PR #398 #1201
codeql
on: dynamic
Matrix: analyze
Annotations
1 warning
|
Async downstream onmessage rejections leak pending requests and block idle shutdown:
src/server/request-lifecycle.ts#L61
The wrapped onmessage uses a synchronous try/catch around downstreamOnMessage(message, extra), but the MCP SDK's Protocol message handler is async and returns a Promise. If the downstream handler rejects asynchronously without ever sending a response (e.g. an unhandled error during dispatch, a thrown error in a request handler that the SDK fails to translate to an error response), the pendingRequestIds entry is never deleted and the observer's onRequestCompleted is never invoked. Because resolveMcpIdleShutdown only triggers when inFlightRequestCount drops to 0, a single such failure permanently prevents the idle timeout from firing, defeating the feature.
|