Commit Graph

7 Commits

Author SHA1 Message Date
Mathias Bergqvist
93c5a6934b feat(mcp): cap inbound request body at 1 MiB
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:58:36 +02:00
Mathias Bergqvist
ba5068648b refactor(mcp): compose origin allowlist as middleware, remove duplication
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:58:08 +02:00
Mathias Bergqvist
36765b8360 feat(mcp): streamable HTTP transport with session, init, and dispatch
Implements the Streamable HTTP transport: POST routing handles initialize
(issues session ID), tools/list, tools/call, and unknown methods; GET SSE
emits a keepalive comment then blocks on context cancellation. A minimal
registry stub is introduced so the server compiles and tools/list returns
an empty array until Phase 6+ registers real tools.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:49:54 +02:00
Mathias Bergqvist
50a3b27825 test(mcp): pin session concurrency, document error codes, assert id round-trip
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-04 20:46:07 +02:00
Mathias Bergqvist
ea19516109 feat(mcp): origin allowlist middleware 2026-05-04 20:41:21 +02:00
Mathias Bergqvist
cf2017e687 feat(mcp): session id store 2026-05-04 20:40:53 +02:00
Mathias Bergqvist
abaf5e8b1d feat(mcp): jsonrpc envelope types and error codes 2026-05-04 20:40:29 +02:00