Andrey Mnatsakanov ea417bcd11 fix(mcp): detach SSE keep-alive so it cannot wedge the HTTP server ...

The MCP HTTP server serves connections sequentially on the single
current-thread runtime (the browser session is !Send). The SSE branch
(GET /mcp, Accept: text/event-stream) ran an infinite keep-alive ping loop
inline, so handle_connection never returned and the accept loop never ran
again — one open SSE stream hung every later POST /mcp tool call
indefinitely (functional break + trivial unauthenticated DoS).

The keep-alive carries no browser state and its write half is Send + 'static,
so spawn the ping loop on its own task and return from the handler. POST
handling stays serialized (correct for a single browser session), but a live
SSE stream no longer blocks the accept loop.

Fixes #489

2026-07-26 11:05:57 +02:00

..

cors_preflight.rs

Security: cap MCP HTTP request bodies and add optional Origin allowlist (#280)

2026-06-10 19:10:18 +00:00

sse_stream_does_not_wedge.rs

fix(mcp): detach SSE keep-alive so it cannot wedge the HTTP server

2026-07-26 11:05:57 +02:00