mcp-stdio 0.3.2__tar.gz → 0.3.3__tar.gz

{mcp_stdio-0.3.2 → mcp_stdio-0.3.3}/.github/workflows/release.yml

@@ -11,6 +11,16 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Verify __version__ matches tag
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(python3 -c "import re; print(re.search(r'__version__ = \"([^\"]+)\"', open('src/mcp_stdio/__init__.py').read()).group(1))")
+          if [ "$TAG" != "$PKG_VERSION" ]; then
+            echo "::error::Tag v$TAG does not match __version__ $PKG_VERSION in src/mcp_stdio/__init__.py"
+            exit 1
+          fi
+          echo "Verified: tag v$TAG matches __version__ $PKG_VERSION"
+
       - name: Set up Python
         uses: actions/setup-python@v6
         with:

{mcp_stdio-0.3.2 → mcp_stdio-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-stdio
-Version: 0.3.2
+Version: 0.3.3
 Summary: Stdio-to-HTTP relay for MCP servers
 Project-URL: Homepage, https://github.com/shigechika/mcp-stdio
 Project-URL: Issues, https://github.com/shigechika/mcp-stdio/issues
@@ -162,6 +162,7 @@ Works around known issues in Claude Code's HTTP transport:
 - **Missing Accept header** — servers return 406, misinterpreted as auth failure ([#42470](https://github.com/anthropics/claude-code/issues/42470))
 - **OAuth fallback loop** — Claude Code enters OAuth discovery even when not needed ([#34008](https://github.com/anthropics/claude-code/issues/34008), [#39271](https://github.com/anthropics/claude-code/issues/39271))
 - **Session lost after disconnect** — mcp-stdio recovers MCP sessions automatically on 404 ([#34498](https://github.com/anthropics/claude-code/issues/34498), [#38631](https://github.com/anthropics/claude-code/issues/38631))
+- **OAuth scope omitted** — Claude Code sends no `scope` parameter in authorization requests, causing strict OAuth servers to reject the flow ([#4540](https://github.com/anthropics/claude-code/issues/4540)); mcp-stdio sends scopes via `--oauth-scope`
 - **Proxy settings ignored** — Claude Code does not respect `NO_PROXY` ([#34804](https://github.com/anthropics/claude-code/issues/34804)); mcp-stdio inherits proxy settings from httpx
 
 ## Features

{mcp_stdio-0.3.2 → mcp_stdio-0.3.3}/README.ja.md

@@ -134,7 +134,8 @@ Claude Code の HTTP transport の既知の問題を回避できます：
 - **Accept ヘッダーの欠落** — サーバーが 406 を返し、認証エラーと誤認される（[#42470](https://github.com/anthropics/claude-code/issues/42470)）
 - **OAuth フォールバックループ** — OAuth 不要なサーバーでも OAuth 検出が走る（[#34008](https://github.com/anthropics/claude-code/issues/34008), [#39271](https://github.com/anthropics/claude-code/issues/39271)）
 - **切断後にセッションが失われる** — mcp-stdio は 404 で MCP セッションを自動回復（[#34498](https://github.com/anthropics/claude-code/issues/34498), [#38631](https://github.com/anthropics/claude-code/issues/38631)）
-- **プロキシ設定が無視される** — Claude Code が `NO_PROXY` を尊重しない（[#34804](https://github.com/anthropics/claude-code/issues/34804)）; mcp-stdio は httpx 経由でプロキシ設定を��承
+- **OAuth scope が送信されない** — 認可リクエストに `scope` パラメータが含まれず、厳格な OAuth サーバーがフローを拒否する（[#4540](https://github.com/anthropics/claude-code/issues/4540)）; mcp-stdio は `--oauth-scope` でスコープを送信
+- **プロキシ設定が無視される** — Claude Code が `NO_PROXY` を尊重しない（[#34804](https://github.com/anthropics/claude-code/issues/34804)）; mcp-stdio は httpx 経由でプロキシ設定を継承
 
 ## 機能
 

{mcp_stdio-0.3.2 → mcp_stdio-0.3.3}/README.md

@@ -136,6 +136,7 @@ Works around known issues in Claude Code's HTTP transport:
 - **Missing Accept header** — servers return 406, misinterpreted as auth failure ([#42470](https://github.com/anthropics/claude-code/issues/42470))
 - **OAuth fallback loop** — Claude Code enters OAuth discovery even when not needed ([#34008](https://github.com/anthropics/claude-code/issues/34008), [#39271](https://github.com/anthropics/claude-code/issues/39271))
 - **Session lost after disconnect** — mcp-stdio recovers MCP sessions automatically on 404 ([#34498](https://github.com/anthropics/claude-code/issues/34498), [#38631](https://github.com/anthropics/claude-code/issues/38631))
+- **OAuth scope omitted** — Claude Code sends no `scope` parameter in authorization requests, causing strict OAuth servers to reject the flow ([#4540](https://github.com/anthropics/claude-code/issues/4540)); mcp-stdio sends scopes via `--oauth-scope`
 - **Proxy settings ignored** — Claude Code does not respect `NO_PROXY` ([#34804](https://github.com/anthropics/claude-code/issues/34804)); mcp-stdio inherits proxy settings from httpx
 
 ## Features

{mcp_stdio-0.3.2 → mcp_stdio-0.3.3}/src/mcp_stdio/__init__.py

@@ -1,3 +1,3 @@
 """mcp-stdio: Stdio-to-HTTP relay for MCP servers."""
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"

{mcp_stdio-0.3.2 → mcp_stdio-0.3.3}/src/mcp_stdio/relay.py

@@ -10,6 +10,8 @@ from typing import Any
 
 import httpx
 
+from mcp_stdio import __version__
+
 MAX_RETRIES = 3
 RETRY_DELAY = 1  # seconds
 
@@ -99,6 +101,66 @@ def _post_and_stream(
     return None
 
 
+def _reinitialize(
+    client: httpx.Client,
+    url: str,
+    headers: dict[str, str],
+) -> str | None:
+    """Send an initialize handshake to establish a new MCP session.
+
+    Used to recover after a session expires (server returns 404 on the
+    next request). Performs the full MCP initialize handshake:
+
+    1. POST an ``initialize`` request to get a new session ID
+    2. POST a ``notifications/initialized`` notification to signal
+       readiness (required by the MCP spec before any other requests)
+
+    Returns the new session ID on success, or None on failure. The
+    initialize response payload is discarded — the caller only needs
+    the session ID for subsequent requests.
+    """
+    initialize_msg = json.dumps(
+        {
+            "jsonrpc": "2.0",
+            "method": "initialize",
+            "id": 0,
+            "params": {
+                "protocolVersion": "2024-11-05",
+                "capabilities": {},
+                "clientInfo": {"name": "mcp-stdio", "version": __version__},
+            },
+        }
+    )
+    try:
+        resp = client.post(url, content=initialize_msg, headers=headers)
+    except httpx.HTTPError as e:
+        log(f"re-initialize request failed: {e}")
+        return None
+    if resp.status_code != 200:
+        log(f"re-initialize returned HTTP {resp.status_code}")
+        return None
+    new_session_id = resp.headers.get("mcp-session-id")
+    if not new_session_id:
+        log("re-initialize response missing mcp-session-id header")
+        return None
+
+    # MCP spec: send notifications/initialized before any other requests
+    initialized_msg = json.dumps(
+        {"jsonrpc": "2.0", "method": "notifications/initialized"}
+    )
+    initialized_headers = dict(headers)
+    initialized_headers["Mcp-Session-Id"] = new_session_id
+    try:
+        resp = client.post(url, content=initialized_msg, headers=initialized_headers)
+    except httpx.HTTPError as e:
+        log(f"notifications/initialized failed: {e}")
+        return None
+    if resp.status_code not in (200, 202):
+        log(f"notifications/initialized returned HTTP {resp.status_code}")
+        return None
+    return new_session_id
+
+
 def test_connection(
     url: str,
     headers: dict[str, str],
@@ -118,15 +180,13 @@ def test_connection(
             "params": {
                 "protocolVersion": "2024-11-05",
                 "capabilities": {},
-                "clientInfo": {"name": "mcp-stdio", "version": "test"},
+                "clientInfo": {"name": "mcp-stdio", "version": __version__},
             },
         }
     )
 
     client = httpx.Client(
-        timeout=httpx.Timeout(
-            connect=timeout_connect, read=timeout_read, write=30, pool=10
-        )
+        timeout=httpx.Timeout(connect=timeout_connect, read=timeout_read, write=30, pool=10)
     )
 
     try:
@@ -169,9 +229,7 @@ def test_connection(
             tools = "yes" if caps.get("tools") else "no"
             resources = "yes" if caps.get("resources") else "no"
             prompts = "yes" if caps.get("prompts") else "no"
-            log(
-                f"✓ Capabilities: tools={tools}, resources={resources}, prompts={prompts}"
-            )
+            log(f"✓ Capabilities: tools={tools}, resources={resources}, prompts={prompts}")
         elif result_data and "error" in result_data:
             err = result_data["error"]
             log(f"✗ MCP error: {err.get('message', err)}")
@@ -273,11 +331,18 @@ def run(
                     )
                     continue
 
-            # Session expired (404) — reset and retry once
+            # Session expired (404) — reset, re-initialize, then retry
             if result.status_code == 404 and session_id:
-                log("session expired, resetting and retrying")
+                log("session expired, re-initializing and retrying")
                 session_id = None
+                new_session_id = _reinitialize(client, url, dict(headers))
+                if new_session_id is None:
+                    log("re-initialize failed, dropping request")
+                    print(_error_response("session lost", req_id), flush=True)
+                    continue
+                session_id = new_session_id
                 req_headers = dict(headers)
+                req_headers["Mcp-Session-Id"] = session_id
                 result = _post_and_stream(client, url, line, req_headers, req_id)
                 if result is None:
                     continue

{mcp_stdio-0.3.2 → mcp_stdio-0.3.3}/tests/test_relay.py

@@ -83,9 +83,7 @@ class TestPostAndStream:
             httpx_mock.add_exception(httpx.ConnectError("refused"))
         client = httpx.Client()
         with patch("mcp_stdio.relay.time.sleep"):
-            result = _post_and_stream(
-                client, "https://example.com/mcp", '{"id":1}', {}, 1
-            )
+            result = _post_and_stream(client, "https://example.com/mcp", '{"id":1}', {}, 1)
         assert result is None
 
     def test_non_200_returns_status(self, httpx_mock):
@@ -120,9 +118,7 @@ class TestRun:
             text=body,
             headers={"content-type": "application/json"},
         )
-        output = self._run_with_stdin(
-            httpx_mock, ['{"jsonrpc":"2.0","method":"init","id":1}']
-        )
+        output = self._run_with_stdin(httpx_mock, ['{"jsonrpc":"2.0","method":"init","id":1}'])
         assert json.loads(output.strip()) == json.loads(body)
 
     def test_sse_response(self, httpx_mock):
@@ -131,9 +127,7 @@ class TestRun:
             text=sse_body,
             headers={"content-type": "text/event-stream"},
         )
-        output = self._run_with_stdin(
-            httpx_mock, ['{"jsonrpc":"2.0","method":"init","id":1}']
-        )
+        output = self._run_with_stdin(httpx_mock, ['{"jsonrpc":"2.0","method":"init","id":1}'])
         assert json.loads(output.strip())["id"] == 1
 
     def test_empty_lines_skipped(self, httpx_mock):
@@ -173,8 +167,16 @@ class TestRun:
         req2 = httpx_mock.get_requests()[1]
         assert req2.headers["mcp-session-id"] == "sess-123"
 
-    def test_session_expired_retry(self, httpx_mock):
-        # First request sets a session ID
+    def test_session_expired_triggers_reinitialize_then_retry(self, httpx_mock):
+        """Reproduces the 404 -> 400 hang from FastMCP StreamableHTTP.
+
+        Before the fix, mcp-stdio cleared the session_id on 404 and just
+        re-sent the original request — but FastMCP requires an initialize
+        handshake on each new session, so the retry came back 400 and the
+        caller hung. The fix sends an initialize to establish a new
+        session first, then replays the original request with it.
+        """
+        # Request 1: init — server assigns sess-old
         httpx_mock.add_response(
             text='{"jsonrpc":"2.0","result":{},"id":1}',
             headers={
@@ -182,17 +184,28 @@ class TestRun:
                 "mcp-session-id": "sess-old",
             },
         )
-        # Second request gets 404 (session expired)
+        # Request 2: tool call with sess-old — server returns 404 (expired)
         httpx_mock.add_response(
             status_code=404,
             text="",
             headers={"content-type": "application/json"},
         )
-        # Retry after session reset succeeds
+        # Request 3: _reinitialize sends a fresh initialize — server assigns sess-new
+        httpx_mock.add_response(
+            text='{"jsonrpc":"2.0","result":{"protocolVersion":"2024-11-05"},"id":0}',
+            headers={
+                "content-type": "application/json",
+                "mcp-session-id": "sess-new",
+            },
+        )
+        # Request 4: _reinitialize sends notifications/initialized with sess-new
+        httpx_mock.add_response(status_code=202, text="")
+        # Request 5: original tool call replayed with sess-new — server returns result
         httpx_mock.add_response(
             text='{"jsonrpc":"2.0","result":{"ok":true},"id":2}',
             headers={"content-type": "application/json"},
         )
+
         output = self._run_with_stdin(
             httpx_mock,
             [
@@ -201,19 +214,108 @@ class TestRun:
             ],
         )
         lines = [x for x in output.strip().splitlines() if x]
+        # stdout gets the two original responses (init + call); the re-initialize
+        # handshake is internal and should not leak to stdout.
         assert len(lines) == 2
-        # Verify session was reset: the retry request should NOT have Mcp-Session-Id
+        assert json.loads(lines[1])["result"] == {"ok": True}
+
         requests = httpx_mock.get_requests()
-        assert len(requests) == 3
+        assert len(requests) == 5
+
+        # Request 2 (the call) still carried sess-old before the 404
+        assert requests[1].headers.get("mcp-session-id") == "sess-old"
+
+        # Request 3 is the re-initialize: no session header, body is initialize
         assert "mcp-session-id" not in requests[2].headers
+        init_body = json.loads(requests[2].content)
+        assert init_body["method"] == "initialize"
+
+        # Request 4 is notifications/initialized with sess-new
+        assert requests[3].headers.get("mcp-session-id") == "sess-new"
+        notif_body = json.loads(requests[3].content)
+        assert notif_body["method"] == "notifications/initialized"
+        assert "id" not in notif_body  # notifications must not carry an id
+
+        # Request 5 is the replayed tool call, now with sess-new
+        assert requests[4].headers.get("mcp-session-id") == "sess-new"
+        replay_body = json.loads(requests[4].content)
+        assert replay_body["method"] == "call"
+        assert replay_body["id"] == 2
+
+    def test_reinitialize_failure_returns_error(self, httpx_mock):
+        """If the post-404 re-initialize fails, we surface a JSON-RPC error
+        instead of silently dropping the original request."""
+        # Request 1: init
+        httpx_mock.add_response(
+            text='{"jsonrpc":"2.0","result":{},"id":1}',
+            headers={
+                "content-type": "application/json",
+                "mcp-session-id": "sess-old",
+            },
+        )
+        # Request 2: tool call -> 404
+        httpx_mock.add_response(status_code=404, text="")
+        # Request 3: re-initialize also fails (server still broken)
+        httpx_mock.add_response(status_code=500, text="")
+
+        output = self._run_with_stdin(
+            httpx_mock,
+            [
+                '{"jsonrpc":"2.0","method":"init","id":1}',
+                '{"jsonrpc":"2.0","method":"call","id":2}',
+            ],
+        )
+        lines = [x for x in output.strip().splitlines() if x]
+        # First response goes through, second is an error reply (not a hang)
+        assert len(lines) == 2
+        err = json.loads(lines[1])
+        assert err["id"] == 2
+        assert err["error"]["code"] == -32000
+        assert "session lost" in err["error"]["message"]
+
+    def test_reinitialize_notifications_initialized_failure_returns_error(
+        self, httpx_mock
+    ):
+        """If the initialize succeeds but the notifications/initialized step
+        fails, we treat the whole re-init as failed and surface an error."""
+        httpx_mock.add_response(
+            text='{"jsonrpc":"2.0","result":{},"id":1}',
+            headers={
+                "content-type": "application/json",
+                "mcp-session-id": "sess-old",
+            },
+        )
+        httpx_mock.add_response(status_code=404, text="")
+        # Initialize succeeds — server assigns sess-new
+        httpx_mock.add_response(
+            text='{"jsonrpc":"2.0","result":{},"id":0}',
+            headers={
+                "content-type": "application/json",
+                "mcp-session-id": "sess-new",
+            },
+        )
+        # notifications/initialized fails
+        httpx_mock.add_response(status_code=500, text="")
+
+        output = self._run_with_stdin(
+            httpx_mock,
+            [
+                '{"jsonrpc":"2.0","method":"init","id":1}',
+                '{"jsonrpc":"2.0","method":"call","id":2}',
+            ],
+        )
+        lines = [x for x in output.strip().splitlines() if x]
+        assert len(lines) == 2
+        err = json.loads(lines[1])
+        assert err["id"] == 2
+        assert err["error"]["code"] == -32000
+        assert "session lost" in err["error"]["message"]
 
     def test_request_failure_returns_error(self, httpx_mock):
         for _ in range(3):
             httpx_mock.add_exception(httpx.ConnectError("refused"))
         with patch("mcp_stdio.relay.time.sleep"):
-            output = self._run_with_stdin(
-                httpx_mock, ['{"jsonrpc":"2.0","method":"init","id":5}']
-            )
+            output = self._run_with_stdin(httpx_mock, ['{"jsonrpc":"2.0","method":"init","id":5}'])
         result = json.loads(output.strip())
         assert result["error"]["code"] == -32000
         assert result["id"] == 5