fix(binding-mcp): return HTTP 404 for unknown/expired MCP session - #2528
Merged
Conversation
Per the MCP Streamable HTTP transport spec, a request bearing a terminated or unknown Mcp-Session-Id should get HTTP 404 so a spec-compliant client can detect it and reinitialize. GET, DELETE and POST requests with no matching session previously returned 400 (GET, DELETE) or a 200 wrapping a JSON-RPC -32600 error (POST), giving clients no reliable signal to recover. Also raises the default zilla.binding.mcp.inactivity.timeout from 60s to 300s, since 60s is easy to exceed during ordinary interactive use (e.g. an LLM agent client with think-time between tool calls), tearing down sessions the client still considers active. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B3SSVuazBL9vG9FTVUmUKm
…-not-found scenarios Per specs/AGENTS.md, every k3po scenario must be authored as a client.rpt/server.rpt pair with a NetworkIT method that runs them against each other to verify self-consistency, independent of the engine. The reject.request.session.unknown/missing scenarios added alongside the HTTP 404 fix only had client.rpt and the runtime IT; this adds the missing server.rpt peers and NetworkIT coverage. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B3SSVuazBL9vG9FTVUmUKm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Per the MCP Streamable HTTP transport spec, a server should respond to a request bearing a terminated/unknown
Mcp-Session-Idwith HTTP 404, which is the client's signal to discard the session and silently reinitialize.McpServerFactorynever returned a 404 for this case:tools/call) with an unknown/missing session returned HTTP 200 wrapping a JSON-RPC-32600 "Invalid Request"error, giving spec-compliant clients no reliable signal to recover.This PR:
STATUS_404constant and switches the GET/DELETE "session not found" rejection path from 400 to 404.onDecodeSessionNotFoundresponse path for POST so an unknown/missing session returns a bare HTTP 404 (mirroring the existingdoNetBeginRejectedBearerno-body-response pattern) instead of a 200 with a JSON-RPC error body.reject.request.session.unknown,reject.request.session.missing) plus matchingMcpServerITtests asserting the POST 404.Also raises the default
zilla.binding.mcp.inactivity.timeoutfromPT60StoPT300S. 60s is easy to exceed during ordinary interactive use (e.g. an LLM agent client with think-time between tool calls), tearing down sessions the client still considers active. Added aMcpConfigurationTestcase asserting the new default; the one existing IT that exercises timeout behavior already overrides the value explicitly via@Configure, so it's unaffected.Fixes #2525
Test plan
./mvnw clean installat the repo root (full reactor, all modules) — green exceptcloud/docker-image, which failed on a transient Docker Hub anonymous-pull rate limit (429) fetching the base JDK image, unrelated to this change (that module only packages already-built/tested jars into a container image, no code involved)runtime/binding-mcp'sMcpServerIT: 100/100 tests passing, including the two new session-not-found 404 testsruntime/binding-mcp'sMcpConfigurationTest: 9/9 tests passing, including the new default-timeout assertionspecs/binding-mcp.specbuilds clean with the new k3po scripts🤖 Generated with Claude Code
https://claude.ai/code/session_01B3SSVuazBL9vG9FTVUmUKm
Generated by Claude Code