fix(server): deregister terminated streamable HTTP sessions

Closed
MI
2mo ago
+35-1

Summary

  • remove terminated existing sessions from both session registries immediately after handling the request
  • add a regression test for the clean DELETE/session termination path

Fixes #3300

Scope

  • The fix is for the handshake-era streamable HTTP path. Released mcp 1.29.0 has no modern request handler, so clients negotiating a newer protocol version still use the affected handshake path there.
  • This is not mitigated through the public server APIs: session_idle_timeout is not accepted by streamable_http_app() or MCPServer, and FastMCP does not expose it either. Deployments using those APIs cannot configure the idle reaper without reaching into lower-level internals.

Validation

  • uv run --frozen ruff format ...
  • uv run --frozen ruff check src/mcp/server/streamable_http_manager.py tests/server/test_streamable_http_manager.py
  • uv run --frozen pyright src/mcp/server/streamable_http_manager.py tests/server/test_streamable_http_manager.py
  • uv run --frozen pytest tests/server/test_streamable_http_manager.py -q (31 passed)
  • git diff --check