Skip to content

PR #398

PR #398 #1201

Triggered via dynamic May 7, 2026 07:32
Status Success
Total duration 1m 22s
Artifacts

codeql

on: dynamic
Matrix: analyze
Fit to window
Zoom out
Zoom in

Annotations

1 warning
Async downstream onmessage rejections leak pending requests and block idle shutdown: src/server/request-lifecycle.ts#L61
The wrapped onmessage uses a synchronous try/catch around downstreamOnMessage(message, extra), but the MCP SDK's Protocol message handler is async and returns a Promise. If the downstream handler rejects asynchronously without ever sending a response (e.g. an unhandled error during dispatch, a thrown error in a request handler that the SDK fails to translate to an error response), the pendingRequestIds entry is never deleted and the observer's onRequestCompleted is never invoked. Because resolveMcpIdleShutdown only triggers when inFlightRequestCount drops to 0, a single such failure permanently prevents the idle timeout from firing, defeating the feature.