tiny-http-mcp-server 0.1.11 → 0.1.12

package/README.md

@@ -430,8 +430,8 @@ Returned `HttpServer` instances support:
 | `allowedOrigins`         | `readonly string[]`                          | `[]`                             | Allowed CORS `Origin` values. Empty means no cross-origin browser clients are allowed.        |
 | `maxRequestBytes`        | `number`                                     | unlimited                        | Maximum JSON request body size.                                                               |
 | `maxBatchSize`           | `number`                                     | unlimited                        | Maximum JSON-RPC batch member count.                                                          |
-| `maxSessions`            | `number`                                     | unlimited                        | Maximum active sessions.                                                                      |
-| `sessionTtlMs`           | `number`                                     | no idle expiry                   | Expire idle sessions after this duration.                                                     |
+| `maxSessions`            | `number`                                     | `128`                            | Maximum active sessions.                                                                      |
+| `sessionTtlMs`           | `number`                                     | `900000`                         | Expire idle sessions after this duration.                                                     |
 | `maxStreamsPerSession`   | `number`                                     | `1`                              | Maximum concurrent GET SSE streams per session.                                               |
 | `maxStreamBufferBytes`   | `number`                                     | `1048576`                        | End a GET SSE stream before a live write when its buffered bytes exceed this limit.           |
 | `maxSseEventHistory`     | `number`                                     | `100`                            | Number of server-sent events retained for `Last-Event-ID` replay.                             |
@@ -535,8 +535,8 @@ Returned by `listenHttp()`:
 | `allowedOrigins`         | `readonly string[]`                          | `[]`               | Allowed CORS origins.                                                                     |
 | `maxRequestBytes`        | `number`                                     | unlimited          | Maximum JSON request body size.                                                           |
 | `maxBatchSize`           | `number`                                     | unlimited          | Maximum JSON-RPC batch member count.                                                      |
-| `maxSessions`            | `number`                                     | unlimited          | Maximum active sessions.                                                                  |
-| `sessionTtlMs`           | `number`                                     | no idle expiry     | Idle session expiration window.                                                           |
+| `maxSessions`            | `number`                                     | `128`              | Maximum active sessions.                                                                  |
+| `sessionTtlMs`           | `number`                                     | `900000`           | Idle session expiration window.                                                           |
 | `maxStreamsPerSession`   | `number`                                     | `1`                | Maximum concurrent GET SSE streams per session.                                           |
 | `maxStreamBufferBytes`   | `number`                                     | `1048576`          | End a GET SSE stream before a live write when its buffered bytes exceed this limit.       |
 | `maxSseEventHistory`     | `number`                                     | `100`              | Number of SSE events retained for replay.                                                 |

package/dist/cli.js

@@ -31,8 +31,10 @@ const HELP_TEXT = [
     "                        Maximum JSON request body size",
     "  --max-batch-size <count>",
     "                        Maximum JSON-RPC batch member count",
-    "  --max-sessions <count> Maximum active sessions",
-    "  --session-ttl-ms <ms>  Expire sessions after this idle duration",
+    "  --max-sessions <count> Maximum active sessions (default: 128)",
+    "  --max-sessions-per-subject <count>",
+    "                        Maximum sessions per authenticated subject (default: 16)",
+    "  --session-ttl-ms <ms>  Expire idle sessions (default: 900000)",
     "  --max-streams-per-session <count>",
     "                        Maximum concurrent GET SSE streams per session",
     "  --max-stream-buffer-bytes <bytes>",
@@ -192,6 +194,7 @@ function parseCliOptions(args) {
             "max-request-bytes": { type: "string" },
             "max-batch-size": { type: "string" },
             "max-sessions": { type: "string" },
+            "max-sessions-per-subject": { type: "string" },
             "session-ttl-ms": { type: "string" },
             "max-streams-per-session": { type: "string" },
             "max-stream-buffer-bytes": { type: "string" },
@@ -217,6 +220,7 @@ function parseCliOptions(args) {
     const maxRequestBytes = parseOptionalInteger(values["max-request-bytes"], "--max-request-bytes", 1);
     const maxBatchSize = parseOptionalInteger(values["max-batch-size"], "--max-batch-size", 1);
     const maxSessions = parseOptionalInteger(values["max-sessions"], "--max-sessions", 1);
+    const maxSessionsPerSubject = parseOptionalInteger(values["max-sessions-per-subject"], "--max-sessions-per-subject", 1);
     const sessionTtlMs = parseOptionalInteger(values["session-ttl-ms"], "--session-ttl-ms", 1);
     const maxStreamsPerSession = parseOptionalInteger(values["max-streams-per-session"], "--max-streams-per-session", 1);
     const maxStreamBufferBytes = parseOptionalInteger(values["max-stream-buffer-bytes"], "--max-stream-buffer-bytes", 0);
@@ -246,6 +250,7 @@ function parseCliOptions(args) {
         ...(maxRequestBytes === undefined ? {} : { maxRequestBytes }),
         ...(maxBatchSize === undefined ? {} : { maxBatchSize }),
         ...(maxSessions === undefined ? {} : { maxSessions }),
+        ...(maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject }),
         ...(sessionTtlMs === undefined ? {} : { sessionTtlMs }),
         ...(maxStreamsPerSession === undefined ? {} : { maxStreamsPerSession }),
         ...(maxStreamBufferBytes === undefined ? {} : { maxStreamBufferBytes }),
@@ -392,6 +397,7 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
                 : { maxRequestBytes: options.maxRequestBytes }),
             ...(options.maxBatchSize === undefined ? {} : { maxBatchSize: options.maxBatchSize }),
             ...(options.maxSessions === undefined ? {} : { maxSessions: options.maxSessions }),
+            ...(options.maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject: options.maxSessionsPerSubject }),
             ...(options.sessionTtlMs === undefined ? {} : { sessionTtlMs: options.sessionTtlMs }),
             ...(options.maxStreamsPerSession === undefined
                 ? {}

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.11",
+      "version": "0.1.12",
       "license": "MIT"
     },
     {

package/dist/http-transport.d.ts

@@ -66,6 +66,8 @@ export interface StreamableHttpTransportOptions {
     maxRequestBytes?: number;
     maxBatchSize?: number;
     maxSessions?: number;
+    /** Maximum sessions per authenticated subject or client ID; defaults to 16. */
+    maxSessionsPerSubject?: number;
     sessionTtlMs?: number;
     maxStreamsPerSession?: number;
     maxStreamBufferBytes?: number;
@@ -88,6 +90,7 @@ export declare class StreamableHttpTransport {
     private readonly maxRequestBytes;
     private readonly maxBatchSize;
     private readonly maxSessions;
+    private readonly maxSessionsPerSubject;
     private readonly sessionTtlMs;
     private readonly maxStreamsPerSession;
     private readonly maxStreamBufferBytes;
@@ -128,6 +131,7 @@ export declare class StreamableHttpTransport {
     private touchSession;
     private isExpired;
     private purgeExpiredSessions;
+    private sessions;
     private sessionCount;
     private deleteSession;
     private createLocalMessageSession;

package/dist/http-transport.js

@@ -27,6 +27,7 @@ export class StreamableHttpTransport {
     maxRequestBytes;
     maxBatchSize;
     maxSessions;
+    maxSessionsPerSubject;
     sessionTtlMs;
     maxStreamsPerSession;
     maxStreamBufferBytes;
@@ -61,8 +62,10 @@ export class StreamableHttpTransport {
         this.allowedHosts = new Set((options.allowedHosts ?? LOCAL_HOSTS).map((host) => this.normalizeHost(host)));
         this.maxRequestBytes = validateOptionalIntegerOption("maxRequestBytes", options.maxRequestBytes, 1);
         this.maxBatchSize = validateOptionalIntegerOption("maxBatchSize", options.maxBatchSize, 1);
-        this.maxSessions = validateOptionalIntegerOption("maxSessions", options.maxSessions, 1);
-        this.sessionTtlMs = validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1);
+        this.maxSessions = validateOptionalIntegerOption("maxSessions", options.maxSessions, 1) ?? 128;
+        this.maxSessionsPerSubject =
+            validateOptionalIntegerOption("maxSessionsPerSubject", options.maxSessionsPerSubject, 1) ?? 16;
+        this.sessionTtlMs = validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1) ?? 15 * 60_000;
         this.maxStreamsPerSession =
             validateOptionalIntegerOption("maxStreamsPerSession", options.maxStreamsPerSession, 1) ?? 1;
         this.maxStreamBufferBytes =
@@ -77,7 +80,7 @@ export class StreamableHttpTransport {
         this.requestIdGenerator = options.requestIdGenerator ?? (() => `req-${this.nextRequestId++}`);
         this.observability = options.observability ?? {};
         this.trustedProxy = options.trustedProxy ?? false;
-        if (this.sessionTtlMs !== undefined) {
+        if (this.sessionIdGenerator !== undefined) {
             this.sessionExpiryInterval = setInterval(() => {
                 try {
                     this.purgeExpiredSessions();
@@ -228,10 +231,16 @@ export class StreamableHttpTransport {
                     this.respondWithRejection(res, 400, "session_id_required", "Mcp-Session-Id is required; initialize a session first.");
                     return;
                 }
-                if (this.maxSessions !== undefined && this.sessionCount() >= this.maxSessions) {
+                this.purgeExpiredSessions();
+                if (this.sessionCount() >= this.maxSessions) {
                     this.respondWithRejection(res, 503, "session_limit_reached", "The server has reached its session limit; close a session or retry later.");
                     return;
                 }
+                const authSubject = this.readAuthSubject(req);
+                if (authSubject !== undefined && this.sessionCount(authSubject) >= this.maxSessionsPerSubject) {
+                    this.respondWithRejection(res, 429, "subject_session_limit_reached", "The authenticated subject has reached its session limit; close a session or retry later.");
+                    return;
+                }
                 const newSessionId = this.sessionIdGenerator();
                 if (!this.isValidNewSessionId(newSessionId)) {
                     this.respondWithStatus(res, 500);
@@ -239,7 +248,6 @@ export class StreamableHttpTransport {
                 }
                 sessionId = newSessionId;
                 activeSession = this.sessionStore.create(newSessionId);
-                const authSubject = this.readAuthSubject(req);
                 if (authSubject !== undefined) {
                     activeSession.authSubject = authSubject;
                 }
@@ -562,26 +570,37 @@ export class StreamableHttpTransport {
         session.lastSeenAt = new Date();
     }
     isExpired(session) {
-        if (this.sessionTtlMs === undefined) {
-            return false;
-        }
         return Date.now() - session.lastSeenAt.getTime() > this.sessionTtlMs;
     }
     purgeExpiredSessions() {
-        if (this.sessionTtlMs === undefined || this.sessionStore.entries === undefined) {
-            return;
-        }
-        for (const session of [...this.sessionStore.entries()]) {
+        for (const session of [...this.sessions()]) {
             if (this.isExpired(session)) {
                 this.deleteSession(session.id, "expired");
             }
         }
     }
-    sessionCount() {
+    *sessions() {
         if (this.sessionStore.entries !== undefined) {
-            return [...this.sessionStore.entries()].length;
+            yield* this.sessionStore.entries();
+        }
+        else {
+            for (const id of this.sessionMessages.keys()) {
+                const session = this.sessionStore.get(id);
+                if (session !== undefined)
+                    yield session;
+            }
+        }
+    }
+    sessionCount(authSubject) {
+        if (authSubject === undefined && this.sessionStore.entries === undefined) {
+            return this.sessionMessages.size;
+        }
+        let count = 0;
+        for (const session of this.sessions()) {
+            if (authSubject === undefined || session.authSubject === authSubject)
+                count++;
         }
-        return this.sessionMessages.size;
+        return count;
     }
     deleteSession(sessionId, reason) {
         const deleted = this.sessionStore.delete(sessionId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",