Skip to content

HTTP MCP SSE task bag retains completed stream tasks #2823

Description

@Widthdom

Evidence

In src/CodeIndex/Mcp/HttpMcpTransport.cs:

  • _sseStreams is declared as ConcurrentBag<Task>.
  • /events handling does _sseStreams.Add(Task.Run(() => RunEventStreamAsync(...))).
  • Code search finds no later reads, pruning, awaiting, or clearing of _sseStreams.

Impact

Every SSE connection leaves a Task reference in the transport for the life of the process, including completed streams. A long-running HTTP MCP server can accumulate stale task objects through repeated /events connects and disconnects.

Expected

Track active SSE streams in a structure that removes completed streams, or do not retain the task when stream lifetime is already represented by _eventStreams. If retaining is needed for shutdown, prune completed tasks and observe exceptions explicitly.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecurity

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions