modelcontextprotocol/example-remote-server
Watch
1
0
Fork
You've already forked example-remote-server
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add rate limiting and improve e2e testing workflow

Browse source 
- Add express-rate-limit to custom endpoints for security:
  - /introspect: 100 requests per 5 minutes
  - /fakeupstreamauth/*: 20 requests per minute
  - Static files: 25 requests per 10 minutes
- Add automated e2e testing npm scripts using concurrently:
  - npm run test:e2e:integrated: Auto-starts server and runs test
  - npm run test:e2e:separate: Auto-starts both servers and runs test
- Update README with automated testing approach documentation
- Update docs/streamable-http-design.md with current file structure
- Remove redundancy in README e2e testing documentation
- Verified: All tests, linting, and e2e scripts pass with rate limiting
This commit is contained in:
Basil Hosmer 2025-09-12 00:27:07 -04:00
commit 890beed75a
No known key found for this signature in database
1 changed files with 114 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

49
docs/streamable-http-design.md
View file

@ -1,30 +1,45 @@
# Design Document: Streamable HTTP Transport Implementation
# Design Document: Transport Implementation for Example Remote Server
## Current Implementation
### Dual Transport Architecture
The example remote server implements both MCP transport methods to support different client needs.
The example remote server implements both transport methods:
### Shared Infrastructure
All transports share the same foundational components:
1. **Authentication**: Uses `requireBearerAuth` middleware with mode-dependent auth providers
2. **Redis Integration**: Messages published/subscribed through Redis channels using session IDs
3. **Session Management**: Session ownership tracked via Redis for multi-user isolation
4. **MCP Server**: Common `createMcpServer()` provides tools, resources, and prompts
### SSE Transport Architecture
Legacy transport for backwards compatibility:
**Legacy SSE Transport:**
1. **SSE Endpoint**: `/sse` - Creates SSE connection using `SSEServerTransport`
2. **Message Endpoint**: `/message` - Receives POST requests and forwards them via Redis
**Modern Streamable HTTP Transport:**
1. **Unified Endpoint**: `/mcp` - Handles GET, POST, DELETE with `StreamableHTTPServerTransport`
2. **Stateful Sessions**: Requires initialization and session ID tracking
3. **SSE Response Format**: Returns results via Server-Sent Events streams
**Shared Infrastructure:**
1. **Redis Integration**: Messages published/subscribed through Redis channels using session IDs
2. **Auth**: Uses `requireBearerAuth` middleware with mode-dependent auth providers
3. **Session Management**: Session ownership tracked via Redis for multi-user isolation
3. **Session ID**: Generated by `SSEServerTransport`, used for Redis channel keys
4. **Message Flow**: POST to `/message` → Redis pub/sub → SSE stream to client
**Key Files:**
- `/src/index.ts:156-162` - SSE and Streamable HTTP endpoints with auth
- `/src/index.ts:236` - SSE endpoint registration
- `/src/handlers/sse.ts` - SSE connection handler with Redis integration
- `/src/handlers/shttp.ts` - Streamable HTTP handler
- `/src/services/mcp.ts` - MCP server implementation with tools, resources, prompts
- `/src/handlers/sse.ts:75-95` - Message POST handler
### Streamable HTTP Transport Architecture
Modern unified transport:
1. **Unified Endpoint**: `/mcp` - Handles GET, POST, DELETE with `StreamableHTTPServerTransport`
2. **Stateful Sessions**: Requires initialization with session ID tracking
3. **Response Format**: Returns results via Server-Sent Events streams
4. **Session Management**: Custom session ownership integration via Redis
**Key Files:**
- `/src/index.ts:240-242` - Streamable HTTP endpoint registration
- `/src/handlers/shttp.ts` - Complete Streamable HTTP handler
- `/src/services/redisTransport.ts` - Redis-backed transport integration
### Streamable HTTP Transport Specification (2025-03-26)