tiny-http-mcp-server 0.1.10 → 0.1.12

package/README.md

@@ -430,8 +430,8 @@ Returned `HttpServer` instances support:
 | `allowedOrigins`         | `readonly string[]`                          | `[]`                             | Allowed CORS `Origin` values. Empty means no cross-origin browser clients are allowed.        |
 | `maxRequestBytes`        | `number`                                     | unlimited                        | Maximum JSON request body size.                                                               |
 | `maxBatchSize`           | `number`                                     | unlimited                        | Maximum JSON-RPC batch member count.                                                          |
-| `maxSessions`            | `number`                                     | unlimited                        | Maximum active sessions.                                                                      |
-| `sessionTtlMs`           | `number`                                     | no idle expiry                   | Expire idle sessions after this duration.                                                     |
+| `maxSessions`            | `number`                                     | `128`                            | Maximum active sessions.                                                                      |
+| `sessionTtlMs`           | `number`                                     | `900000`                         | Expire idle sessions after this duration.                                                     |
 | `maxStreamsPerSession`   | `number`                                     | `1`                              | Maximum concurrent GET SSE streams per session.                                               |
 | `maxStreamBufferBytes`   | `number`                                     | `1048576`                        | End a GET SSE stream before a live write when its buffered bytes exceed this limit.           |
 | `maxSseEventHistory`     | `number`                                     | `100`                            | Number of server-sent events retained for `Last-Event-ID` replay.                             |
@@ -535,8 +535,8 @@ Returned by `listenHttp()`:
 | `allowedOrigins`         | `readonly string[]`                          | `[]`               | Allowed CORS origins.                                                                     |
 | `maxRequestBytes`        | `number`                                     | unlimited          | Maximum JSON request body size.                                                           |
 | `maxBatchSize`           | `number`                                     | unlimited          | Maximum JSON-RPC batch member count.                                                      |
-| `maxSessions`            | `number`                                     | unlimited          | Maximum active sessions.                                                                  |
-| `sessionTtlMs`           | `number`                                     | no idle expiry     | Idle session expiration window.                                                           |
+| `maxSessions`            | `number`                                     | `128`              | Maximum active sessions.                                                                  |
+| `sessionTtlMs`           | `number`                                     | `900000`           | Idle session expiration window.                                                           |
 | `maxStreamsPerSession`   | `number`                                     | `1`                | Maximum concurrent GET SSE streams per session.                                           |
 | `maxStreamBufferBytes`   | `number`                                     | `1048576`          | End a GET SSE stream before a live write when its buffered bytes exceed this limit.       |
 | `maxSseEventHistory`     | `number`                                     | `100`              | Number of SSE events retained for replay.                                                 |

package/dist/cli.js

@@ -31,8 +31,10 @@ const HELP_TEXT = [
     "                        Maximum JSON request body size",
     "  --max-batch-size <count>",
     "                        Maximum JSON-RPC batch member count",
-    "  --max-sessions <count> Maximum active sessions",
-    "  --session-ttl-ms <ms>  Expire sessions after this idle duration",
+    "  --max-sessions <count> Maximum active sessions (default: 128)",
+    "  --max-sessions-per-subject <count>",
+    "                        Maximum sessions per authenticated subject (default: 16)",
+    "  --session-ttl-ms <ms>  Expire idle sessions (default: 900000)",
     "  --max-streams-per-session <count>",
     "                        Maximum concurrent GET SSE streams per session",
     "  --max-stream-buffer-bytes <bytes>",
@@ -192,6 +194,7 @@ function parseCliOptions(args) {
             "max-request-bytes": { type: "string" },
             "max-batch-size": { type: "string" },
             "max-sessions": { type: "string" },
+            "max-sessions-per-subject": { type: "string" },
             "session-ttl-ms": { type: "string" },
             "max-streams-per-session": { type: "string" },
             "max-stream-buffer-bytes": { type: "string" },
@@ -217,6 +220,7 @@ function parseCliOptions(args) {
     const maxRequestBytes = parseOptionalInteger(values["max-request-bytes"], "--max-request-bytes", 1);
     const maxBatchSize = parseOptionalInteger(values["max-batch-size"], "--max-batch-size", 1);
     const maxSessions = parseOptionalInteger(values["max-sessions"], "--max-sessions", 1);
+    const maxSessionsPerSubject = parseOptionalInteger(values["max-sessions-per-subject"], "--max-sessions-per-subject", 1);
     const sessionTtlMs = parseOptionalInteger(values["session-ttl-ms"], "--session-ttl-ms", 1);
     const maxStreamsPerSession = parseOptionalInteger(values["max-streams-per-session"], "--max-streams-per-session", 1);
     const maxStreamBufferBytes = parseOptionalInteger(values["max-stream-buffer-bytes"], "--max-stream-buffer-bytes", 0);
@@ -246,6 +250,7 @@ function parseCliOptions(args) {
         ...(maxRequestBytes === undefined ? {} : { maxRequestBytes }),
         ...(maxBatchSize === undefined ? {} : { maxBatchSize }),
         ...(maxSessions === undefined ? {} : { maxSessions }),
+        ...(maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject }),
         ...(sessionTtlMs === undefined ? {} : { sessionTtlMs }),
         ...(maxStreamsPerSession === undefined ? {} : { maxStreamsPerSession }),
         ...(maxStreamBufferBytes === undefined ? {} : { maxStreamBufferBytes }),
@@ -392,6 +397,7 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
                 : { maxRequestBytes: options.maxRequestBytes }),
             ...(options.maxBatchSize === undefined ? {} : { maxBatchSize: options.maxBatchSize }),
             ...(options.maxSessions === undefined ? {} : { maxSessions: options.maxSessions }),
+            ...(options.maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject: options.maxSessionsPerSubject }),
             ...(options.sessionTtlMs === undefined ? {} : { sessionTtlMs: options.sessionTtlMs }),
             ...(options.maxStreamsPerSession === undefined
                 ? {}

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.10",
+      "version": "0.1.12",
       "license": "MIT"
     },
     {

package/dist/http-transport.d.ts

@@ -66,6 +66,8 @@ export interface StreamableHttpTransportOptions {
     maxRequestBytes?: number;
     maxBatchSize?: number;
     maxSessions?: number;
+    /** Maximum sessions per authenticated subject or client ID; defaults to 16. */
+    maxSessionsPerSubject?: number;
     sessionTtlMs?: number;
     maxStreamsPerSession?: number;
     maxStreamBufferBytes?: number;
@@ -88,6 +90,7 @@ export declare class StreamableHttpTransport {
     private readonly maxRequestBytes;
     private readonly maxBatchSize;
     private readonly maxSessions;
+    private readonly maxSessionsPerSubject;
     private readonly sessionTtlMs;
     private readonly maxStreamsPerSession;
     private readonly maxStreamBufferBytes;
@@ -128,6 +131,7 @@ export declare class StreamableHttpTransport {
     private touchSession;
     private isExpired;
     private purgeExpiredSessions;
+    private sessions;
     private sessionCount;
     private deleteSession;
     private createLocalMessageSession;

package/dist/http-transport.js

@@ -27,6 +27,7 @@ export class StreamableHttpTransport {
     maxRequestBytes;
     maxBatchSize;
     maxSessions;
+    maxSessionsPerSubject;
     sessionTtlMs;
     maxStreamsPerSession;
     maxStreamBufferBytes;
@@ -61,8 +62,10 @@ export class StreamableHttpTransport {
         this.allowedHosts = new Set((options.allowedHosts ?? LOCAL_HOSTS).map((host) => this.normalizeHost(host)));
         this.maxRequestBytes = validateOptionalIntegerOption("maxRequestBytes", options.maxRequestBytes, 1);
         this.maxBatchSize = validateOptionalIntegerOption("maxBatchSize", options.maxBatchSize, 1);
-        this.maxSessions = validateOptionalIntegerOption("maxSessions", options.maxSessions, 1);
-        this.sessionTtlMs = validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1);
+        this.maxSessions = validateOptionalIntegerOption("maxSessions", options.maxSessions, 1) ?? 128;
+        this.maxSessionsPerSubject =
+            validateOptionalIntegerOption("maxSessionsPerSubject", options.maxSessionsPerSubject, 1) ?? 16;
+        this.sessionTtlMs = validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1) ?? 15 * 60_000;
         this.maxStreamsPerSession =
             validateOptionalIntegerOption("maxStreamsPerSession", options.maxStreamsPerSession, 1) ?? 1;
         this.maxStreamBufferBytes =
@@ -77,7 +80,7 @@ export class StreamableHttpTransport {
         this.requestIdGenerator = options.requestIdGenerator ?? (() => `req-${this.nextRequestId++}`);
         this.observability = options.observability ?? {};
         this.trustedProxy = options.trustedProxy ?? false;
-        if (this.sessionTtlMs !== undefined) {
+        if (this.sessionIdGenerator !== undefined) {
             this.sessionExpiryInterval = setInterval(() => {
                 try {
                     this.purgeExpiredSessions();
@@ -228,10 +231,16 @@ export class StreamableHttpTransport {
                     this.respondWithRejection(res, 400, "session_id_required", "Mcp-Session-Id is required; initialize a session first.");
                     return;
                 }
-                if (this.maxSessions !== undefined && this.sessionCount() >= this.maxSessions) {
+                this.purgeExpiredSessions();
+                if (this.sessionCount() >= this.maxSessions) {
                     this.respondWithRejection(res, 503, "session_limit_reached", "The server has reached its session limit; close a session or retry later.");
                     return;
                 }
+                const authSubject = this.readAuthSubject(req);
+                if (authSubject !== undefined && this.sessionCount(authSubject) >= this.maxSessionsPerSubject) {
+                    this.respondWithRejection(res, 429, "subject_session_limit_reached", "The authenticated subject has reached its session limit; close a session or retry later.");
+                    return;
+                }
                 const newSessionId = this.sessionIdGenerator();
                 if (!this.isValidNewSessionId(newSessionId)) {
                     this.respondWithStatus(res, 500);
@@ -239,7 +248,6 @@ export class StreamableHttpTransport {
                 }
                 sessionId = newSessionId;
                 activeSession = this.sessionStore.create(newSessionId);
-                const authSubject = this.readAuthSubject(req);
                 if (authSubject !== undefined) {
                     activeSession.authSubject = authSubject;
                 }
@@ -562,26 +570,37 @@ export class StreamableHttpTransport {
         session.lastSeenAt = new Date();
     }
     isExpired(session) {
-        if (this.sessionTtlMs === undefined) {
-            return false;
-        }
         return Date.now() - session.lastSeenAt.getTime() > this.sessionTtlMs;
     }
     purgeExpiredSessions() {
-        if (this.sessionTtlMs === undefined || this.sessionStore.entries === undefined) {
-            return;
-        }
-        for (const session of [...this.sessionStore.entries()]) {
+        for (const session of [...this.sessions()]) {
             if (this.isExpired(session)) {
                 this.deleteSession(session.id, "expired");
             }
         }
     }
-    sessionCount() {
+    *sessions() {
         if (this.sessionStore.entries !== undefined) {
-            return [...this.sessionStore.entries()].length;
+            yield* this.sessionStore.entries();
+        }
+        else {
+            for (const id of this.sessionMessages.keys()) {
+                const session = this.sessionStore.get(id);
+                if (session !== undefined)
+                    yield session;
+            }
+        }
+    }
+    sessionCount(authSubject) {
+        if (authSubject === undefined && this.sessionStore.entries === undefined) {
+            return this.sessionMessages.size;
+        }
+        let count = 0;
+        for (const session of this.sessions()) {
+            if (authSubject === undefined || session.authSubject === authSubject)
+                count++;
         }
-        return this.sessionMessages.size;
+        return count;
     }
     deleteSession(sessionId, reason) {
         const deleted = this.sessionStore.delete(sessionId);

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -567,6 +567,7 @@ declare class HttpTransport implements McpTransport {
     private cancelOpenSseReaders;
     private fetchWithAbort;
     private consumeWrittenLines;
+    private sendPost;
     private createPostHeaders;
     private createGetHeaders;
     private createDeleteHeaders;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -2919,6 +2919,9 @@ var HttpTransport = class {
     this.openSseReaders.clear();
   }
   async fetchWithAbort(input, init) {
+    if (this.disposed) {
+      throw new Error("HTTP transport disposed");
+    }
     const abortController = new AbortController();
     this.inFlightFetchAbortControllers.add(abortController);
     try {
@@ -2935,25 +2938,44 @@ var HttpTransport = class {
       if (this.disposed || line.length === 0) {
         continue;
       }
-      const hasSessionId = this.sessionId !== void 0;
-      const response = await this.fetchWithOAuthRetry({
-        method: "POST",
-        createHeaders: () => this.createPostHeaders(),
-        body: line
-      });
-      if (hasSessionId && response.status === 404) {
-        this.sessionId = void 0;
-        this.dispose(new Error("HTTP transport session expired (404 response)"));
-        return;
+      const parsed = parseJsonRpcMessage(line);
+      const post = this.sendPost(line);
+      if (parsed.type === "request" && parsed.message.method === "initialize" || parsed.type === "notification" && parsed.message.method === "notifications/initialized") {
+        await post;
+      } else {
+        void post.catch((error) => {
+          this.dispose(error instanceof Error ? error : new Error(String(error)));
+        });
       }
-      await this.throwForPostHttpError(response);
-      this.captureSessionId(response);
-      this.maybeOpenGetSseStream();
-      void this.forwardResponseMessages(response).catch((error) => {
-        this.dispose(error instanceof Error ? error : new Error(String(error)));
-      });
     }
   }
+  async sendPost(line) {
+    const hasSessionId = this.sessionId !== void 0;
+    const response = await this.fetchWithOAuthRetry({
+      method: "POST",
+      createHeaders: () => this.createPostHeaders(),
+      body: line
+    });
+    if (this.disposed) {
+      await response.body?.cancel();
+      return;
+    }
+    if (hasSessionId && response.status === 404) {
+      this.sessionId = void 0;
+      this.dispose(new Error("HTTP transport session expired (404 response)"));
+      return;
+    }
+    await this.throwForPostHttpError(response);
+    if (this.disposed) {
+      await response.body?.cancel();
+      return;
+    }
+    this.captureSessionId(response);
+    this.maybeOpenGetSseStream();
+    void this.forwardResponseMessages(response).catch((error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+  }
   async createPostHeaders() {
     const headers = new Headers(this.headers);
     headers.set("Accept", "application/json, text/event-stream");
@@ -3750,6 +3772,19 @@ function isJsonRpcErrorObject(value) {
   }
   return value.data === void 0 || hasOwn(value, "data");
 }
+function parseJsonRpcMessage(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return {
+      type: "invalid",
+      id: null,
+      error: parseError()
+    };
+  }
+  return parseJsonRpcPayload(parsed);
+}
 function parseJsonRpcPayload(parsed) {
   if (!isObjectRecord5(parsed)) {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",