Code Quality: PR #398 #1196
codeql
on: dynamic
Matrix: analyze
Annotations
2 warnings
|
Orphaned pending request IDs can prevent idle shutdown indefinitely:
src/server/request-lifecycle.ts#L61
If a JSON-RPC request is received but no matching response is ever sent (e.g., the handler throws asynchronously, the client disconnects mid-request, or a notification handler path completes without a response), the request ID remains in `pendingRequestIds` forever and `onRequestCompleted` is never called to balance the earlier `onRequestStarted`. Because this module powers the new idle-timeout shutdown, a single orphaned request will keep the active counter above zero and prevent the server from ever shutting down on idle, defeating the feature. The synchronous try/catch around `downstreamOnMessage` only handles thrown (sync) errors; rejected promises from an async downstream handler will not trigger the cleanup path.
|
|
Async downstream onmessage rejection leaves request pending forever:
src/server/request-lifecycle.ts#L61
Transport.onmessage handlers in the MCP SDK return a Promise (the wrapper signature accepts a possibly-async handler). The try/catch around downstreamOnMessage(message, extra) only catches synchronous throws; a rejected promise will not enter the catch block. If the request handler rejects without producing a JSON-RPC response on the send path, the id stays in pendingRequestIds permanently, suppressing onRequestCompleted and preventing idle-shutdown from ever firing.
|