🚀 Promote develop → main (@maxhealth.tech/mcp-http) - #17
Merged
Conversation
0.3.0 swapped the peer dependency to @modelcontextprotocol/server v2 but kept driving WebStandardStreamableHTTPServerTransport, which is the 2025-era transport: sessions, Mcp-Session-Id, and validation limited to mcp-protocol-version against a version list. The package peered on v2 while never serving 2026-07-28. This is the layer swap 0.3.0 did not do. handleMcpPost now delegates to createMcpHandler, so server/discover, the _meta envelope, MRTR, resultType and the inbound validation ladder that emits -32020 HeaderMismatch come from the SDK. Reimplementing that ladder here was the alternative: it covers header/body cross-checks plus SEP-2243 Mcp-Param-* validation against each tool's x-mcp-header declarations, with base64 sender-encoding and numeric canonicalisation. Closes #8 and #6's -32020 item. legacy is left at its default 'stateless', so 2025-era clients keep being served, one fresh instance per request. GET/DELETE answer 405, matching the Allow header the router already returned. Breaking: - handleMcpPost takes a createServer factory, not a constructed server: the SDK builds one instance per serving unit, per era. onError keeps its Response override, which createMcpHandler's reporting-only onerror cannot express; out-of-band SDK reports route through it alongside anything thrown. - handleMcpPostStateful, SessionStore and the stateful/sessionTtlMs options are removed, as scheduled in 0.3.0. Sessions do not exist in this revision. - Mcp-Session-Id and Last-Event-ID leave the CORS defaults. Also fixes mcpHono rebuilding its handler per request, which defeated the authorization-server metadata cache (closure state), re-fetching the AS document on every request rather than once per TTL. Verified: none of dicom-viewer, drypdf or legal-web reference any removed or changed export, so this is breaking on paper only. New acceptance tests assert a modern tool call with no initialize handshake, a -32020 header/body mismatch, and that 2025-era traffic is still served. bun run check green, 179 tests.
CI installs with --frozen-lockfile, so removing the dependency without regenerating the lockfile fails the install step.
The response body is piped through a TransformStream so the server closes only once it drains. Cancelling that pipe — what a client disconnecting mid-response does — rejects pipeTo, and `.finally()` re-raises it, so nothing ever handled the rejection. Not an SSE edge case: the SDK returns a ReadableStream body for ordinary JSON replies too, so this fired on any cancelled request. On Workers that is routine traffic. Present in the 0.3.x transport under the same `void pipeTo(...).finally(...)` shape, so it is a pre-existing bug this release inherits rather than introduces. The pipe and the subsequent close() now both swallow their own errors. Found by TDD before shipping 0.4.0. The regression test installs an unhandledRejection listener, cancels the body, and asserts nothing fires; it fails against the unfixed version. Also adds tests for contracts 0.4.0 changed that line coverage did not pin, since hono/index.ts read 100% while asserting nothing about them: - the Hono Context and env reach createServer - per-request context stays isolated across concurrent requests, which matters now the handler is shared rather than rebuilt per request - AS-metadata discovery is fetched once, not per request (the cache the per-request rebuild was silently defeating) - CORS and onRequest still apply to the delegated response And removes one type assertion from the Hono adapter by typing the platform context on the variable rather than at the call site.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR — merging
developintomain.Merging publishes to npm: release.yml stamps the changelog, tags, and publishes.
Commits ahead of main: 3
Updated: 2026-08-07 16:00:44 UTC