Issues

• Legacy POST accepts messages that are not JSON-RPC 2.0

  platformatic/mcp#344 · Filter by author mcollina opened on Oct 19, 2026

• HEAD /mcp with enableSSE opens an SSE session and never sends headers

  platformatic/mcp#343 · Filter by author mcollina opened on Oct 19, 2026

• toolArgumentLimits is not validated; NaN silently removes the limit

  platformatic/mcp#342 · Filter by author mcollina opened on Oct 19, 2026

• /.well-known/oauth-protected-resource/mcp advertises a resource whose tokens are then rejected

  platformatic/mcp#341 · Filter by author mcollina opened on Oct 19, 2026

• Under a route prefix, protected resource metadata requires a token and the advertised URL is 404

  platformatic/mcp#340 · Filter by author mcollina opened on Oct 19, 2026

• With tasks disabled, a 2025-11-25 tools/call carrying task is refused instead of run normally

  platformatic/mcp#339 · Filter by author mcollina opened on Oct 19, 2026

• stdio: a bare \r inside a message splits it into two parse errors

  platformatic/mcp#338 · Filter by author mcollina opened on Oct 19, 2026

• Resource unsubscribe handlers are not reference-counted across eras and never run on legacy session expiry

  platformatic/mcp#337 · Filter by author mcollina opened on Oct 18, 2026

• Legacy SSE GET ignores resolveAuthorizationContext expiresAt

  platformatic/mcp#336 · Filter by author mcollina opened on Oct 18, 2026

• Legacy SSE GET drops headers set by hooks (CORS, security headers)

  platformatic/mcp#335 · Filter by author mcollina opened on Oct 18, 2026

• Disconnecting during a Last-Event-ID replay leaves a dead SSE stream and the session answers 409 forever

  platformatic/mcp#334 · Filter by author mcollina opened on Oct 18, 2026

• tasks/result leaves a waiter behind forever when its client has already disconnected

  platformatic/mcp#333 · Filter by author mcollina opened on Oct 18, 2026

• tasks/list reports tasks with a lapsed lease as working

  platformatic/mcp#330 · Filter by author mcollina opened on Oct 17, 2026

• Redis backend leaks a broker subscription for every expired legacy session

  platformatic/mcp#329 · Filter by author mcollina opened on Oct 17, 2026

• Redis: a legacy SSE stream on another instance never receives per-session messages

  platformatic/mcp#328 · Filter by author mcollina opened on Oct 17, 2026

• Legacy SSE sessions stop receiving messages after their first GET stream closes, even with Last-Event-ID

  platformatic/mcp#327 · Filter by author mcollina opened on Oct 17, 2026

• All unauthenticated callers share one retained-task allowance

  platformatic/mcp#320 · Filter by author mcollina opened on Oct 16, 2026

• JSON-RPC batch handling ignores the negotiated protocol version

  platformatic/mcp#319 · Filter by author mcollina opened on Oct 16, 2026

• Request ids that are not a string or integer are processed and echoed back

  platformatic/mcp#318 · Filter by author mcollina opened on Oct 16, 2026

• Concurrent broadcasts give a legacy SSE session duplicate event ids

  platformatic/mcp#317 · Filter by author mcollina opened on Oct 16, 2026

• Legacy SSE streams buffer broadcasts without limit for a client that stops reading

  platformatic/mcp#316 · Filter by author mcollina opened on Oct 16, 2026

• Harden tool argument sanitization against special property names

  enhancement
  platformatic/mcp#311 · Filter by author mcollina opened on Oct 15, 2026

• Add configurable limits for sessions and resource subscriptions

  enhancement
  platformatic/mcp#312 · Filter by author mcollina opened on Oct 15, 2026

• README Plugin Options list is missing several options

  platformatic/mcp#305 · Filter by author mcollina opened on Oct 15, 2026

• POST with an unknown or expired Mcp-Session-Id is not answered 404

  platformatic/mcp#304 · Filter by author mcollina opened on Oct 15, 2026