stacklok / toolhive / 29770527329

69%

Build Type

push

github

Committed by web-flow

Commit Message

Serve MCP 2026-07-28 stateless requests through the transparent proxy (#5884)

* Centralize MCP classification-error rendering

The streamable proxy rendered ClassifyRevision errors as HTTP 400 JSON-RPC
error bodies via a local helper. The transparent proxy will need the same
rendering (issue #5831), so lift it into pkg/mcp as a single source of truth:

- WriteClassificationError writes to an http.ResponseWriter (streamable).
- ClassificationErrorResponse builds an *http.Response for use from
  tracingTransport.RoundTrip, where no ResponseWriter is available.

Both share one body-computation helper, mirroring the
session.NotFoundBody/WriteNotFound/NotFoundResponse precedent. Wire output is
byte-identical; the streamable local copy is removed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Make transparent proxy method gate revision-aware

The transparent proxy only rejected GET/HEAD/DELETE with 405 in --stateless
mode. A Modern (2026-07-28, stateless) MCP request has no protocol use for
those methods either, regardless of proxy mode, so the gate should reject them
whenever the request is tagged Modern.

Replace statelessMethodGate with a p.methodGate method that 405s GET/HEAD/DELETE
when p.stateless OR the MCP-Protocol-Version header is exactly the Modern
version, and wire it unconditionally. The gate stays outermost (pre-auth) and
header-only -- it never reads the body, so it does not call ClassifyRevision.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Classify Modern POST requests in transparent proxy

The transparent proxy forwarded every POST unclassified, so a malformed
2026-07-28 (Modern, stateless) request reached the backend instead of being
rejected at the edge, and no revision signal was available for the health
readiness fix.

Parse the JSON-RPC body once (parseRPCRequest, replacing detectInitialize) to
recover method, params, and id. Only a single request (non-empty method and a
valid non-null id) is classified v... (continued)

Coverage Stats

89 of 89 new or added lines in 3 files covered. (100.0%)

19 existing lines in 5 files now uncovered.

75692 of 109972 relevant lines covered (68.83%)

71.66 hits per line