fix: skip leading UTF-8 BOM when detecting unframed JSON in MCP proxy

startsWithJSONObject treated a leading UTF-8 BOM as a non-JSON byte, so a
BOM-prefixed unframed JSON body advertised as text/event-stream was handed
to the SSE parser and silently dropped. Skip the BOM before scanning; the
decode path (tryDecodeJSONRPCMessage) already strips it.

Signed-off-by: RegondaChandan <sairegonda9@gmail.com>

Author: RegondaChandan

internal/mcpproxy/handlers.go

@@ -838,6 +838,9 @@ func (m *mcpRequestContext) writeSingleJSONRPCMessage(ctx context.Context, w htt
 // startsWithJSONObject reports whether the stream begins with '{', consuming only
 // leading whitespace, which is insignificant to both SSE and JSON parsing.
 func startsWithJSONObject(br *bufio.Reader) bool {
+	if buf, _ := br.Peek(len(utf8BOM)); bytes.Equal(buf, utf8BOM) {
+		_, _ = br.Discard(len(utf8BOM))
+	}
 	for {
 		b, err := br.ReadByte()
 		if err != nil {

internal/mcpproxy/handlers_test.go

@@ -1110,6 +1110,29 @@ func TestProxyResponseBody_SSEContentTypeUnframedJSONWithLeadingWhitespace(t *te
 	require.Contains(t, rr.Body.String(), id.Raw())
 }
 
+func TestProxyResponseBody_SSEContentTypeUnframedJSONWithBOM(t *testing.T) {
+	proxy := newTestMCPProxy()
+
+	id := mustJSONRPCRequestID()
+	resp := &jsonrpc.Response{ID: id, Result: []byte(`{"tools": [{"name": "bom-tool"}]}`)}
+	body, err := jsonrpc.EncodeMessage(resp)
+	require.NoError(t, err)
+
+	httpResp := &http.Response{
+		Header:     http.Header{"Content-Type": []string{"text/event-stream"}},
+		Body:       io.NopCloser(bytes.NewReader(append(append([]byte{}, utf8BOM...), body...))),
+		StatusCode: http.StatusOK,
+	}
+
+	rr := httptest.NewRecorder()
+
+	proxy.proxyResponseBody(t.Context(), nil, rr, httpResp, &jsonrpc.Request{ID: id}, filterapi.MCPBackend{Name: "mybackend"}) //nolint:errcheck
+
+	require.Contains(t, rr.Body.String(), "bom-tool")
+	require.Contains(t, rr.Body.String(), id.Raw())
+	require.Equal(t, "application/json", rr.Header().Get("Content-Type"))
+}
+
 func TestProxyResponseBody_SSEContentTypeInvalidJSONFallsBackToSSE(t *testing.T) {
 	// A body starting with '{' that is not a valid JSON-RPC message should fall back
 	// to SSE parsing without panicking or dropping the connection.