey.length !== 32 || decodedKey.toString("base64") !== rawEventEncryptionKey) {
+      throw new Error(
+        "MCP_EVENT_ENCRYPTION_KEY must be base64-encoded 32-byte key when MCP_EVENT_STORE=redis"
+      );
+    }
+    eventEncryptionKey = decodedKey;
+  }
   const redisKeyPrefix = process.env.MCP_REDIS_KEY_PREFIX?.trim() || "mcp:event-store";
   const keyPath = process.env.MCP_TLS_KEY_PATH?.trim() || void 0;
   const certPath = process.env.MCP_TLS_CERT_PATH?.trim() || void 0;
@@ -8702,7 +8839,8 @@ function getServerConfig() {
       mode: eventStoreMode,
       ttlSeconds: eventStoreTtlSeconds,
       redisUrl,
-      redisKeyPrefix
+      redisKeyPrefix,
+      encryptionKey: eventEncryptionKey
     },
     protocol,
     port,
@@ -8720,8 +8858,69 @@ function getServerConfig() {
 }
 
 // src/lib/event-store.ts
-import { randomUUID } from "node:crypto";
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes as randomBytes2,
+  randomUUID
+} from "node:crypto";
 var EVENT_STORE_CLEANUP_INTERVAL_MS = 3e4;
+var EVENT_PAYLOAD_ENCRYPTION_VERSION = "v1";
+var EVENT_PAYLOAD_AAD = Buffer.from(
+  "portkey-admin-mcp:event-payload:v1",
+  "utf8"
+);
+function assertEncryptionKey(key) {
+  if (key.length !== 32) {
+    throw new Error("Event payload encryption requires a 32-byte key");
+  }
+}
+function encryptEventPayload(message, key) {
+  assertEncryptionKey(key);
+  const iv = randomBytes2(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv, {
+    authTagLength: 16
+  });
+  cipher.setAAD(EVENT_PAYLOAD_AAD);
+  const ciphertext = Buffer.concat([
+    cipher.update(JSON.stringify(message), "utf8"),
+    cipher.final()
+  ]);
+  const authenticationTag = cipher.getAuthTag();
+  return [
+    EVENT_PAYLOAD_ENCRYPTION_VERSION,
+    iv.toString("base64url"),
+    authenticationTag.toString("base64url"),
+    ciphertext.toString("base64url")
+  ].join(".");
+}
+function decryptEventPayload(encoded, key) {
+  assertEncryptionKey(key);
+  const [version, encodedIv, encodedTag, encodedCiphertext, ...rest] = encoded.split(".");
+  if (version !== EVENT_PAYLOAD_ENCRYPTION_VERSION || !encodedIv || !encodedTag || !encodedCiphertext || rest.length > 0) {
+    throw new Error("Invalid encrypted event payload envelope");
+  }
+  const iv = Buffer.from(encodedIv, "base64url");
+  const authenticationTag = Buffer.from(encodedTag, "base64url");
+  if (iv.length !== 12) {
+    throw new Error("Encrypted event payload must use a 12-byte nonce");
+  }
+  if (authenticationTag.length !== 16) {
+    throw new Error(
+      "Encrypted event payload must use a 16-byte authentication tag"
+    );
+  }
+  const decipher = createDecipheriv("aes-256-gcm", key, iv, {
+    authTagLength: 16
+  });
+  decipher.setAAD(EVENT_PAYLOAD_AAD);
+  decipher.setAuthTag(authenticationTag);
+  const plaintext = Buffer.concat([
+    decipher.update(Buffer.from(encodedCiphertext, "base64url")),
+    decipher.final()
+  ]);
+  return JSON.parse(plaintext.toString("utf8"));
+}
 var SAFE_EVENT_ID_PATTERN = /^[\w-]{1,128}$/;
 function assertSafeRedisId(id, kind) {
   if (!SAFE_EVENT_ID_PATTERN.test(id)) {
@@ -8731,36 +8930,47 @@ function assertSafeRedisId(id, kind) {
   }
   return id;
 }
-var InMemoryEventStore = class {
+var InMemoryEventStore = class _InMemoryEventStore {
   ttlMs;
-  events = /* @__PURE__ */ new Map();
-  streamEvents = /* @__PURE__ */ new Map();
-  activeReplayStreams = /* @__PURE__ */ new Set();
-  lastCleanupAt = 0;
-  constructor(ttlSeconds) {
+  ownerKey;
+  state;
+  constructor(ttlSeconds, ownerKey, state = {
+    events: /* @__PURE__ */ new Map(),
+    streamEvents: /* @__PURE__ */ new Map(),
+    activeReplayStreams: /* @__PURE__ */ new Set(),
+    lastCleanupAt: 0
+  }) {
     this.ttlMs = ttlSeconds * 1e3;
+    this.ownerKey = ownerKey;
+    this.state = state;
+  }
+  forOwner(ownerKey) {
+    return new _InMemoryEventStore(this.ttlMs / 1e3, ownerKey, this.state);
   }
-  removeEvent(eventId, event = this.events.get(eventId)) {
+  removeEvent(eventId, event = this.state.events.get(eventId)) {
     if (!event) {
       return;
     }
-    this.events.delete(eventId);
-    const eventIds = this.streamEvents.get(event.streamId);
+    this.state.events.delete(eventId);
+    const eventIds = this.state.streamEvents.get(event.streamId);
     if (!eventIds) {
       return;
     }
     const filtered = eventIds.filter((candidate) => candidate !== eventId);
     if (filtered.length === 0) {
-      this.streamEvents.delete(event.streamId);
+      this.state.streamEvents.delete(event.streamId);
     } else if (filtered.length !== eventIds.length) {
-      this.streamEvents.set(event.streamId, filtered);
+      this.state.streamEvents.set(event.streamId, filtered);
     }
   }
   getEventIfUnexpired(eventId, now = Date.now()) {
-    const event = this.events.get(eventId);
+    const event = this.state.events.get(eventId);
     if (!event) {
       return void 0;
     }
+    if (event.ownerKey !== this.ownerKey) {
+      return void 0;
+    }
     if (event.expiresAt > now) {
       return event;
     }
@@ -8768,38 +8978,41 @@ var InMemoryEventStore = class {
     return void 0;
   }
   cleanupExpired(now = Date.now()) {
-    for (const [eventId, event] of this.events.entries()) {
+    for (const [eventId, event] of this.state.events.entries()) {
       if (event.expiresAt <= now) {
-        this.events.delete(eventId);
+        this.state.events.delete(eventId);
       }
     }
-    for (const [streamId, eventIds] of this.streamEvents.entries()) {
-      const filtered = eventIds.filter((eventId) => this.events.has(eventId));
+    for (const [streamId, eventIds] of this.state.streamEvents.entries()) {
+      const filtered = eventIds.filter(
+        (eventId) => this.state.events.has(eventId)
+      );
       if (filtered.length === 0) {
-        this.streamEvents.delete(streamId);
+        this.state.streamEvents.delete(streamId);
       } else if (filtered.length !== eventIds.length) {
-        this.streamEvents.set(streamId, filtered);
+        this.state.streamEvents.set(streamId, filtered);
       }
     }
   }
   maybeCleanupExpired(now = Date.now()) {
-    if (now - this.lastCleanupAt < EVENT_STORE_CLEANUP_INTERVAL_MS) {
+    if (now - this.state.lastCleanupAt < EVENT_STORE_CLEANUP_INTERVAL_MS) {
       return;
     }
     this.cleanupExpired(now);
-    this.lastCleanupAt = now;
+    this.state.lastCleanupAt = now;
   }
   async storeEvent(streamId, message) {
     this.maybeCleanupExpired();
     const eventId = randomUUID();
-    this.events.set(eventId, {
+    this.state.events.set(eventId, {
       streamId,
+      ownerKey: this.ownerKey,
       message,
       expiresAt: Date.now() + this.ttlMs
     });
-    const streamIds = this.streamEvents.get(streamId) || [];
+    const streamIds = this.state.streamEvents.get(streamId) || [];
     streamIds.push(eventId);
-    this.streamEvents.set(streamId, streamIds);
+    this.state.streamEvents.set(streamId, streamIds);
     return eventId;
   }
   async getStreamIdForEventId(eventId) {
@@ -8812,17 +9025,17 @@ var InMemoryEventStore = class {
     if (!streamId) {
       return { status: "missing" };
     }
-    if (this.activeReplayStreams.has(streamId)) {
+    if (this.state.activeReplayStreams.has(streamId)) {
       return { status: "conflict" };
     }
-    this.activeReplayStreams.add(streamId);
+    this.state.activeReplayStreams.add(streamId);
     let released = false;
     return {
       status: "acquired",
       release: async () => {
         if (!released) {
           released = true;
-          this.activeReplayStreams.delete(streamId);
+          this.state.activeReplayStreams.delete(streamId);
         }
       }
     };
@@ -8836,7 +9049,7 @@ var InMemoryEventStore = class {
     if (!lastEvent) {
       throw new Error(`Event not found for replay: ${lastEventId}`);
     }
-    const eventIds = this.streamEvents.get(lastEvent.streamId) || [];
+    const eventIds = this.state.streamEvents.get(lastEvent.streamId) || [];
     const index = eventIds.indexOf(lastEventId);
     if (index < 0) {
       throw new Error(
@@ -8853,16 +9066,36 @@ var InMemoryEventStore = class {
     return lastEvent.streamId;
   }
 };
-var RedisEventStore = class {
-  client;
+var RedisEventStore = class _RedisEventStore {
   redisUrl;
   ttlSeconds;
   keyPrefix;
-  connectPromise;
-  constructor(redisUrl, keyPrefix, ttlSeconds) {
+  ownerKey;
+  encryptionKey;
+  connection;
+  constructor(redisUrl, keyPrefix, ttlSeconds, ownerKey, encryptionKey, connection = {}) {
     this.redisUrl = redisUrl;
     this.ttlSeconds = ttlSeconds;
     this.keyPrefix = keyPrefix;
+    this.ownerKey = ownerKey;
+    this.encryptionKey = encryptionKey;
+    this.connection = connection;
+  }
+  get client() {
+    return this.connection.client;
+  }
+  set client(client) {
+    this.connection.client = client;
+  }
+  forOwner(ownerKey) {
+    return new _RedisEventStore(
+      this.redisUrl,
+      this.keyPrefix,
+      this.ttlSeconds,
+      ownerKey,
+      this.encryptionKey,
+      this.connection
+    );
   }
   counterKey() {
     return `${this.keyPrefix}:counter`;
@@ -8877,9 +9110,9 @@ var RedisEventStore = class {
     return `${this.keyPrefix}:stream:${assertSafeRedisId(streamId, "streamId")}:replay-lease`;
   }
   async ensureConnected() {
-    if (!this.client) {
+    if (!this.connection.client) {
       const { createClient } = await import("redis");
-      this.client = createClient({
+      this.connection.client = createClient({
         url: this.redisUrl,
         // node-redis v6 defaults to RESP3, a 5-second command timeout, and a
         // 30-second keepalive delay. Keep the event store's v5 behavior stable
@@ -8888,7 +9121,7 @@ var RedisEventStore = class {
         socket: { keepAliveInitialDelay: 5e3 },
         commandOptions: { timeout: void 0 }
       });
-      this.client.on("error", (error) => {
+      this.connection.client.on("error", (error) => {
         Logger.error("Redis event store error", {
           metadata: {
             error: error instanceof Error ? error.message : String(error)
@@ -8896,22 +9129,22 @@ var RedisEventStore = class {
         });
       });
     }
-    if (this.client.isOpen) {
+    if (this.connection.client.isOpen) {
       return;
     }
-    if (!this.connectPromise) {
-      this.connectPromise = this.client.connect().catch((error) => {
-        this.connectPromise = void 0;
+    if (!this.connection.connectPromise) {
+      this.connection.connectPromise = this.connection.client.connect().catch((error) => {
+        this.connection.connectPromise = void 0;
         throw error;
       });
     }
-    await this.connectPromise;
+    await this.connection.connectPromise;
   }
   getConnectedClient() {
-    if (!this.client) {
+    if (!this.connection.client) {
       throw new Error("Redis client not initialized");
     }
-    return this.client;
+    return this.connection.client;
   }
   async storeEvent(streamId, message) {
     await this.ensureConnected();
@@ -8923,8 +9156,9 @@ var RedisEventStore = class {
     const tx = client.multi();
     tx.hSet(eventKey, {
       streamId,
+      ownerKey: this.ownerKey,
       sequence: String(sequence),
-      message: JSON.stringify(message)
+      message: encryptEventPayload(message, this.encryptionKey)
     });
     tx.expire(eventKey, this.ttlSeconds);
     tx.zAdd(streamKey, {
@@ -8940,11 +9174,10 @@ var RedisEventStore = class {
       return void 0;
     }
     await this.ensureConnected();
-    const streamId = await this.getConnectedClient().hGet(
-      this.eventKey(eventId),
-      "streamId"
+    const event = await this.getConnectedClient().hGetAll(
+      this.eventKey(eventId)
     );
-    return streamId || void 0;
+    return event.ownerKey === this.ownerKey ? event.streamId || void 0 : void 0;
   }
   async acquireReplayLease(eventId) {
     const streamId = await this.getStreamIdForEventId(eventId);
@@ -8983,7 +9216,7 @@ var RedisEventStore = class {
     const client = this.getConnectedClient();
     const baseEvent = await client.hGetAll(this.eventKey(lastEventId));
     const streamId = baseEvent.streamId;
-    if (!streamId) {
+    if (!streamId || baseEvent.ownerKey !== this.ownerKey) {
       throw new Error(`Event not found for replay: ${lastEventId}`);
     }
     const baseScore = Number(baseEvent.sequence);
@@ -9000,17 +9233,17 @@ var RedisEventStore = class {
     }
     const tx = client.multi();
     for (const eventId of eventIds) {
-      tx.hGet(this.eventKey(eventId), "message");
+      tx.hGetAll(this.eventKey(eventId));
     }
-    const encodedMessages = await tx.exec();
+    const encodedEvents = await tx.exec();
     for (const [index, eventId] of eventIds.entries()) {
-      const encoded = encodedMessages[index];
-      if (typeof encoded !== "string") {
+      const event = encodedEvents[index];
+      if (typeof event !== "object" || event === null || !("message" in event) || !("ownerKey" in event) || event.ownerKey !== this.ownerKey || typeof event.message !== "string") {
         continue;
       }
       let message;
       try {
-        message = JSON.parse(encoded);
+        message = decryptEventPayload(event.message, this.encryptionKey);
       } catch {
         continue;
       }
@@ -9019,17 +9252,17 @@ var RedisEventStore = class {
     return streamId;
   }
   async close() {
-    if (!this.client) {
+    if (!this.connection.client) {
       return;
     }
-    if (!this.client.isOpen && this.connectPromise) {
+    if (!this.connection.client.isOpen && this.connection.connectPromise) {
       try {
-        await this.connectPromise;
+        await this.connection.connectPromise;
       } catch {
       }
     }
-    if (this.client.isOpen) {
-      await this.client.close();
+    if (this.connection.client.isOpen) {
+      await this.connection.client.close();
     }
   }
 };
@@ -9037,29 +9270,41 @@ function createManagedEventStore(config) {
   if (config.eventStore.mode === "off") {
     return {
       mode: "off",
+      eventStoreForOwner: () => void 0,
       close: async () => {
       }
     };
   }
   if (config.eventStore.mode === "memory") {
-    const memoryStore = new InMemoryEventStore(config.eventStore.ttlSeconds);
+    const memoryStore = new InMemoryEventStore(
+      config.eventStore.ttlSeconds,
+      "internal"
+    );
     return {
       mode: "memory",
-      eventStore: memoryStore,
-      acquireReplayLease: (eventId) => memoryStore.acquireReplayLease(eventId),
+      eventStoreForOwner: (ownerKey) => memoryStore.forOwner(ownerKey),
+      acquireReplayLease: (eventId, ownerKey) => memoryStore.forOwner(ownerKey).acquireReplayLease(eventId),
       close: async () => {
       }
     };
   }
+  const encryptionKey = config.eventStore.encryptionKey;
+  if (!encryptionKey) {
+    throw new Error(
+      "Redis event store requires MCP_EVENT_ENCRYPTION_KEY configuration"
+    );
+  }
   const redisStore = new RedisEventStore(
     config.eventStore.redisUrl,
     config.eventStore.redisKeyPrefix,
-    config.eventStore.ttlSeconds
+    config.eventStore.ttlSeconds,
+    "internal",
+    encryptionKey
   );
   return {
     mode: "redis",
-    eventStore: redisStore,
-    acquireReplayLease: (eventId) => redisStore.acquireReplayLease(eventId),
+    eventStoreForOwner: (ownerKey) => redisStore.forOwner(ownerKey),
+    acquireReplayLease: (eventId, ownerKey) => redisStore.forOwner(ownerKey).acquireReplayLease(eventId),
     close: async () => {
       await redisStore.close();
     }
@@ -9195,6 +9440,25 @@ function parseConfiguredToolDomains(rawValue = process.env.PORTKEY_TOOL_DOMAINS?
   }
   return normalizeToolDomains(requestedDomains);
 }
+function resolveToolDomains(requestedDomains) {
+  const configuredDomains = parseConfiguredToolDomains();
+  if (!configuredDomains) {
+    return requestedDomains ? normalizeToolDomains(requestedDomains) : void 0;
+  }
+  if (!requestedDomains) {
+    return configuredDomains;
+  }
+  const configuredDomainSet = new Set(configuredDomains);
+  const disallowedDomains = normalizeToolDomains(requestedDomains).filter(
+    (domain) => !configuredDomainSet.has(domain)
+  );
+  if (disallowedDomains.length > 0) {
+    throw new Error(
+      `Requested tool domains are not allowed by PORTKEY_TOOL_DOMAINS: ${disallowedDomains.join(", ")}`
+    );
+  }
+  return normalizeToolDomains(requestedDomains);
+}
 function createMcpServer(options = {}) {
   const service = getSharedPortkeyService();
   const server = new McpServer(
@@ -9213,7 +9477,7 @@ function createMcpServer(options = {}) {
   );
   registerServerPromptsAndResources(server);
   registerAllTools(server, service, {
-    domains: options.toolDomains ?? parseConfiguredToolDomains()
+    domains: resolveToolDomains(options.toolDomains)
   });
   return {
     server,
@@ -9222,6 +9486,8 @@ function createMcpServer(options = {}) {
 }
 
 // src/lib/security.ts
+import { createHash } from "node:crypto";
+import { ipKeyGenerator } from "express-rate-limit";
 function parseOrigins(raw) {
   return raw.split(",").map((origin) => origin.trim()).filter(Boolean);
 }
@@ -9342,6 +9608,65 @@ function hostValidationMiddleware(req, res, next) {
   }
   next();
 }
+var RATE_LIMIT_REDIS_COMMAND_TIMEOUT_MS = 5e3;
+var REDIS_TOKEN_BUCKET_SCRIPT = `
+local values = redis.call('HMGET', KEYS[1], 'tokens', 'lastRefill')
+local tokens = tonumber(values[1])
+local lastRefill = tonumber(values[2])
+local maxTokens = tonumber(ARGV[1])
+local windowMs = tonumber(ARGV[2])
+local refillRate = tonumber(ARGV[3])
+local now = tonumber(ARGV[4])
+
+if not tokens or not lastRefill then
+  tokens = maxTokens
+  lastRefill = now
+end
+
+local elapsedMs = math.max(0, now - lastRefill)
+local tokensToAdd = math.floor((elapsedMs / windowMs) * refillRate)
+if tokensToAdd > 0 then
+  tokens = math.min(maxTokens, tokens + tokensToAdd)
+  lastRefill = now
+end
+
+local allowed = 0
+if tokens > 0 then
+  tokens = tokens - 1
+  allowed = 1
+end
+
+redis.call('HSET', KEYS[1], 'tokens', tokens, 'lastRefill', lastRefill)
+redis.call('PEXPIRE', KEYS[1], math.max(windowMs * 2, 1000))
+return { allowed, tokens }
+`;
+async function consumeRedisRateLimitToken(client, options) {
+  let timeout;
+  const result = await Promise.race([
+    client.eval(REDIS_TOKEN_BUCKET_SCRIPT, {
+      keys: [options.key],
+      arguments: [
+        String(options.maxTokens),
+        String(options.windowMs),
+        String(options.refillRate),
+        String(options.now)
+      ]
+    }),
+    new Promise((_resolve, reject) => {
+      timeout = setTimeout(() => {
+        reject(new Error("Redis rate-limit command timed out"));
+      }, options.timeoutMs ?? RATE_LIMIT_REDIS_COMMAND_TIMEOUT_MS);
+    })
+  ]).finally(() => {
+    if (timeout) {
+      clearTimeout(timeout);
+    }
+  });
+  if (!Array.isArray(result) || result.length < 1) {
+    throw new Error("Invalid response from Redis rate-limit script");
+  }
+  return { allowed: Number(result[0]) === 1 };
+}
 function parsePositiveIntegerEnv(name, fallback) {
   const raw = process.env[name];
   if (raw === void 0) {
@@ -9361,20 +9686,71 @@ function parsePositiveIntegerEnv(name, fallback) {
   });
   return fallback;
 }
+function isExplicitlyEnabled2(value) {
+  return /^(1|true|yes)$/i.test(value?.trim() ?? "");
+}
+function resolveRateLimitStore() {
+  const store = process.env.RATE_LIMIT_STORE?.trim().toLowerCase() || "memory";
+  if (store !== "memory" && store !== "redis") {
+    throw new Error(
+      `Invalid RATE_LIMIT_STORE value: ${store}. Must be 'memory' or 'redis'`
+    );
+  }
+  return store;
+}
+function resolveRateLimitRedisUrl(store) {
+  if (store !== "redis") {
+    return void 0;
+  }
+  const redisUrl = process.env.RATE_LIMIT_REDIS_URL?.trim() || process.env.MCP_REDIS_URL?.trim() || process.env.REDIS_URL?.trim();
+  if (!redisUrl) {
+    throw new Error(
+      "RATE_LIMIT_STORE=redis requires RATE_LIMIT_REDIS_URL, MCP_REDIS_URL, or REDIS_URL"
+    );
+  }
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(redisUrl);
+  } catch {
+    throw new Error(
+      "Rate-limit Redis URL must be a valid redis:// or rediss:// URL"
+    );
+  }
+  if (!["redis:", "rediss:"].includes(parsedUrl.protocol)) {
+    throw new Error("Rate-limit Redis URL must use redis:// or rediss://");
+  }
+  if (process.env.NODE_ENV?.trim().toLowerCase() === "production" && parsedUrl.protocol !== "rediss:") {
+    throw new Error("Rate-limit Redis URL must use rediss:// in production");
+  }
+  return redisUrl;
+}
+var rateLimitEnabled = process.env.RATE_LIMIT_ENABLED?.trim().toLowerCase() !== "false";
+var rateLimitStore = resolveRateLimitStore();
+if (rateLimitEnabled && rateLimitStore === "memory" && process.env.NODE_ENV?.trim().toLowerCase() === "production" && !isExplicitlyEnabled2(process.env.RATE_LIMIT_SINGLE_PROCESS)) {
+  throw new Error(
+    "Production in-memory rate limiting requires RATE_LIMIT_SINGLE_PROCESS=true. Use RATE_LIMIT_STORE=redis for multi-instance deployments."
+  );
+}
 var RATE_LIMIT_CONFIG = {
-  enabled: process.env.RATE_LIMIT_ENABLED?.trim().toLowerCase() !== "false",
+  enabled: rateLimitEnabled,
+  store: rateLimitStore,
   maxTokens: parsePositiveIntegerEnv("RATE_LIMIT_MAX", 60),
   windowMs: parsePositiveIntegerEnv("RATE_LIMIT_WINDOW_MS", 6e4),
   refillRate: parsePositiveIntegerEnv("RATE_LIMIT_REFILL", 60),
-  maxBuckets: parsePositiveIntegerEnv("RATE_LIMIT_MAX_BUCKETS", 1e4)
+  maxBuckets: parsePositiveIntegerEnv("RATE_LIMIT_MAX_BUCKETS", 1e4),
+  redisUrl: resolveRateLimitRedisUrl(rateLimitStore),
+  redisKeyPrefix: process.env.RATE_LIMIT_REDIS_KEY_PREFIX?.trim() || "mcp:rate-limit"
 };
 function getRateLimitConfig() {
   return RATE_LIMIT_CONFIG;
 }
 var buckets = /* @__PURE__ */ new Map();
 var overflowBucket;
-function getClientIdentifier(req) {
-  return req.ip || "unknown";
+function getClientIdentifier(req, res, scope) {
+  const principal = res.locals?.authPrincipal;
+  const principalKey = scope === "principal" && principal ? getPrincipalOwnerKey(principal) : scope;
+  const trustedIp = ipKeyGenerator(req.ip || "unknown");
+  return createHash("sha256").update(scope, "utf8").update("\0", "utf8").update(principalKey, "utf8").update("\0", "utf8").update(trustedIp, "utf8").digest("hex");
 }
 function refillBucket(bucket, config) {
   const now = Date.now();
@@ -9435,7 +9811,63 @@ function consumeToken(clientId, config) {
   }
   return { allowed: false };
 }
-function rateLimitMiddleware(req, res, next) {
+var rateLimitRedisClient;
+var rateLimitRedisCreatePromise;
+var rateLimitRedisConnectPromise;
+async function createRateLimitRedisClient(config) {
+  const { createClient } = await import("redis");
+  const client = createClient({
+    url: config.redisUrl,
+    RESP: 2,
+    socket: { keepAliveInitialDelay: 5e3 },
+    commandOptions: { timeout: RATE_LIMIT_REDIS_COMMAND_TIMEOUT_MS }
+  });
+  client.on("error", (error) => {
+    Logger.error("Redis rate-limit store error", {
+      metadata: {
+        error: error instanceof Error ? error.message : String(error)
+      }
+    });
+  });
+  return client;
+}
+async function getRateLimitRedisClient(config) {
+  if (!config.redisUrl) {
+    throw new Error("Rate-limit Redis URL is not configured");
+  }
+  if (!rateLimitRedisClient) {
+    rateLimitRedisCreatePromise ??= createRateLimitRedisClient(config).catch(
+      (error) => {
+        rateLimitRedisCreatePromise = void 0;
+        throw error;
+      }
+    );
+    rateLimitRedisClient = await rateLimitRedisCreatePromise;
+  }
+  if (!rateLimitRedisClient.isOpen) {
+    rateLimitRedisConnectPromise ??= rateLimitRedisClient.connect().catch((error) => {
+      rateLimitRedisConnectPromise = void 0;
+      throw error;
+    });
+    await rateLimitRedisConnectPromise;
+  }
+  return rateLimitRedisClient;
+}
+function applyRateLimitDecision(allowed, config, req, res, next, clientId) {
+  if (allowed) {
+    next();
+    return;
+  }
+  const retryAfterMs = Math.ceil(config.windowMs / config.refillRate);
+  Logger.warn("Rate limit exceeded", {
+    path: req.path,
+    method: req.method,
+    metadata: { clientFingerprint: clientId.slice(0, 16), retryAfterMs }
+  });
+  res.setHeader("Retry-After", Math.ceil(retryAfterMs / 1e3).toString());
+  res.status(429).json({ error: "Too Many Requests" });
+}
+function applyRateLimit(scope, req, res, next) {
   const config = getRateLimitConfig();
   if (!config.enabled) {
     next();
@@ -9445,20 +9877,69 @@ function rateLimitMiddleware(req, res, next) {
     next();
     return;
   }
-  const clientId = getClientIdentifier(req);
-  const { allowed } = consumeToken(clientId, config);
-  if (!allowed) {
-    const retryAfterMs = Math.ceil(config.windowMs / config.refillRate);
-    Logger.warn("Rate limit exceeded", {
-      path: req.path,
-      method: req.method,
-      metadata: { clientId, retryAfterMs }
-    });
-    res.setHeader("Retry-After", Math.ceil(retryAfterMs / 1e3).toString());
-    res.status(429).json({ error: "Too Many Requests" });
+  if (scope === "authentication" && req.path !== "/mcp") {
+    next();
     return;
   }
-  next();
+  const clientId = getClientIdentifier(req, res, scope);
+  if (config.store === "memory") {
+    const { allowed } = consumeToken(clientId, config);
+    applyRateLimitDecision(allowed, config, req, res, next, clientId);
+    return;
+  }
+  return (async () => {
+    try {
+      const client = await getRateLimitRedisClient(config);
+      const { allowed } = await consumeRedisRateLimitToken(client, {
+        key: `${config.redisKeyPrefix}:${clientId}`,
+        maxTokens: config.maxTokens,
+        windowMs: config.windowMs,
+        refillRate: config.refillRate,
+        now: Date.now()
+      });
+      applyRateLimitDecision(allowed, config, req, res, next, clientId);
+    } catch (error) {
+      Logger.error("Rate-limit store unavailable", {
+        path: req.path,
+        method: req.method,
+        metadata: {
+          error: error instanceof Error ? error.message : String(error)
+        }
+      });
+      res.status(503).json({ error: "Rate limit service unavailable" });
+    }
+  })();
+}
+function rateLimitMiddleware(req, res, next) {
+  return applyRateLimit("authentication", req, res, next);
+}
+function principalRateLimitMiddleware(req, res, next) {
+  return applyRateLimit("principal", req, res, next);
+}
+async function closeRateLimitStore() {
+  if (!rateLimitRedisClient && rateLimitRedisCreatePromise) {
+    try {
+      rateLimitRedisClient = await rateLimitRedisCreatePromise;
+    } catch {
+      rateLimitRedisCreatePromise = void 0;
+      return;
+    }
+  }
+  if (!rateLimitRedisClient) {
+    return;
+  }
+  if (!rateLimitRedisClient.isOpen && rateLimitRedisConnectPromise) {
+    try {
+      await rateLimitRedisConnectPromise;
+    } catch {
+    }
+  }
+  if (rateLimitRedisClient.isOpen) {
+    await rateLimitRedisClient.close();
+  }
+  rateLimitRedisClient = void 0;
+  rateLimitRedisCreatePromise = void 0;
+  rateLimitRedisConnectPromise = void 0;
 }
 var cleanupTimer = setInterval(
   () => {
@@ -9495,6 +9976,11 @@ var SessionStore = class {
   get(sessionId) {
     return this.sessions.get(sessionId);
   }
+  /** Return a session only when it belongs to the supplied principal. */
+  getOwned(sessionId, ownerKey) {
+    const entry = this.sessions.get(sessionId);
+    return entry?.ownerKey === ownerKey ? entry : void 0;
+  }
   /**
    * Get a transport by session ID
    * @param sessionId - The session identifier
@@ -9746,6 +10232,16 @@ function respondJsonRpcClientError(res, statusCode, message, code = -32602) {
     id: null
   });
 }
+function getRequestOwnerKey(res) {
+  const principal = res.locals.authPrincipal;
+  if (!principal) {
+    throw new Error("Authenticated MCP request is missing its principal");
+  }
+  return getPrincipalOwnerKey(principal);
+}
+function fingerprintCapabilityId(id) {
+  return createHash2("sha256").update(id, "utf8").digest("hex").slice(0, 16);
+}
 function parseRequestedToolDomains(rawQuery) {
   if (rawQuery === void 0) {
     return void 0;
@@ -9773,7 +10269,7 @@ function parseRequestedToolDomains(rawQuery) {
       `Unknown tool domains: ${invalidDomains.join(", ")}. Valid domains: ${TOOL_DOMAIN_NAMES.join(", ")}`
     );
   }
-  return normalizeToolDomains(normalizedDomains);
+  return resolveToolDomains(normalizedDomains);
 }
 function areToolDomainsEqual(left, right) {
   const normalizedLeft = left ? normalizeToolDomains(left) : [];
@@ -9845,11 +10341,11 @@ function createHttpAppRuntime() {
   let closeRuntimeResourcesPromise;
   let sigintHandler;
   let sigtermHandler;
-  async function handleStatelessRequest(req, res, context, parsedBody, toolDomains) {
+  async function handleStatelessRequest(req, res, context, ownerKey, parsedBody, toolDomains) {
     let replayStreamId;
     let responseDisconnected = false;
     const storedMessages = /* @__PURE__ */ new WeakSet();
-    const sharedEventStore = managedEventStore.eventStore;
+    const sharedEventStore = managedEventStore.eventStoreForOwner(ownerKey);
     const requestEventStore = sharedEventStore ? {
       storeEvent: async (streamId, message) => {
         replayStreamId ??= streamId;
@@ -9960,8 +10456,21 @@ function createHttpAppRuntime() {
     app.use(hostValidationMiddleware);
   }
   app.use(originValidationMiddleware);
+  const rateLimitConfig = getRateLimitConfig();
+  app.use(
+    expressRateLimit({
+      windowMs: rateLimitConfig.windowMs,
+      limit: rateLimitConfig.maxTokens,
+      standardHeaders: false,
+      legacyHeaders: false,
+      validate: false,
+      skip: (req) => !rateLimitConfig.enabled || req.path !== "/mcp",
+      message: { error: "Too Many Requests" }
+    })
+  );
   app.use(rateLimitMiddleware);
   app.use(mcpAuthMiddleware);
+  app.use(principalRateLimitMiddleware);
   app.use(
     (err, _req, res, next) => {
       const errorType = err && typeof err === "object" && "type" in err ? err.type : void 0;
@@ -10118,6 +10627,7 @@ function createHttpAppRuntime() {
     });
   });
   app.post("/mcp", async (req, res) => {
+    const ownerKey = getRequestOwnerKey(res);
     let requestedToolDomains;
     const protocolVersionHeader = getMcpProtocolVersion(req);
     try {
@@ -10154,6 +10664,7 @@ function createHttpAppRuntime() {
           req,
           res,
           "POST /mcp stateless",
+          ownerKey,
           req.body,
           requestedToolDomains
         );
@@ -10165,7 +10676,7 @@ function createHttpAppRuntime() {
     const sessionId = req.headers["mcp-session-id"];
     let transport;
     let hasReservedSessionSlot = false;
-    const sessionEntry = sessionId ? sessionStore.get(sessionId) : void 0;
+    const sessionEntry = sessionId ? sessionStore.getOwned(sessionId, ownerKey) : void 0;
     if (sessionId && sessionEntry) {
       transport = sessionEntry.transport;
       if (transport) {
@@ -10209,10 +10720,11 @@ function createHttpAppRuntime() {
       hasReservedSessionSlot = true;
       const newTransport = new StreamableHTTPServerTransport({
         sessionIdGenerator: () => randomUUID2(),
-        eventStore: managedEventStore.eventStore,
+        eventStore: managedEventStore.eventStoreForOwner(ownerKey),
         onsessioninitialized: (id) => {
           sessionStore.set(id, {
             transport: newTransport,
+            ownerKey,
             toolDomains: requestedToolDomains,
             protocolVersion: getNegotiatedProtocolVersion(req.body),
             createdAt: Date.now(),
@@ -10220,13 +10732,13 @@ function createHttpAppRuntime() {
           });
           hasReservedSessionSlot = false;
           Logger.info("MCP session initialized", {
-            metadata: { sessionId: id }
+            metadata: { sessionFingerprint: fingerprintCapabilityId(id) }
           });
         },
         onsessionclosed: (id) => {
           sessionStore.delete(id);
           Logger.info("MCP session closed", {
-            metadata: { sessionId: id }
+            metadata: { sessionFingerprint: fingerprintCapabilityId(id) }
           });
         }
       });
@@ -10278,6 +10790,7 @@ function createHttpAppRuntime() {
     }
   });
   app.get("/mcp", async (req, res) => {
+    const ownerKey = getRequestOwnerKey(res);
     let requestedToolDomains;
     try {
       requestedToolDomains = parseRequestedToolDomains(req.query.tools);
@@ -10299,7 +10812,8 @@ function createHttpAppRuntime() {
         );
         return;
       }
-      if (!managedEventStore.eventStore || !managedEventStore.acquireReplayLease) {
+      const replayEventStore = managedEventStore.eventStoreForOwner(ownerKey);
+      if (!replayEventStore || !managedEventStore.acquireReplayLease) {
         res.setHeader("Allow", "POST");
         respondJsonRpcClientError(
           res,
@@ -10336,12 +10850,11 @@ function createHttpAppRuntime() {
         respondJsonRpcClientError(res, 400, protocolError, -32e3);
         return;
       }
-      const replayEventStore = managedEventStore.eventStore;
-      if (!replayEventStore) {
-        return;
-      }
       try {
-        const lease = await managedEventStore.acquireReplayLease(lastEventId);
+        const lease = await managedEventStore.acquireReplayLease(
+          lastEventId,
+          ownerKey
+        );
         if (lease.status !== "acquired") {
           if (lease.status === "missing") {
             respondJsonRpcClientError(
@@ -10452,7 +10965,7 @@ data:
       });
       return;
     }
-    const sessionEntry = sessionStore.get(sessionId);
+    const sessionEntry = sessionStore.getOwned(sessionId, ownerKey);
     const transport = sessionEntry?.transport;
     if (transport) {
       const protocolError = validateRequiredProtocolVersion(
@@ -10485,6 +10998,7 @@ data:
     }
   });
   app.delete("/mcp", async (req, res) => {
+    const ownerKey = getRequestOwnerKey(res);
     if (!isStatefulSessionMode) {
       res.status(405).json({
         jsonrpc: "2.0",
@@ -10509,7 +11023,7 @@ data:
       });
       return;
     }
-    const sessionEntry = sessionStore.get(sessionId);
+    const sessionEntry = sessionStore.getOwned(sessionId, ownerKey);
     const transport = sessionEntry?.transport;
     if (transport) {
       const protocolError = validateRequiredProtocolVersion(
@@ -10537,7 +11051,9 @@ data:
       const expiredIds = await sessionStore.cleanup(config.sessionTimeout);
       for (const id of expiredIds) {
         Logger.info("MCP session expired and cleaned up", {
-          metadata: { sessionId: id }
+          metadata: {
+            sessionFingerprint: fingerprintCapabilityId(id)
+          }
         });
       }
     } catch (error) {
@@ -10584,7 +11100,7 @@ data:
           );
           await Promise.allSettled(activeReplayOperations);
         } finally {
-          await managedEventStore.close();
+          await Promise.all([managedEventStore.close(), closeRateLimitStore()]);
         }
       })();
     }
@@ -10631,7 +11147,7 @@ data:
     console.log("  GET  /ready  - Readiness check");
     console.log("  POST /mcp    - MCP requests");
     console.log(
-      `  GET  /mcp    - ${isStatefulSessionMode ? "SSE notifications and replay" : managedEventStore.eventStore ? "SSE replay (requires Last-Event-ID)" : "Unavailable (event store off)"}`
+      `  GET  /mcp    - ${isStatefulSessionMode ? "SSE notifications and replay" : managedEventStore.mode !== "off" ? "SSE replay (requires Last-Event-ID)" : "Unavailable (event store off)"}`
     );
     console.log(
       `  DELETE /mcp  - ${isStatefulSessionMode ? "Close session" : "Not used in stateless mode"}`