v1.0.3 — the HTTP transport under test, and a 413 that never arrived

Fixed

The HTTP transport never delivered its 413.

When a request body exceeded SYMFONY_MCP_MAX_PAYLOAD_BYTES, readBody called req.destroy() on hitting the limit. That tears down the socket before the handler can write its response, so the client saw a hung-up connection — indistinguishable from a network fault, with no indication that the payload was the problem.

The read now pauses instead, letting TCP backpressure slow the sender, and the socket is closed only after the 413 has been written.

This was found by the first test ever written against that file.

Added

src/transport/http-transport.ts had no tests. It was the only file in the project without any, and the only one reachable from the network. It now has 39, run against a real listener on a real port rather than mocked request objects:

• Security headers on every response, including the refusals, and HSTS present over TLS and absent over plaintext
• IP allowlist: exact matches, CIDR ranges, and malformed entries failing closed rather than allowing everyone
• Payload cap, session-token rejection through header, bearer token and query string, per-IP rate limiting with Retry-After
• TLS and mutual TLS against a certificate generated for the run
• A full SSE-plus-POST exchange, from opening the stream to posting a message back to its session

0% → 99.5% of lines, 100% of functions. 1,014 tests in total.

Also ships from the commits since v1.0.2:

• The MCPB bundle (pnpm run build:mcpb) that Smithery distributes for local installs, replacing a smithery.yaml written against a publishing route retired in September 2025
• A project icon, carried inside the bundle
• The attestation fix: the previous release published correctly but the job went red, because the verification step moved the tarball out of the workspace before the attest step looked for it

Full changelog: https://github.com/shakaran/symfony-agent-mcp/blob/main/CHANGELOG.md