modelcontextprotocol/conformance
Watch
1
0
Fork
You've already forked conformance
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: create fresh Server per request in auth test helpers (#141)

Browse source 
The auth test server helper and no-dns-rebinding-protection example
reused a single Server instance across requests, calling connect()
on each new transport. SDK v1.26.0's security fix (GHSA-345p-7cg4-v4c7)
now throws "Already connected to a transport" in this case.

Fix by wrapping Server creation in a factory function called per
request, matching the pattern already used by tools_call.ts and
everything-server.ts.

Also updates no-dns-rebinding-protection.ts to use registerTool()
instead of the deprecated tool() API.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Felix Weinberger 2026-02-10 19:22:16 +00:00 • committed by GitHub
commit 37225cef7d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 61 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

35
examples/servers/typescript/no-dns-rebinding-protection.ts
View file

@ -13,21 +13,27 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
import express from 'express';
// Create minimal MCP server
const server = new McpServer({
name: 'no-dns-rebinding-protection-server',
version: '1.0.0'
});
// Create a fresh MCP server per request to avoid "Already connected" errors
// after the v1.26.0 security fix (GHSA-345p-7cg4-v4c7)
function createMcpServer() {
const server = new McpServer({
name: 'no-dns-rebinding-protection-server',
version: '1.0.0'
});
// Add a simple tool
server.tool(
'echo',
'Echo the input back',
{ message: { type: 'string' } },
async ({ message }) => ({
content: [{ type: 'text', text: `Echo: ${message}` }]
})
);
server.registerTool(
'echo',
{
description: 'Echo the input back',
inputSchema: { message: { type: 'string' } }
},
async ({ message }) => ({
content: [{ type: 'text', text: `Echo: ${message}` }]
})
);
return server;
}
// === VULNERABLE EXPRESS APP ===
// This intentionally does NOT use createMcpExpressApp() or localhostHostValidation()
@ -37,6 +43,7 @@ app.use(express.json());
app.post('/mcp', async (req, res) => {
try {
const server = createMcpServer();
// Stateless: no session ID
const transport = new StreamableHTTPServerTransport({
sessionIdGenerator: undefined