Skip to content

Code Quality: PR #398 #1196

Code Quality: PR #398

Code Quality: PR #398 #1196

Triggered via dynamic May 6, 2026 21:40
Status Success
Total duration 1m 34s
Artifacts

codeql

on: dynamic
Matrix: analyze
Fit to window
Zoom out
Zoom in

Annotations

2 warnings
Orphaned pending request IDs can prevent idle shutdown indefinitely: src/server/request-lifecycle.ts#L61
If a JSON-RPC request is received but no matching response is ever sent (e.g., the handler throws asynchronously, the client disconnects mid-request, or a notification handler path completes without a response), the request ID remains in `pendingRequestIds` forever and `onRequestCompleted` is never called to balance the earlier `onRequestStarted`. Because this module powers the new idle-timeout shutdown, a single orphaned request will keep the active counter above zero and prevent the server from ever shutting down on idle, defeating the feature. The synchronous try/catch around `downstreamOnMessage` only handles thrown (sync) errors; rejected promises from an async downstream handler will not trigger the cleanup path.
Async downstream onmessage rejection leaves request pending forever: src/server/request-lifecycle.ts#L61
Transport.onmessage handlers in the MCP SDK return a Promise (the wrapper signature accepts a possibly-async handler). The try/catch around downstreamOnMessage(message, extra) only catches synchronous throws; a rejected promise will not enter the catch block. If the request handler rejects without producing a JSON-RPC response on the send path, the id stays in pendingRequestIds permanently, suppressing onRequestCompleted and preventing idle-shutdown from ever firing.