modelcontextprotocol/conformance
Watch
1
0
Fork
You've already forked conformance
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: create fresh Server per request in auth test helpers (#141)

Browse source 
The auth test server helper and no-dns-rebinding-protection example
reused a single Server instance across requests, calling connect()
on each new transport. SDK v1.26.0's security fix (GHSA-345p-7cg4-v4c7)
now throws "Already connected to a transport" in this case.

Fix by wrapping Server creation in a factory function called per
request, matching the pattern already used by tools_call.ts and
everything-server.ts.

Also updates no-dns-rebinding-protection.ts to use registerTool()
instead of the deprecated tool() API.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Felix Weinberger 2026-02-10 19:22:16 +00:00 • committed by GitHub
commit 37225cef7d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 61 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

77
src/scenarios/client/auth/helpers/createServer.ts
View file

@ -41,43 +41,49 @@ export function createServer(
tokenVerifier,
prmResourceOverride
} = options;
const server = new Server(
{
name: 'auth-prm-pathbased-server',
version: '1.0.0'
},
{
capabilities: {
tools: {}
}
}
);
server.setRequestHandler(ListToolsRequestSchema, async () => {
return {
tools: [
{
name: 'test-tool',
inputSchema: { type: 'object' }
// Factory: create a fresh Server per request to avoid "Already connected" errors
// after the v1.26.0 security fix (GHSA-345p-7cg4-v4c7)
function createMcpServer() {
const server = new Server(
{
name: 'auth-prm-pathbased-server',
version: '1.0.0'
},
{
capabilities: {
tools: {}
}
]
};
});
server.setRequestHandler(
CallToolRequestSchema,
async (request): Promise<CallToolResult> => {
if (request.params.name === 'test-tool') {
return {
content: [{ type: 'text', text: 'test' }]
};
}
throw new McpError(
ErrorCode.InvalidParams,
`Tool ${request.params.name} not found`
);
}
);
);
server.setRequestHandler(ListToolsRequestSchema, async () => {
return {
tools: [
{
name: 'test-tool',
inputSchema: { type: 'object' }
}
]
};
});
server.setRequestHandler(
CallToolRequestSchema,
async (request): Promise<CallToolResult> => {
if (request.params.name === 'test-tool') {
return {
content: [{ type: 'text', text: 'test' }]
};
}
throw new McpError(
ErrorCode.InvalidParams,
`Tool ${request.params.name} not found`
);
}
);
return server;
}
const app = express();
app.use(express.json());
@ -151,6 +157,7 @@ export function createServer(
authMiddleware(req, res, async (err?: any) => {
if (err) return next(err);
const server = createMcpServer();
const transport = new StreamableHTTPServerTransport({
sessionIdGenerator: undefined
});