tiny-http-mcp-server 0.1.16 → 0.1.18

package/dist/cli.js

@@ -29,6 +29,8 @@ const HELP_TEXT = [
     "  --allowed-origin <url> Allowed CORS Origin value (repeatable)",
     "  --max-request-bytes <bytes>",
     "                        Maximum JSON request body size",
+    "  --max-response-bytes <bytes>",
+    "                        Maximum JSON body or SSE frame size (default: 16777216)",
     "  --max-batch-size <count>",
     "                        Maximum JSON-RPC batch member count",
     "  --max-sessions <count> Maximum active sessions (default: 128)",
@@ -38,13 +40,15 @@ const HELP_TEXT = [
     "  --max-streams-per-session <count>",
     "                        Maximum concurrent GET SSE streams per session",
     "  --max-stream-buffer-bytes <bytes>",
-    "                        Maximum buffered bytes per GET SSE stream (default: 1048576)",
+    "                        Maximum buffered bytes per SSE stream (default: 1048576)",
     "  --max-sse-event-history <count>",
     "                        Number of SSE events retained for Last-Event-ID replay",
     "  --sse-keep-alive-ms <ms>",
-    "                        GET SSE keepalive interval (default: 30000; 0 disables)",
+    "                        SSE keepalive interval (default: 30000; 0 disables)",
     "  --max-concurrent-tool-calls <count>",
     "                        Maximum concurrent tool calls across sessions (default: 4)",
+    "  --max-active-requests <count>",
+    "                        Maximum active requests across connections (default: 128)",
     "  --max-queued-tool-calls <count>",
     "                        Maximum waiting tool calls (default: 64; 0 disables waiting)",
     "  --trusted-proxy        Trust X-Forwarded-Proto and X-Forwarded-Host",
@@ -194,6 +198,7 @@ function parseCliOptions(args) {
             "allowed-host": { type: "string", multiple: true },
             "allowed-origin": { type: "string", multiple: true },
             "max-request-bytes": { type: "string" },
+            "max-response-bytes": { type: "string" },
             "max-batch-size": { type: "string" },
             "max-sessions": { type: "string" },
             "max-sessions-per-subject": { type: "string" },
@@ -203,6 +208,7 @@ function parseCliOptions(args) {
             "max-sse-event-history": { type: "string" },
             "sse-keep-alive-ms": { type: "string" },
             "max-concurrent-tool-calls": { type: "string" },
+            "max-active-requests": { type: "string" },
             "max-queued-tool-calls": { type: "string" },
             "trusted-proxy": { type: "boolean" },
             "request-timeout-ms": { type: "string" },
@@ -222,6 +228,7 @@ function parseCliOptions(args) {
     });
     const maxRequestBytes = parseOptionalInteger(values["max-request-bytes"], "--max-request-bytes", 1);
     const maxBatchSize = parseOptionalInteger(values["max-batch-size"], "--max-batch-size", 1);
+    const maxResponseBytes = parseOptionalInteger(values["max-response-bytes"], "--max-response-bytes", 1);
     const maxSessions = parseOptionalInteger(values["max-sessions"], "--max-sessions", 1);
     const maxSessionsPerSubject = parseOptionalInteger(values["max-sessions-per-subject"], "--max-sessions-per-subject", 1);
     const sessionTtlMs = parseOptionalInteger(values["session-ttl-ms"], "--session-ttl-ms", 1);
@@ -231,6 +238,7 @@ function parseCliOptions(args) {
     const sseKeepAliveMs = parseOptionalInteger(values["sse-keep-alive-ms"], "--sse-keep-alive-ms", 0);
     const maxConcurrentToolCalls = parseOptionalInteger(values["max-concurrent-tool-calls"], "--max-concurrent-tool-calls", 1);
     const maxQueuedToolCalls = parseOptionalInteger(values["max-queued-tool-calls"], "--max-queued-tool-calls", 0);
+    const maxActiveRequests = parseOptionalInteger(values["max-active-requests"], "--max-active-requests", 1);
     const requestTimeoutMs = parseOptionalInteger(values["request-timeout-ms"], "--request-timeout-ms", 0);
     const headersTimeoutMs = parseOptionalInteger(values["headers-timeout-ms"], "--headers-timeout-ms", 0);
     const keepAliveTimeoutMs = parseOptionalInteger(values["keep-alive-timeout-ms"], "--keep-alive-timeout-ms", 0);
@@ -252,6 +260,7 @@ function parseCliOptions(args) {
             }
             : {}),
         ...(maxRequestBytes === undefined ? {} : { maxRequestBytes }),
+        ...(maxResponseBytes === undefined ? {} : { maxResponseBytes }),
         ...(maxBatchSize === undefined ? {} : { maxBatchSize }),
         ...(maxSessions === undefined ? {} : { maxSessions }),
         ...(maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject }),
@@ -261,6 +270,7 @@ function parseCliOptions(args) {
         ...(maxSseEventHistory === undefined ? {} : { maxSseEventHistory }),
         ...(sseKeepAliveMs === undefined ? {} : { sseKeepAliveMs }),
         ...(maxConcurrentToolCalls === undefined ? {} : { maxConcurrentToolCalls }),
+        ...(maxActiveRequests === undefined ? {} : { maxActiveRequests }),
         ...(maxQueuedToolCalls === undefined ? {} : { maxQueuedToolCalls }),
         trustedProxy: values["trusted-proxy"] ?? false,
         ...(requestTimeoutMs === undefined ? {} : { requestTimeoutMs }),
@@ -400,6 +410,7 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
             ...(options.maxRequestBytes === undefined
                 ? {}
                 : { maxRequestBytes: options.maxRequestBytes }),
+            ...(options.maxResponseBytes === undefined ? {} : { maxResponseBytes: options.maxResponseBytes }),
             ...(options.maxBatchSize === undefined ? {} : { maxBatchSize: options.maxBatchSize }),
             ...(options.maxSessions === undefined ? {} : { maxSessions: options.maxSessions }),
             ...(options.maxSessionsPerSubject === undefined ? {} : { maxSessionsPerSubject: options.maxSessionsPerSubject }),
@@ -418,6 +429,7 @@ export async function runCli(args = process.argv.slice(2), dependencies = {}) {
                 ? {}
                 : { maxConcurrentToolCalls: options.maxConcurrentToolCalls }),
             ...(options.maxQueuedToolCalls === undefined ? {} : { maxQueuedToolCalls: options.maxQueuedToolCalls }),
+            ...(options.maxActiveRequests === undefined ? {} : { maxActiveRequests: options.maxActiveRequests }),
             ...(options.trustedProxy ? { trustedProxy: true } : {}),
             ...(oauth === undefined ? {} : { oauth })
         });

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.16",
+      "version": "0.1.18",
       "license": "MIT"
     },
     {

package/dist/http-server.d.ts

@@ -1,5 +1,5 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
-import { type Server, type ServerOptions, type ToolDefinition, type CallToolResult, type ToolReturn, type TypedSchema } from "tiny-stdio-mcp-server";
+import { type Server, type ServerOptions, type ToolDefinition, type CallToolResult, type InputRequiredResult, type HandlerRequestContext, type ToolReturn, type TypedSchema, type TypedOutputSchema } from "tiny-stdio-mcp-server";
 import { type AuthenticatedIncomingMessage, type TokenVerifier, type VerifiedAccessToken, type RequestAuthInfo } from "./auth.js";
 import { type HttpObservabilityEvent, type StreamableHttpTransportOptions } from "./http-transport.js";
 export interface ProtectedResourceMetadataOptions {
@@ -33,18 +33,20 @@ export interface HttpServerHandle {
     closeAllConnections(): void;
 }
 export interface HttpServer extends Omit<Server, "tool" | "registerTool"> {
-    tool<TIn, TOut = never>(name: string, description: string, inputSchema: TypedSchema<TIn>, handler: HttpToolHandler<TIn, TOut>, outputSchema?: TypedSchema<TOut>): HttpServer;
+    tool<TIn, TOut = never>(name: string, description: string, inputSchema: TypedSchema<TIn>, handler: HttpToolHandler<TIn, TOut>, outputSchema?: TypedOutputSchema<TOut>): HttpServer;
     registerTool<TIn, TOut = never>(definition: Omit<ToolDefinition<TIn, TOut>, "handler">, handler: HttpToolHandler<TIn, TOut>): HttpServer;
     listenHttp(options?: HttpListenOptions): Promise<HttpServerHandle>;
     handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    getRequestContext(): HttpToolContext | undefined;
+    getRequestContext(): HttpRequestContext | undefined;
 }
-export interface HttpToolContext {
+export interface HttpRequestContext {
     request: AuthenticatedIncomingMessage;
     sessionId?: string;
     auth?: RequestAuthInfo;
 }
-export type HttpToolHandler<T = Record<string, unknown>, TOut = ToolReturn> = (args: T, context: HttpToolContext) => Promise<TOut | CallToolResult> | TOut | CallToolResult;
+export interface HttpToolContext extends HttpRequestContext, HandlerRequestContext {
+}
+export type HttpToolHandler<T = Record<string, unknown>, TOut = ToolReturn> = (args: T, context: HttpToolContext) => Promise<TOut | CallToolResult | InputRequiredResult> | TOut | CallToolResult | InputRequiredResult;
 export declare function createProtectedResourceMetadataDocument(options: ProtectedResourceMetadataOptions): Record<string, unknown>;
 export declare function createHttpServer(options: HttpTransportOptions): HttpServer;
 export type { RequestAuthInfo, TokenVerifier, VerifiedAccessToken };

package/dist/http-server.js

@@ -87,12 +87,7 @@ export function createProtectedResourceMetadataDocument(options) {
 }
 export function createHttpServer(options) {
     const requestContextStorage = new AsyncLocalStorage();
-    const supportsSessions = !hasOwnProperty(options, "sessionIdGenerator") || options.sessionIdGenerator !== undefined;
-    const server = createServer({
-        ...options,
-        supportNotifications: supportsSessions,
-        supportResourceSubscriptions: supportsSessions
-    });
+    const server = createServer(options);
     const transport = new StreamableHttpTransport(server, options, async (req, callback) => requestContextStorage.run({
         request: req,
         sessionId: Array.isArray(req.headers["mcp-session-id"])
@@ -144,11 +139,11 @@ export function createHttpServer(options) {
         return true;
     };
     httpServer.tool = (name, description, inputSchema, handler, outputSchema) => {
-        registerTool(name, description, inputSchema, (args) => handler(args, requestContextStorage.getStore() ?? defaultContext), outputSchema);
+        registerTool(name, description, inputSchema, (args, context) => handler(args, { ...(requestContextStorage.getStore() ?? defaultContext), ...context }), outputSchema);
         return httpServer;
     };
     httpServer.registerTool = (definition, handler) => {
-        registerRichTool(definition, (args) => handler(args, requestContextStorage.getStore() ?? defaultContext));
+        registerRichTool(definition, (args, context) => handler(args, { ...(requestContextStorage.getStore() ?? defaultContext), ...context }));
         return httpServer;
     };
     httpServer.listenHttp = async (listenOptions = {}) => {
@@ -265,6 +260,3 @@ export function createHttpServer(options) {
     httpServer.getRequestContext = () => requestContextStorage.getStore();
     return httpServer;
 }
-function hasOwnProperty(value, key) {
-    return Object.prototype.hasOwnProperty.call(value, key);
-}

package/dist/http-transport.d.ts

@@ -64,6 +64,7 @@ export interface StreamableHttpTransportOptions {
     allowedOrigins?: readonly string[];
     allowedHosts?: readonly string[];
     maxRequestBytes?: number;
+    maxResponseBytes?: number;
     maxBatchSize?: number;
     maxSessions?: number;
     /** Maximum sessions per authenticated subject or client ID; defaults to 16. */
@@ -88,6 +89,7 @@ export declare class StreamableHttpTransport {
     private readonly allowedOrigins;
     private readonly allowedHosts;
     private readonly maxRequestBytes;
+    private readonly maxResponseBytes;
     private readonly maxBatchSize;
     private readonly maxSessions;
     private readonly maxSessionsPerSubject;
@@ -108,6 +110,8 @@ export declare class StreamableHttpTransport {
     private readonly responseRequestIds;
     private readonly responseOrigins;
     private readonly responseRejectionReasons;
+    private readonly modernRequests;
+    private readonly modernStreams;
     private nextNotificationEventId;
     private nextRequestId;
     private activeToolCalls;
@@ -118,6 +122,7 @@ export declare class StreamableHttpTransport {
     handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void>;
     close(): Promise<void>;
     private handlePost;
+    private handleModernPost;
     private handleGet;
     private handleDelete;
     private handleOptions;
@@ -143,7 +148,7 @@ export declare class StreamableHttpTransport {
     private stopSseKeepAliveIfIdle;
     private stopSseKeepAlive;
     private sendNotificationToSession;
-    private writeToLiveGetStream;
+    private writeToLiveStream;
     private recordSseEvent;
     private replaySseEvents;
     private isJsonRequest;

package/dist/http-transport.js

@@ -4,6 +4,7 @@ import { formatErrorResponse, formatSuccessResponse } from "tiny-stdio-mcp-serve
 import { JsonRpcMessageError, readAndClassifyBody } from "./parse-body.js";
 import { createSessionStore, defaultSessionIdGenerator } from "./session.js";
 import { formatSseEvent, SSE_HEADERS } from "./sse.js";
+import { validateModernHeaders } from "./modern-headers.js";
 const ALLOWED_METHODS = "POST, GET, DELETE, OPTIONS";
 const MCP_SESSION_ID_HEADER = "Mcp-Session-Id";
 const LOCAL_HOSTS = ["localhost", "127.0.0.1", "::1"];
@@ -25,6 +26,7 @@ export class StreamableHttpTransport {
     allowedOrigins;
     allowedHosts;
     maxRequestBytes;
+    maxResponseBytes;
     maxBatchSize;
     maxSessions;
     maxSessionsPerSubject;
@@ -45,6 +47,8 @@ export class StreamableHttpTransport {
     responseRequestIds = new WeakMap();
     responseOrigins = new WeakMap();
     responseRejectionReasons = new WeakMap();
+    modernRequests = new Map();
+    modernStreams = new Set();
     nextNotificationEventId = 1;
     nextRequestId = 1;
     activeToolCalls = 0;
@@ -62,10 +66,13 @@ export class StreamableHttpTransport {
         this.allowedHosts = new Set((options.allowedHosts ?? LOCAL_HOSTS).map((host) => this.normalizeHost(host)));
         this.maxRequestBytes = validateOptionalIntegerOption("maxRequestBytes", options.maxRequestBytes, 1);
         this.maxBatchSize = validateOptionalIntegerOption("maxBatchSize", options.maxBatchSize, 1);
+        this.maxResponseBytes = validateOptionalIntegerOption("maxResponseBytes", options.maxResponseBytes, 1) ?? 16 * 1024 * 1024;
         this.maxSessions = validateOptionalIntegerOption("maxSessions", options.maxSessions, 1) ?? 128;
         this.maxSessionsPerSubject =
-            validateOptionalIntegerOption("maxSessionsPerSubject", options.maxSessionsPerSubject, 1) ?? 16;
-        this.sessionTtlMs = validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1) ?? 15 * 60_000;
+            validateOptionalIntegerOption("maxSessionsPerSubject", options.maxSessionsPerSubject, 1) ??
+                16;
+        this.sessionTtlMs =
+            validateOptionalIntegerOption("sessionTtlMs", options.sessionTtlMs, 1) ?? 15 * 60_000;
         this.maxStreamsPerSession =
             validateOptionalIntegerOption("maxStreamsPerSession", options.maxStreamsPerSession, 1) ?? 1;
         this.maxStreamBufferBytes =
@@ -120,6 +127,12 @@ export class StreamableHttpTransport {
                 this.respondWithRejection(res, 403, "origin_not_allowed", `Origin ${JSON.stringify(this.readOrigin(req) ?? "")} is not allowed; add it to allowedOrigins.`);
                 return;
             }
+            if (req.headers["mcp-protocol-version"] === "2026-07-28" &&
+                req.method !== "POST" &&
+                req.method !== "OPTIONS") {
+                this.respondWithStatus(res, 405, undefined, { Allow: "POST, OPTIONS" });
+                return;
+            }
             switch (req.method) {
                 case "POST":
                     await this.handlePost(req, res);
@@ -172,6 +185,12 @@ export class StreamableHttpTransport {
     }
     async close() {
         this.closed = true;
+        for (const [response, controller] of this.modernRequests) {
+            controller.abort();
+            response.end();
+        }
+        this.modernRequests.clear();
+        this.modernStreams.clear();
         if (this.sessionExpiryInterval !== undefined) {
             clearInterval(this.sessionExpiryInterval);
             this.sessionExpiryInterval = undefined;
@@ -221,6 +240,20 @@ export class StreamableHttpTransport {
             this.respondWithJsonRpcError(res, 400, code, message, id);
             return;
         }
+        const modern = req.headers["mcp-protocol-version"] === "2026-07-28" ||
+            classified.messages.some((message) => {
+                if (!("method" in message))
+                    return false;
+                const metadata = message.params?._meta;
+                return (message.method === "server/discover" ||
+                    (typeof metadata === "object" &&
+                        metadata !== null &&
+                        Object.prototype.hasOwnProperty.call(metadata, "io.modelcontextprotocol/protocolVersion")));
+            });
+        if (modern) {
+            await this.handleModernPost(req, res, classified);
+            return;
+        }
         const initMessage = classified.messages.find((message) => this.isRequest(message) && message.method === "initialize");
         let sessionId;
         let activeSession;
@@ -237,7 +270,8 @@ export class StreamableHttpTransport {
                     return;
                 }
                 const authSubject = this.readAuthSubject(req);
-                if (authSubject !== undefined && this.sessionCount(authSubject) >= this.maxSessionsPerSubject) {
+                if (authSubject !== undefined &&
+                    this.sessionCount(authSubject) >= this.maxSessionsPerSubject) {
                     this.respondWithRejection(res, 429, "subject_session_limit_reached", "The authenticated subject has reached its session limit; close a session or retry later.");
                     return;
                 }
@@ -283,6 +317,15 @@ export class StreamableHttpTransport {
                 if (!("method" in message)) {
                     continue;
                 }
+                if (this.sessionIdGenerator === undefined &&
+                    (message.method === "resources/subscribe" || message.method === "resources/unsubscribe")) {
+                    if (this.isRequest(message))
+                        responses.push(formatErrorResponse(message.id, {
+                            code: JSON_RPC_ERROR_CODES.METHOD_NOT_FOUND,
+                            message: "Method not found"
+                        }));
+                    continue;
+                }
                 const session = activeSession;
                 if (session !== undefined &&
                     message.method !== "initialize" &&
@@ -333,7 +376,23 @@ export class StreamableHttpTransport {
                         this.activeToolCalls -= 1;
                     }
                 }
-                const { error, result } = handled;
+                const { error } = handled;
+                let { result } = handled;
+                if (error === undefined &&
+                    message.method === "initialize" &&
+                    result !== undefined &&
+                    this.sessionIdGenerator === undefined) {
+                    const initialization = result;
+                    const capabilities = structuredClone(initialization.capabilities);
+                    for (const category of ["tools", "prompts", "resources"]) {
+                        const capability = capabilities[category];
+                        if (capability !== undefined)
+                            delete capability.listChanged;
+                    }
+                    if (capabilities.resources !== undefined)
+                        delete capabilities.resources.subscribe;
+                    result = { ...initialization, capabilities };
+                }
                 if (isToolCall) {
                     this.emit({
                         type: "tool.end",
@@ -380,12 +439,115 @@ export class StreamableHttpTransport {
             this.respondWithStatus(res, 200, sessionId, { "Content-Type": "application/json" }, body);
             return;
         }
+        const frames = formattedResponses.map((data) => formatSseEvent({ data }));
+        if (frames.some((frame) => Buffer.byteLength(frame, "utf8") > this.maxResponseBytes)) {
+            res.destroy();
+            return;
+        }
         res.writeHead(200, this.withSessionHeader(SSE_HEADERS, sessionId, res));
-        for (const formattedResponse of formattedResponses) {
-            res.write(formatSseEvent({ data: formattedResponse }));
+        for (const frame of frames) {
+            this.writeToLiveStream(res, frame);
         }
         res.end();
     }
+    async handleModernPost(req, res, body) {
+        const message = body.messages[0];
+        if (body.isBatch ||
+            body.messages.length !== 1 ||
+            message === undefined ||
+            !("method" in message)) {
+            this.respondWithJsonRpcError(res, 400, JSON_RPC_ERROR_CODES.INVALID_REQUEST, "Modern HTTP requires a single request or notification");
+            return;
+        }
+        const id = this.isRequest(message) ? message.id : null;
+        if (!this.acceptsResponseType(req, "application/json") ||
+            !this.acceptsResponseType(req, "text/event-stream")) {
+            this.respondWithRejection(res, 406, "response_type_not_acceptable", "Accept must allow application/json and text/event-stream.");
+            return;
+        }
+        const headerError = validateModernHeaders(req.headers, message);
+        if (headerError !== undefined) {
+            this.respondWithJsonRpcError(res, 400, headerError.code, headerError.message, id);
+            return;
+        }
+        const controller = new AbortController();
+        const cancel = () => controller.abort();
+        res.once("close", cancel);
+        req.once("aborted", cancel);
+        this.modernRequests.set(res, controller);
+        let streaming = false;
+        const write = (data) => {
+            if (controller.signal.aborted || res.destroyed || res.writableEnded)
+                return;
+            const frame = formatSseEvent({ data });
+            if (Buffer.byteLength(frame, "utf8") > this.maxResponseBytes) {
+                controller.abort(new Error("Modern SSE response size limit exceeded"));
+                res.destroy();
+                return;
+            }
+            if ((res.writableLength ?? 0) > this.maxStreamBufferBytes) {
+                controller.abort(new Error("Modern SSE output buffer limit exceeded"));
+                res.destroy();
+                return;
+            }
+            if (!streaming) {
+                res.writeHead(200, this.withSessionHeader({ ...SSE_HEADERS, "X-Accel-Buffering": "no" }, undefined, res));
+                streaming = true;
+                res.flushHeaders();
+                this.modernStreams.add(res);
+                this.startSseKeepAlive();
+            }
+            res.write(frame);
+        };
+        const session = this.server.createMessageSession((notification) => write(JSON.stringify(notification)));
+        try {
+            if (!this.isRequest(message) && !message.method.startsWith("notifications/")) {
+                this.respondWithJsonRpcError(res, 400, JSON_RPC_ERROR_CODES.INVALID_REQUEST, "A request ID is required");
+                return;
+            }
+            const handled = await this.runWithRequestContext(req, () => session.handleMessage(message.method, message.params, {
+                ...(this.isRequest(message) ? { requestId: message.id } : {}),
+                signal: controller.signal,
+                parameterHeaders: req.headers
+            }));
+            if (controller.signal.aborted || res.destroyed || res.writableEnded)
+                return;
+            if (!this.isRequest(message) ||
+                (handled.result === undefined && handled.error === undefined)) {
+                if (streaming)
+                    res.end();
+                else
+                    this.respondWithStatus(res, 202);
+                return;
+            }
+            const formatted = handled.error === undefined
+                ? formatSuccessResponse(message.id, handled.result)
+                : formatErrorResponse(message.id, handled.error);
+            const status = handled.error?.code === JSON_RPC_ERROR_CODES.METHOD_NOT_FOUND
+                ? 404
+                : handled.error?.code === JSON_RPC_ERROR_CODES.INVALID_PARAMS ||
+                    handled.error?.code === JSON_RPC_ERROR_CODES.UNSUPPORTED_PROTOCOL_VERSION ||
+                    handled.error?.code === -32020 ||
+                    handled.error?.code === -32021
+                    ? 400
+                    : 200;
+            if (streaming || (!this.enableJsonResponse && status === 200)) {
+                write(formatted);
+                if (!res.destroyed)
+                    res.end();
+            }
+            else
+                this.respondWithStatus(res, status, undefined, { "Content-Type": "application/json" }, formatted);
+        }
+        finally {
+            session.close();
+            res.off("close", cancel);
+            req.off("aborted", cancel);
+            this.modernRequests.delete(res);
+            this.modernStreams.delete(res);
+            this.stopSseKeepAliveIfIdle();
+        }
+    }
     async handleGet(req, res) {
         if (this.sessionIdGenerator === undefined) {
             this.respondWithStatus(res, 405, undefined, {
@@ -675,10 +837,14 @@ export class StreamableHttpTransport {
             return;
         }
         this.sseKeepAliveInterval = setInterval(() => {
+            for (const response of this.modernStreams) {
+                if (!response.writableEnded)
+                    this.writeToLiveStream(response, ": keepalive\n\n");
+            }
             for (const streams of this.sseStreams.values()) {
                 for (const response of streams) {
                     if (!response.writableEnded) {
-                        this.writeToLiveGetStream(response, ": keepalive\n\n");
+                        this.writeToLiveStream(response, ": keepalive\n\n");
                     }
                 }
             }
@@ -686,7 +852,8 @@ export class StreamableHttpTransport {
         this.sseKeepAliveInterval.unref();
     }
     stopSseKeepAliveIfIdle() {
-        if ([...this.sseStreams.values()].some((streams) => streams.size > 0)) {
+        if (this.modernStreams.size > 0 ||
+            [...this.sseStreams.values()].some((streams) => streams.size > 0)) {
             return;
         }
         this.stopSseKeepAlive();
@@ -704,15 +871,19 @@ export class StreamableHttpTransport {
         }
         const id = this.nextNotificationEventId++;
         const data = JSON.stringify(notification);
-        this.recordSseEvent(sessionId, id, data);
         const streams = this.sseStreams.get(sessionId);
-        if (streams === undefined) {
-            return;
-        }
         const event = formatSseEvent({
             id: String(id),
             data
         });
+        if (Buffer.byteLength(event, "utf8") > this.maxResponseBytes) {
+            for (const response of streams ?? [])
+                response.destroy();
+            return;
+        }
+        this.recordSseEvent(sessionId, id, data);
+        if (streams === undefined)
+            return;
         let latestResponse;
         for (const response of streams) {
             if (!response.writableEnded) {
@@ -720,10 +891,16 @@ export class StreamableHttpTransport {
             }
         }
         if (latestResponse !== undefined) {
-            this.writeToLiveGetStream(latestResponse, event);
+            this.writeToLiveStream(latestResponse, event);
         }
     }
-    writeToLiveGetStream(response, data) {
+    writeToLiveStream(response, data) {
+        if (response.destroyed || response.writableEnded)
+            return;
+        if (Buffer.byteLength(data, "utf8") > this.maxResponseBytes) {
+            response.destroy();
+            return;
+        }
         if ((response.writableLength ?? 0) > this.maxStreamBufferBytes) {
             response.end();
             return;
@@ -754,7 +931,7 @@ export class StreamableHttpTransport {
         const history = this.sseEventHistory.get(sessionId) ?? [];
         for (const event of history) {
             if (event.id > lastEventId && !res.writableEnded) {
-                this.writeToLiveGetStream(res, formatSseEvent({ id: String(event.id), data: event.data }));
+                this.writeToLiveStream(res, formatSseEvent({ id: String(event.id), data: event.data }));
             }
         }
     }
@@ -877,6 +1054,10 @@ export class StreamableHttpTransport {
         this.respondWithStatus(res, statusCode, undefined, { "Content-Type": "application/json" }, JSON.stringify({ error: reason, message }));
     }
     respondWithStatus(res, statusCode, sessionId, headers, body) {
+        if (body !== undefined && Buffer.byteLength(body, "utf8") > this.maxResponseBytes) {
+            res.destroy();
+            return;
+        }
         res.writeHead(statusCode, this.withSessionHeader(headers, sessionId, res));
         res.end(body);
     }

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 export { createServer, defineSchema, Image, Audio, File, toContentBlocks, fileTypeFromBuffer, JSON_RPC_ERROR_CODES, ToolError } from "tiny-stdio-mcp-server";
-export type { Server, TypedSchema, ImageContent, AudioContent, EmbeddedResource, TextResourceContents, BlobResourceContents, ContentBlock, TextContent, FileTypeResult, ToolReturn, ServerOptions, ToolHandler, ToolDefinition, Tool, ToolAnnotations, ToolExecution, Icon, ContentAnnotations, ResourceLink, CallToolResult, PromptContentItem, PromptArgument, Prompt, PromptMessage, GetPromptResult, PromptHandler, PromptDefinition, Resource, ResourceTemplate, ResourceContents, ReadResourceResult, ResourceHandler, ResourceDefinition, ResourceTemplateDefinition, HandleResult, ContentItem, JSONSchema, JSONSchemaProperty, Transport, SDKTransport, JSONRPCRequest, JSONRPCResponse, JSONRPCError, JSONRPCMessage, JSONRPCNotification, InitializeResult } from "tiny-stdio-mcp-server";
+export type { Server, MessageRequestContext, MessageSession, MessageSessionContext, TypedSchema, TypedOutputSchema, ImageContent, AudioContent, EmbeddedResource, TextResourceContents, BlobResourceContents, ContentBlock, TextContent, FileTypeResult, ToolReturn, ServerOptions, ToolHandler, HandlerRequestContext, InputRequiredResult, ToolDefinition, Tool, ToolAnnotations, ToolExecution, Icon, ContentAnnotations, ResourceLink, CallToolResult, PromptContentItem, PromptArgument, Prompt, PromptMessage, GetPromptResult, PromptHandler, PromptDefinition, Resource, ResourceTemplate, ResourceContents, ReadResourceResult, ResourceHandler, ResourceDefinition, ResourceTemplateDefinition, HandleResult, ContentItem, JSONSchema, OutputSchema, JSONSchemaProperty, Transport, SDKTransport, JSONRPCRequest, JSONRPCResponse, JSONRPCError, JSONRPCMessage, JSONRPCNotification, InitializeResult, DiscoverResult } from "tiny-stdio-mcp-server";
 export { createExpressMiddleware, createExpressOAuthHandlers, createProtectedResourceMetadataRouter } from "./express-middleware.js";
 export type { CreateExpressOAuthHandlersOptions } from "./express-middleware.js";
 export { createHttpServer, createProtectedResourceMetadataDocument } from "./http-server.js";
-export type { HttpToolContext, HttpToolHandler, HttpAdditionalRequestHandler, HttpListenOptions, HttpServer, HttpServerHandle, HttpTransportOptions, ProtectedResourceMetadataOptions, TinyHttpMcpServerOAuthOptions } from "./http-server.js";
+export type { HttpToolContext, HttpRequestContext, HttpToolHandler, HttpAdditionalRequestHandler, HttpListenOptions, HttpServer, HttpServerHandle, HttpTransportOptions, ProtectedResourceMetadataOptions, TinyHttpMcpServerOAuthOptions } from "./http-server.js";
 export { TokenVerificationError } from "./auth.js";
 export type { RequestAuthInfo, TokenVerifier, VerifiedAccessToken } from "./auth.js";
 export { StreamableHttpTransport } from "./http-transport.js";

package/dist/modern-headers.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingHttpHeaders } from "node:http";
+import { type JSONRPCError, type JSONRPCNotification, type JSONRPCRequest } from "tiny-stdio-mcp-server";
+export declare function validateModernHeaders(headers: IncomingHttpHeaders, request: JSONRPCRequest | JSONRPCNotification): JSONRPCError | undefined;

package/dist/modern-headers.js

@@ -0,0 +1,35 @@
+import { JSON_RPC_ERROR_CODES } from "tiny-stdio-mcp-server";
+import { decodeHeaderValue } from "tiny-stdio-mcp-server/headers";
+export function validateModernHeaders(headers, request) {
+    const metadata = request.params?._meta;
+    const version = typeof metadata === "object" && metadata !== null
+        ? metadata["io.modelcontextprotocol/protocolVersion"]
+        : undefined;
+    if (typeof version !== "string")
+        return {
+            code: JSON_RPC_ERROR_CODES.INVALID_PARAMS,
+            message: "Missing protocol version request metadata"
+        };
+    const expected = { "mcp-protocol-version": version };
+    // Notifications require the protocol version header but no method/name mirrors.
+    if ("id" in request) {
+        expected["mcp-method"] = request.method;
+        if (request.method === "tools/call" || request.method === "prompts/get")
+            expected["mcp-name"] = request.params?.name;
+        else if (request.method === "resources/read")
+            expected["mcp-name"] = request.params?.uri;
+    }
+    for (const [field, value] of Object.entries(expected)) {
+        const header = headers[field];
+        const actual = field === "mcp-name"
+            ? decodeHeaderValue(header)
+            : typeof header === "string"
+                ? header
+                : undefined;
+        if (typeof value !== "string" || actual === undefined || actual !== value)
+            return {
+                code: -32020,
+                message: `Header mismatch: ${field} must match the request body`
+            };
+    }
+}

package/dist/parse-body.d.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage } from "node:http";
 import type { JSONRPCMessage, JSONRPCNotification, JSONRPCRequest, JSONRPCResponse } from "tiny-stdio-mcp-server";
 export interface ClassifiedBody {
+    isBatch: boolean;
     entries: Array<JSONRPCMessage | null>;
     messages: JSONRPCMessage[];
     hasRequests: boolean;

package/dist/parse-body.js

@@ -21,9 +21,7 @@ function isValidResponse(value) {
     if (!hasOwn(value, "id")) {
         return false;
     }
-    if (value.id !== null &&
-        typeof value.id !== "string" &&
-        typeof value.id !== "number") {
+    if (value.id !== null && typeof value.id !== "string" && typeof value.id !== "number") {
         return false;
     }
     const hasResult = hasOwn(value, "result");
@@ -61,7 +59,12 @@ async function readStreamBody(req, maxBytes) {
         }
         chunks.push(bytes);
     }
-    return Buffer.concat(chunks).toString("utf8");
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+    }
+    catch {
+        throw new Error("Parse error");
+    }
 }
 async function readRawBody(req, preParsed, options) {
     const reqWithBody = req;
@@ -145,6 +148,7 @@ export async function readAndClassifyBody(req, preParsed, options = {}) {
         entries.push(request);
     }
     return {
+        isBatch,
         entries,
         messages,
         hasRequests: requests.length > 0,
@@ -152,6 +156,6 @@ export async function readAndClassifyBody(req, preParsed, options = {}) {
         hasResponses: responses.length > 0,
         requests,
         notifications,
-        responses,
+        responses
     };
 }